Race Condition Affecting kernel-debug-devel package, versions *


Severity

Recommended
medium

Based on CentOS security rating.

Threat Intelligence

EPSS
0.04% (6th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-CENTOS6-KERNELDEBUGDEVEL-1948819
  • published26 Jul 2021
  • disclosed7 Nov 2014

Introduced: 7 Nov 2014

CVE-2014-9710  (opens in a new tab)
CWE-362  (opens in a new tab)

How to fix?

There is no fixed version for Centos:6 kernel-debug-devel.

NVD Description

Note: Versions mentioned in the description apply only to the upstream kernel-debug-devel package and not the kernel-debug-devel package as distributed by Centos. See How to fix? for Centos:6 relevant fixed versions and status.

The Btrfs implementation in the Linux kernel before 3.19 does not ensure that the visible xattr state is consistent with a requested replacement, which allows local users to bypass intended ACL settings and gain privileges via standard filesystem operations (1) during an xattr-replacement time window, related to a race condition, or (2) after an xattr-replacement attempt that fails because the data does not fit.

CVSS Scores

version 3.1