# CVE-2014-0196

The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial of service (memory corruption and system crash) or gain privileges by triggering a race condition involving read and write operations with long strings.

- Page: https://www.vulneraibility.com/cve/CVE-2014-0196
- CVSS: 5.5
- Known exploited: yes, in CISA KEV since 2023-05-12; CISA due date 2023-06-02
- EPSS: 20.33% (percentile 97.5)
- Public exploit code: 1 on Exploit-DB · 2 GitHub proofs of concept (first 2014-05-13)
- CISA SSVC: exploitation active, automatable no, technical impact partial (assessed 2025-02-07)
- Weakness: CWE-362
- Published: 2014-05-07

## Affected

- linux:linux_kernel
- debian:debian_linux
- redhat:enterprise_linux
- redhat:enterprise_linux_eus
- redhat:enterprise_linux_server_eus
- suse:suse_linux_enterprise_desktop
- suse:suse_linux_enterprise_high_availability_extension
- suse:suse_linux_enterprise_server
- oracle:linux
- canonical:ubuntu_linux
- f5:big-ip_access_policy_manager
- f5:big-ip_advanced_firewall_manager
- f5:big-ip_analytics
- f5:big-ip_application_acceleration_manager
- f5:big-ip_application_security_manager
- f5:big-ip_edge_gateway
- f5:big-ip_global_traffic_manager
- f5:big-ip_link_controller
- f5:big-ip_local_traffic_manager
- f5:big-ip_policy_enforcement_manager
- f5:big-ip_protocol_security_module
- f5:big-ip_wan_optimization_manager
- f5:big-ip_webaccelerator
- f5:big-iq_application_delivery_controller
- f5:big-iq_centralized_management
- f5:big-iq_cloud
- f5:big-iq_cloud_and_orchestration
- f5:big-iq_device
- f5:big-iq_security
- f5:enterprise_manager

## References

- [advisory] http://www.ubuntu.com/usn/USN-2203-1
- [other] http://support.f5.com/kb/en-us/solutions/public/15000/300/sol15319.html
- [other] http://www.osvdb.org/106646
- [advisory] http://lists.opensuse.org/opensuse-security-announce/2014-05/msg00012.html
- [other] http://www.openwall.com/lists/oss-security/2014/05/05/6
- [advisory] http://secunia.com/advisories/59262
- [advisory] http://www.ubuntu.com/usn/USN-2204-1
- [advisory] http://secunia.com/advisories/59218
- [advisory] http://www.ubuntu.com/usn/USN-2202-1
- [exploit] http://www.exploit-db.com/exploits/33516
- [advisory] http://www.debian.org/security/2014/dsa-2928
- [advisory] http://www.ubuntu.com/usn/USN-2199-1
- [other] http://linux.oracle.com/errata/ELSA-2014-0771.html
- [other] https://bugzilla.redhat.com/show_bug.cgi?id=1094232
- [advisory] http://www.ubuntu.com/usn/USN-2197-1
- [other] http://source.android.com/security/bulletin/2016-07-01.html
- [advisory] http://rhn.redhat.com/errata/RHSA-2014-0512.html
- [advisory] http://secunia.com/advisories/59599
- [advisory] http://www.debian.org/security/2014/dsa-2926
- [other] https://github.com/torvalds/linux/commit/4291086b1f081b869c6d79e5b7441633dc3ace00
- [advisory] http://lists.opensuse.org/opensuse-security-announce/2014-05/msg00007.html
- [other] http://pastebin.com/raw.php?i=yTSFUBgZ
- [other] http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=4291086b1f081b869c6d79e5b7441633dc3ace00
- [other] http://bugzilla.novell.com/show_bug.cgi?id=875690
- [advisory] http://www.ubuntu.com/usn/USN-2198-1
- [advisory] http://www.ubuntu.com/usn/USN-2200-1
- [advisory] http://www.ubuntu.com/usn/USN-2201-1
- [advisory] http://www.ubuntu.com/usn/USN-2196-1
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-0196

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.