CVE-2014-0196

MEDIUM(5.5)KEVElevated Risk

Linux Kernel Race Condition Vulnerability

Description

CVE-2014-0196 is a race condition vulnerability in the Linux kernel's n_tty_write function within the TTY driver subsystem. The flaw exists in versions through 3.14.3 and affects the handling of terminal driver access under specific "LECHO & !OPOST" conditions. A local attacker with low-level system privileges can trigger this race condition by performing concurrent read and write operations with long strings, leading to memory corruption that may cause a system crash or enable privilege escalation. This Linux kernel vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, and with an EPSS score of 61.8% it faces a high probability of active exploitation. The CVE-2014-0196 flaw impacts numerous downstream products including Debian, Red Hat Enterprise Linux, SUSE, Ubuntu, Oracle Linux, and multiple F5 BIG-IP appliances.

KEV Information

Vendor
Linux
Product
Kernel
Date Added
May 12, 2023
Due Date
June 2, 2023
Required Action
The impacted product is end-of-life and should be disconnected if still in use.

CVSS Score

Vector String
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HOpen in Calculator
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
Exploitability Score
1.8
Impact Score
3.6

CWEs

CWE-362Race Condition

Concurrent Execution using Shared Resource with Improper Synchronization

Affected Products

VendorProductVersion
linuxlinux kernel> 2.6.31, < 3.2.59; >= 3.3, < 3.4.91; >= 3.5, < 3.10.40; >= 3.11, < 3.12.20; >= 3.13, < 3.14.4; 2.6.31
debiandebian linux6.0; 7.0
redhatenterprise linux6.0
redhatenterprise linux eus6.3; 6.4
redhatenterprise linux server eus6.3
susesuse linux enterprise desktop11
susesuse linux enterprise high availability extension11
susesuse linux enterprise server11
oraclelinux6
canonicalubuntu linux10.04; 12.04; 12.10; 13.10; 14.04
f5big-ip access policy manager>= 11.1.0, <= 11.5.1
f5big-ip advanced firewall manager>= 11.3.0, <= 11.5.1
f5big-ip analytics>= 11.1.0, <= 11.5.1
f5big-ip application acceleration manager>= 11.4.0, <= 11.5.1
f5big-ip application security manager>= 11.1.0, <= 11.5.1
f5big-ip edge gateway>= 11.1.0, <= 11.3.0
f5big-ip global traffic manager>= 11.1.0, <= 11.5.1
f5big-ip link controller>= 11.1.0, <= 11.5.1
f5big-ip local traffic manager>= 11.1.0, <= 11.5.1
f5big-ip policy enforcement manager>= 11.3.0, <= 11.5.1

References

Weakness Type

CWE-362: Concurrent Execution Using Shared Resource with Improper Synchronization

CWE-362, commonly known as a race condition, occurs when multiple threads or processes access shared resources without proper synchronization. In the context of CVE-2014-0196, the Linux kernel's TTY driver fails to properly serialize concurrent read and write operations on terminal devices, allowing an attacker to exploit a timing window that leads to memory corruption.

Learn more: CWE-362 — Concurrent Execution Using Shared Resource with Improper Synchronization

Impact Analysis

Attack Vector (Local): CVE-2014-0196 requires local access to the system, meaning an attacker must already have a user account or shell access on the affected machine to exploit this vulnerability. Attack Complexity (Low): The exploit conditions are straightforward and do not require special preparation or winning a narrow timing window beyond triggering the race condition itself. Privileges Required (Low): A standard unprivileged user account is sufficient to trigger the vulnerability, making it accessible to any local user. Confidentiality and Integrity (None): While the CVSS v3.1 base score of 5.5 (Medium) reflects no direct data exfiltration or modification, the underlying memory corruption can lead to privilege escalation in practice. Availability (High): Successful exploitation causes memory corruption that can crash the entire system, resulting in a complete denial of service. The EPSS score of 61.8% (98th percentile) indicates that exploitation activity is highly likely, and CISA has confirmed active exploitation in the wild by adding CVE-2014-0196 to its Known Exploited Vulnerabilities catalog.

Exploit Maturity

Public exploit code is available for CVE-2014-0196 via multiple sources, including Exploit-DB and a Pastebin proof-of-concept. Additionally, the kernel commit on GitHub is tagged as an exploit reference. Active exploitation has been confirmed by CISA, which added this vulnerability to its Known Exploited Vulnerabilities catalog with a remediation deadline of June 2, 2023. The EPSS score of 61.8% places CVE-2014-0196 in the 98th percentile, indicating near-certain exploitation activity across the threat landscape. While the ransomware association is currently listed as unknown, the availability of mature public exploit code and confirmed active exploitation make this vulnerability a critical priority for patching.

Remediation

  1. Apply kernel patches immediately as directed by CISA's required action: apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Upgrade the Linux kernel to version 3.14.4 or later, which contains the fix in commit 4291086b1f081b869c6d79e5b7441633dc3ace00.
  2. Update distribution-specific packages by applying the relevant security advisories for your platform: Red Hat (RHSA-2014-0512), Debian (DSA-2926, DSA-2928), Ubuntu (USN-2196-1 through USN-2204-1), SUSE (openSUSE-SU-2014:0678), and Oracle Linux (ELSA-2014-0771). For F5 BIG-IP products, apply the mitigations described in SOL15319.
  3. Restrict local access to affected systems by auditing user accounts and removing unnecessary shell access. Since this vulnerability requires local privileges, reducing the number of users with interactive login capabilities minimizes the attack surface.
  4. Monitor for exploitation attempts by reviewing system logs for unexpected kernel panics, segmentation faults in TTY-related processes, or suspicious terminal operations involving high-volume read/write activity on pseudo-terminals.
  5. Implement defense-in-depth measures against race condition vulnerabilities by enabling kernel hardening options such as SELinux or AppArmor in enforcing mode, which can limit the impact of successful privilege escalation attempts.

Technical Details

Vulnerability mechanism: CVE-2014-0196 resides in the n_tty_write function in drivers/tty/n_tty.c, where the Linux kernel fails to properly manage concurrent access to the TTY driver when the terminal line discipline is configured with LECHO (local echo) enabled and OPOST (output post-processing) disabled. This specific configuration creates a race condition between the read and write paths of the N_TTY line discipline. Exploitation technique: An attacker triggers the vulnerability by initiating simultaneous read and write system calls with long string buffers on the same TTY device, exploiting the insufficient locking to corrupt kernel memory. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H reflects that while the base metric captures the denial-of-service impact, the memory corruption primitive can be leveraged for privilege escalation depending on the kernel memory layout and exploitation technique. Root cause: The underlying issue is a classic CWE-362 race condition where shared TTY buffer state is accessed by multiple execution contexts without adequate mutual exclusion, and the fix introduced proper locking to serialize these operations.

Frequently Asked Questions

Is CVE-2014-0196 being actively exploited?

Yes, CVE-2014-0196 is confirmed to be actively exploited in the wild. CISA added this vulnerability to its Known Exploited Vulnerabilities catalog with a remediation deadline of June 2, 2023. The EPSS score of 61.8% (98th percentile) further indicates a very high probability of exploitation activity.

What products are affected by CVE-2014-0196?

CVE-2014-0196 affects the Linux kernel through version 3.14.3. This impacts all major distributions including Red Hat Enterprise Linux, Debian, Ubuntu, SUSE Linux Enterprise, and Oracle Linux. Additionally, F5 BIG-IP products (Access Policy Manager, Application Security Manager, Local Traffic Manager, and others) that rely on affected kernel versions are also vulnerable.

How do I fix CVE-2014-0196?

Upgrade the Linux kernel to version 3.14.4 or later, or apply the distribution-specific security patches provided by your vendor (e.g., RHSA-2014-0512 for Red Hat, DSA-2926 for Debian). For F5 BIG-IP appliances, consult SOL15319 for applicable mitigations. See the Remediation section above for detailed steps.

How severe is CVE-2014-0196?

CVE-2014-0196 carries a CVSS v3.1 base score of 5.5 (Medium severity), reflecting the local access requirement and primary denial-of-service impact. However, the practical severity is elevated due to confirmed active exploitation, available public exploit code, and the potential for privilege escalation through memory corruption. The EPSS percentile of 98.3% places it among the most likely-to-be-exploited vulnerabilities.

CVSS Score

5.5
MEDIUM(5.5)

EPSS Score

EPSS Score22.48%
EPSS Percentile97.5%

Dates

PublishedMay 7, 2014
Last ModifiedJune 17, 2026
StatusAnalyzed
CVSS Versionv3.1

Quick Links

Back to CVE Database

Need Help With Vulnerability Management?

Our security experts can help you prioritize and remediate vulnerabilities effectively.

Get in Touch