CVE-2014-3153

HIGH(7.8)KEVElevated Risk

Linux Kernel Privilege Escalation Vulnerability

Description

CVE-2014-3153 is a local privilege escalation vulnerability in the Linux kernel caused by a flaw in the futex_requeue function within kernel/futex.c. The function fails to ensure that calls reference two different futex addresses, allowing a local user to exploit this race condition to gain root privileges on the affected system. This is one of the most well-known Linux kernel privilege escalation vulnerabilities, widely used in Android rooting exploits and targeted attacks. CISA has confirmed active exploitation by including CVE-2014-3153 in the Known Exploited Vulnerabilities catalog. With an EPSS percentile of 98.8%, this vulnerability represents one of the most likely-to-be-exploited CVEs in the entire database.

KEV Information

Vendor
Linux
Product
Kernel
Date Added
May 25, 2022
Due Date
June 15, 2022
Required Action
Apply updates per vendor instructions.

CVSS Score

Vector String
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in Calculator
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
1.8
Impact Score
5.9

Affected Products

VendorProductVersion
linuxlinux kernel< 3.2.60; >= 3.3, < 3.4.92; >= 3.5, < 3.10.42; >= 3.11, < 3.12.22; >= 3.13, < 3.14.6
redhatenterprise linux server aus6.2
opensuseopensuse11.4
suselinux enterprise desktop11
suselinux enterprise high availability extension11
suselinux enterprise real time extension11
suselinux enterprise server11
canonicalubuntu linux12.04; 14.04
oraclelinux5; 6

Multiple CVSS Assessments

Source: [email protected](Primary)
7.8
HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0(Secondary)
7.8
HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Weakness Type

Since no specific CWE has been assigned to CVE-2014-3153, the underlying weakness type remains formally unspecified. However, the vulnerability is a race condition in the kernel's futex (fast userspace mutex) implementation that results in improper validation of function arguments. The futex_requeue function does not verify that the two futex addresses provided as arguments are distinct, enabling an attacker to manipulate kernel memory through carefully crafted futex operations.

Impact Analysis

CVE-2014-3153 allows local users to escalate their privileges to root on any Linux system running an affected kernel version. The vulnerability requires local access to the system, meaning the attacker must already have user-level shell access or code execution capability on the target. However, once exploited, the impact is total: the attacker gains full root control over the system, including access to all files, credentials, running processes, and the ability to install persistent rootkits or kernel modules. The exploitation complexity is low, as stable and reliable exploit code has been publicly available for years. The EPSS percentile of 98.8% reflects this vulnerability's extreme popularity among attackers, particularly in Android environments where it was used as a key component in device rooting chains. Any unpatched Linux system or Android device running a vulnerable kernel version should be considered at critical risk.

Exploit Maturity

CVE-2014-3153 is one of the most extensively exploited Linux kernel vulnerabilities in history. CISA has confirmed active exploitation by including it in the Known Exploited Vulnerabilities catalog with a remediation deadline of June 15, 2022. The EPSS percentile of 98.8% places it in the top 2% of all CVEs for exploitation likelihood. Numerous public exploit implementations exist, including the well-known "towelroot" exploit that was widely used to root Android devices. The vulnerability has been incorporated into multiple exploit frameworks, privilege escalation toolkits, and post-exploitation suites, making it accessible to attackers of varying skill levels.

Remediation

  1. Update the Linux kernel to a patched version that addresses CVE-2014-3153. CISA's required action is to apply updates per vendor instructions. For most distributions, kernel updates from mid-2014 onward include the fix.
  2. For Android devices, ensure the device firmware has been updated to a version released after the June 2014 security patch that addresses this vulnerability.
  3. Implement kernel hardening measures such as enabling SMEP (Supervisor Mode Execution Prevention), SMAP (Supervisor Mode Access Prevention), and kernel address space layout randomization (KASLR) to make exploitation more difficult.
  4. Monitor systems for suspicious futex-related system calls and unexpected privilege transitions using audit logging and endpoint detection tools.
  5. Apply the principle of least privilege by restricting user shell access and using mandatory access control frameworks (SELinux, AppArmor) to limit the impact of privilege escalation even if the kernel vulnerability is exploited.

Technical Details

CVE-2014-3153 is a race condition vulnerability in the futex_requeue function located in kernel/futex.c of the Linux kernel. The futex (fast userspace mutex) subsystem provides efficient user-space locking primitives that involve kernel assistance for blocking and waking threads. The futex_requeue function is designed to move waiters from one futex to another, but it fails to validate that the source and destination futex addresses are different. By passing identical addresses, an attacker can trigger a use-after-free condition or corrupt kernel memory structures related to the futex wait queue. This memory corruption can be leveraged to overwrite kernel data structures and achieve arbitrary code execution in kernel context, resulting in complete privilege escalation from any unprivileged user to root. The attack is local, requiring the ability to make futex system calls, which is available to any unprivileged process on Linux. The exploit is reliable and does not require any special kernel configuration or module to be loaded.

Frequently Asked Questions

Is CVE-2014-3153 being actively exploited?

Yes, CVE-2014-3153 has been extensively exploited in the wild. CISA added it to the Known Exploited Vulnerabilities catalog, and the EPSS percentile of 98.8% confirms it is among the most exploited CVEs. It was the basis for the "towelroot" Android rooting exploit and has been incorporated into numerous exploitation frameworks.

What products are affected by CVE-2014-3153?

CVE-2014-3153 affects the Linux kernel in versions prior to the security patch applied in mid-2014. This includes all Linux distributions and Android devices running vulnerable kernel versions. The flaw is in the core futex subsystem, making it a cross-distribution and cross-device vulnerability.

How do I fix CVE-2014-3153?

Update the Linux kernel to a version that includes the fix for CVE-2014-3153. Most distribution vendors released patches in mid-2014. For Android devices, ensure firmware is updated beyond the June 2014 security patch level. Additionally, enable kernel hardening features like KASLR and SMEP.

How severe is CVE-2014-3153?

CVE-2014-3153 is a critical local privilege escalation vulnerability with an EPSS percentile of 98.8%. It allows any local user to gain root access with high reliability. Its widespread use in Android rooting and its inclusion in the CISA KEV catalog make it one of the most consequential Linux kernel vulnerabilities ever disclosed.

CVSS Score

7.8
HIGH(7.8)

EPSS Score

EPSS Score37.23%
EPSS Percentile98.4%

Dates

PublishedJune 7, 2014
Last ModifiedJune 17, 2026
StatusAnalyzed
CVSS Versionv3.1

Quick Links

Back to CVE Database

Need Help With Vulnerability Management?

Our security experts can help you prioritize and remediate vulnerabilities effectively.

Get in Touch