01 Record

CVE-2014-3153

The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which allows local users to gain privileges via a crafted

HighKEVPUBLISHEDCNA: Chrome

CNA base score7.8 CVSS v3.xCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

View raw JSON

02 Description

03 Exploitation and scoring

Exploitation

Exploited in the wild. Listed in the CISA Known Exploited Vulnerabilities catalog on 2022-05-25. Federal remediation due 2022-06-15.

SSVC decision

ExploitationactiveCISA reports credible evidence of active exploitation.
AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
Technical ImpacttotalSuccessful exploitation gives total control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

37.23% probability of exploitation activity in the next 30 days.

EPSS percentile

Equal to or higher than the score of 98.3% of scored records. A rank, not a probability.

NVD base score

7.8 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD analysis status

Analyzed. NVD last modified this record on 2026-06-17.

Red Hat severity

Important. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published: 2014-06-07 14:00Z12 YR AGO
Last updated: 2025-10-22 00:05Z1 YR AGO
Reserved: 2014-05-03
Assigning CNA: Chrome
Record state: PUBLISHED
Severity: High (CVSS 7.8)
CNA CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses: No CWE assigned
Data version: 5.1
Document digest: f15995c83b7c93448facaae8aeae942bde81dcf309650b4afede843b904644fb

05 Affected products

VendorProductVersionsPlatforms

canonicalubuntu_linuxNot specified—

linuxlinux_kernelNot specified—

opensuseopensuseNot specified—

oraclelinuxNot specified—

redhatenterprise_linuxNot specified—

redhatenterprise_linux_server_ausNot specified—

redhatenterprise_mrgNot specified—

redhatrhel_eusNot specified—

redhatrhel_mission_criticalNot specified—

suselinux_enterprise_desktopNot specified—

suselinux_enterprise_high_availability_extensionNot specified—

suselinux_enterprise_real_time_extensionNot specified—

suselinux_enterprise_serverNot specified—

06 References

www.securityfocus.com67906http://www.securityfocus.com/bid/67906vdb-entryx_refsource_BID
lists.opensuse.orgopenSUSE-SU-2014:0878http://lists.opensuse.org/opensuse-security-announce/2014-07/msg00006.htmlvendor-advisoryx_refsource_SUSE
openwall.com[oss-security] 20140605 Re: Linux kernel futex local privilege escalation (CVE-2014-3153)http://openwall.com/lists/oss-security/2014/06/05/24mailing-listx_refsource_MLIST
secunia.com59029http://secunia.com/advisories/59029third-party-advisoryx_refsource_SECUNIA
www.debian.orgDSA-2949http://www.debian.org/security/2014/dsa-2949vendor-advisoryx_refsource_DEBIAN
lists.opensuse.orgSUSE-SU-2014:1316http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00006.htmlvendor-advisoryx_refsource_SUSE
lists.opensuse.orgSUSE-SU-2014:0796http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00018.htmlvendor-advisoryx_refsource_SUSE
secunia.com59262http://secunia.com/advisories/59262third-party-advisoryx_refsource_SECUNIA
secunia.com58990http://secunia.com/advisories/58990third-party-advisoryx_refsource_SECUNIA
git.kernel.orghttps://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=13fbca4c6ecd96ec1a1cfa2e4f2ce191fe928a5ex_refsource_CONFIRM
git.kernel.orghttps://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=54a217887a7b658e2650c3feff22756ab80c7339x_refsource_CONFIRM
git.kernel.orghttp://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=e9c243a5a6de0be8e584c604d353412584b592f8x_refsource_CONFIRM
linux.oracle.comhttp://linux.oracle.com/errata/ELSA-2014-3037.htmlx_refsource_CONFIRM
secunia.com59153http://secunia.com/advisories/59153third-party-advisoryx_refsource_SECUNIA
openwall.com[oss-security] 20140606 Re: Linux kernel futex local privilege escalation (CVE-2014-3153)http://openwall.com/lists/oss-security/2014/06/06/20mailing-listx_refsource_MLIST
secunia.com59309http://secunia.com/advisories/59309third-party-advisoryx_refsource_SECUNIA
github.comhttps://github.com/torvalds/linux/commit/e9c243a5a6de0be8e584c604d353412584b592f8x_refsource_CONFIRM
www.securitytracker.com1030451http://www.securitytracker.com/id/1030451vdb-entryx_refsource_SECTRACK
linux.oracle.comhttp://linux.oracle.com/errata/ELSA-2014-0771.htmlx_refsource_CONFIRM
lists.opensuse.orgSUSE-SU-2014:0775http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00014.htmlvendor-advisoryx_refsource_SUSE
rhn.redhat.comRHSA-2014:0800http://rhn.redhat.com/errata/RHSA-2014-0800.htmlvendor-advisoryx_refsource_REDHAT
www.ubuntu.comUSN-2237-1http://www.ubuntu.com/usn/USN-2237-1vendor-advisoryx_refsource_UBUNTU
lists.opensuse.orgSUSE-SU-2014:1319http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00007.htmlvendor-advisoryx_refsource_SUSE
linux.oracle.comhttp://linux.oracle.com/errata/ELSA-2014-3039.htmlx_refsource_CONFIRM
git.kernel.orghttps://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b3eaa9fc5cd0a4d74b18f6b8dc617aeaf1873270x_refsource_CONFIRM
secunia.com58500http://secunia.com/advisories/58500third-party-advisoryx_refsource_SECUNIA
www.ubuntu.comUSN-2240-1http://www.ubuntu.com/usn/USN-2240-1vendor-advisoryx_refsource_UBUNTU
bugzilla.redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=1103626x_refsource_CONFIRM
secunia.com59386http://secunia.com/advisories/59386third-party-advisoryx_refsource_SECUNIA
www.exploit-db.com35370http://www.exploit-db.com/exploits/35370exploitx_refsource_EXPLOIT-DB
secunia.com59599http://secunia.com/advisories/59599third-party-advisoryx_refsource_SECUNIA
lists.opensuse.orgSUSE-SU-2014:0837http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00025.htmlvendor-advisoryx_refsource_SUSE
www.openwall.com[oss-security] 20140605 Linux kernel futex local privilege escalation (CVE-2014-3153)http://www.openwall.com/lists/oss-security/2014/06/05/22mailing-listx_refsource_MLIST
secunia.com59092http://secunia.com/advisories/59092third-party-advisoryx_refsource_SECUNIA
linux.oracle.comhttp://linux.oracle.com/errata/ELSA-2014-3038.htmlx_refsource_CONFIRM
www.openwall.com[oss-security] 20210201 Re: Linux Kernel: local priv escalation via futexeshttp://www.openwall.com/lists/oss-security/2021/02/01/4mailing-listx_refsource_MLIST
www.openwall.comhttps://www.openwall.com/lists/oss-security/2021/02/01/4x_refsource_MISC
elongl.github.iohttps://elongl.github.io/exploitation/2021/01/08/cve-2014-3153.htmlx_refsource_MISC
github.comhttps://github.com/elongl/CVE-2014-3153x_refsource_MISC
www.cisa.govhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-3153government-resource

07 Fixed in

Debian 12

linux
Fixed in 3.14.5-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

linux
Fixed in 3.14.5-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

linux
Fixed in 3.14.5-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu 14.04 LTS

linux
Fixed in 3.13.0-29.53

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

A release or ecosystem missing from this list has no record here. It may be unaffected or not covered by the source. Source notices and licences.