medium 6.9

CVE-2014-2851 json

Integer overflow in the ping_init_sock function in net/ipv4/ping.c in the Linux kernel through 3.14.1 allows local users to cause a denial…

published 2014-04-14 12y ago modified 2026-06-17 4mo ago also EUVD-2014-2876

cvss: 6.9; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.0%; EPSS 1.0% chance of exploitation in 30 days, percentile 61%
public exploits: 1; Exploit-DB

Integer overflow in the ping_init_sock function in net/ipv4/ping.c in the Linux kernel through 3.14.1 allows local users to cause a denial of service (use-after-free and system crash) or possibly gain privileges via a crafted application that leverages an improperly managed reference counter.

Patch / fix

fixed in 1 distros 3 links 4

linux linux_kernel 3.2.60, 3.4.92, 3.10.41, 3.12.19, 3.14.5

debian ubuntu red hat

linux Debian 14, Debian 13, Debian 12 3.14.4-1

debian advisories DEBIAN-CVE-2014-2851

linux Ubuntu 14.04 LTS 3.13.0-27.50

ubuntu advisories UBUNTU-CVE-2014-2851

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

kernel RHEL 6 2.6.32-431.23.3.el6
perf RHEL 6 2.6.32-431.23.3.el6
python-perf RHEL 6 2.6.32-431.23.3.el6
kernel-kdump RHEL 6 2.6.32-431.23.3.el6
kernel-firmware RHEL 6 2.6.32-431.23.3.el6
kernel-bootwrapper RHEL 6 2.6.32-431.23.3.el6
kernel-abi-whitelists RHEL 6 2.6.32-431.23.3.el6
kernel-debuginfo-common-i686 RHEL 6 2.6.32-431.23.3.el6

red hat advisories RHSA-2014:0981 RHSA-2014:0786 RHSA-2014:1101 RHSA-2014:0557

git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=b04c4619021… commit
bugzilla.redhat.com/show_bug.cgi?id=1086730 advisory
lkml.org/lkml/2014/4/10/736 advisory
openwall.com/lists/oss-security/2014/04/11/4 advisory

Is CVE-2014-2851 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2014-2851 updated 2026-11-04 cvss 6.2

kernel: net: ping: refcount issue in ping_init_sock() function

Red Hat Enterprise Linux Client (v. 7) perf 3.10.0-123.4.2.el7, kernel 3.10.0-123.4.2.el7, kernel-tools 3.10.0-123.4.2.el7, kernel-tools-libs 3.10.0-123.4.2.el7, kernel-abi-whitelists 3.10.0-123.4.2.el7, kernel-debuginfo-common-x86_64 3.10.0-123.4.2.el7 Red Hat Enterprise Linux Client Optional (v. 7) python-perf 3.10.0-123.4.2.el7, kernel-debuginfo-common-x86_64 3.10.0-123.4.2.el7
fixed: vendor fix RHSA-2014:0786
Red Hat Enterprise Linux Compute Node Optional EUS (v. 6.4) kernel 2.6.32-358.48.1.el6, python-perf 2.6.32-358.48.1.el6, kernel-debuginfo-common-x86_64 2.6.32-358.48.1.el6
fixed: vendor fix RHSA-2014:1101
Red Hat Enterprise Linux ComputeNode (v. 7) perf 3.10.0-123.4.2.el7, kernel 3.10.0-123.4.2.el7, kernel-tools 3.10.0-123.4.2.el7, kernel-tools-libs 3.10.0-123.4.2.el7, kernel-abi-whitelists 3.10.0-123.4.2.el7, kernel-debuginfo-common-x86_64 3.10.0-123.4.2.el7 Red Hat Enterprise Linux ComputeNode Optional (v. 7) python-perf 3.10.0-123.4.2.el7, kernel-debuginfo-common-x86_64 3.10.0-123.4.2.el7
fixed: vendor fix RHSA-2014:0786
Red Hat Enterprise Linux Desktop (v. 6) perf 2.6.32-431.23.3.el6, kernel 2.6.32-431.23.3.el6, kernel-firmware 2.6.32-431.23.3.el6, kernel-abi-whitelists 2.6.32-431.23.3.el6, kernel-debuginfo-common-i686 2.6.32-431.23.3.el6, kernel-debuginfo-common-x86_64 2.6.32-431.23.3.el6 Red Hat Enterprise Linux Desktop Optional (v. 6) kernel 2.6.32-431.23.3.el6, python-perf 2.6.32-431.23.3.el6, kernel-debuginfo-common-i686 2.6.32-431.23.3.el6, kernel-debuginfo-common-x86_64 2.6.32-431.23.3.el6 Red Hat Enterprise Linux HPC Node (v. 6) perf 2.6.32-431.23.3.el6, kernel 2.6.32-431.23.3.el6, kernel-firmware 2.6.32-431.23.3.el6, kernel-abi-whitelists 2.6.32-431.23.3.el6, kernel-debuginfo-common-x86_64 2.6.32-431.23.3.el6
fixed: vendor fix RHSA-2014:0981
Red Hat Enterprise Linux HPC Node EUS (v. 6.4) perf 2.6.32-358.48.1.el6, kernel 2.6.32-358.48.1.el6, kernel-firmware 2.6.32-358.48.1.el6, kernel-debuginfo-common-x86_64 2.6.32-358.48.1.el6
fixed: vendor fix RHSA-2014:1101
Red Hat Enterprise Linux HPC Node Optional (v. 6) kernel 2.6.32-431.23.3.el6, python-perf 2.6.32-431.23.3.el6, kernel-debuginfo-common-x86_64 2.6.32-431.23.3.el6 Red Hat Enterprise Linux Server (v. 6) perf 2.6.32-431.23.3.el6, kernel 2.6.32-431.23.3.el6, kernel-kdump 2.6.32-431.23.3.el6, kernel-firmware 2.6.32-431.23.3.el6, kernel-bootwrapper 2.6.32-431.23.3.el6, kernel-abi-whitelists 2.6.32-431.23.3.el6, +4 more
fixed: vendor fix RHSA-2014:0981
Red Hat Enterprise Linux Server (v. 7) perf 3.10.0-123.4.2.el7, kernel 3.10.0-123.4.2.el7, kernel-kdump 3.10.0-123.4.2.el7, kernel-tools 3.10.0-123.4.2.el7, kernel-tools-libs 3.10.0-123.4.2.el7, kernel-bootwrapper 3.10.0-123.4.2.el7, +4 more
fixed: vendor fix RHSA-2014:0786
Red Hat Enterprise Linux Server EUS (v. 6.4) perf 2.6.32-358.48.1.el6, kernel 2.6.32-358.48.1.el6, kernel-kdump 2.6.32-358.48.1.el6, kernel-firmware 2.6.32-358.48.1.el6, kernel-bootwrapper 2.6.32-358.48.1.el6, kernel-debuginfo-common-i686 2.6.32-358.48.1.el6, +3 more
fixed: vendor fix RHSA-2014:1101

show 9 more

Red Hat Enterprise Linux Server Optional (v. 6) kernel 2.6.32-431.23.3.el6, python-perf 2.6.32-431.23.3.el6, kernel-debuginfo-common-i686 2.6.32-431.23.3.el6, kernel-debuginfo-common-ppc64 2.6.32-431.23.3.el6, kernel-debuginfo-common-s390x 2.6.32-431.23.3.el6, kernel-debuginfo-common-x86_64 2.6.32-431.23.3.el6
fixed: vendor fix RHSA-2014:0981
Red Hat Enterprise Linux Server Optional (v. 7) python-perf 3.10.0-123.4.2.el7, kernel-debuginfo-common-ppc64 3.10.0-123.4.2.el7, kernel-debuginfo-common-s390x 3.10.0-123.4.2.el7, kernel-debuginfo-common-x86_64 3.10.0-123.4.2.el7
fixed: vendor fix RHSA-2014:0786
Red Hat Enterprise Linux Server Optional EUS (v. 6.4) kernel 2.6.32-358.48.1.el6, python-perf 2.6.32-358.48.1.el6, kernel-debuginfo-common-i686 2.6.32-358.48.1.el6, kernel-debuginfo-common-ppc64 2.6.32-358.48.1.el6, kernel-debuginfo-common-s390x 2.6.32-358.48.1.el6, kernel-debuginfo-common-x86_64 2.6.32-358.48.1.el6
fixed: vendor fix RHSA-2014:1101
Red Hat Enterprise Linux Workstation (v. 6) perf 2.6.32-431.23.3.el6, kernel 2.6.32-431.23.3.el6, kernel-firmware 2.6.32-431.23.3.el6, kernel-abi-whitelists 2.6.32-431.23.3.el6, kernel-debuginfo-common-i686 2.6.32-431.23.3.el6, kernel-debuginfo-common-x86_64 2.6.32-431.23.3.el6
fixed: vendor fix RHSA-2014:0981
Red Hat Enterprise Linux Workstation (v. 7) perf 3.10.0-123.4.2.el7, kernel 3.10.0-123.4.2.el7, kernel-tools 3.10.0-123.4.2.el7, kernel-tools-libs 3.10.0-123.4.2.el7, kernel-abi-whitelists 3.10.0-123.4.2.el7, kernel-debuginfo-common-x86_64 3.10.0-123.4.2.el7
fixed: vendor fix RHSA-2014:0786
Red Hat Enterprise Linux Workstation Optional (v. 6) kernel 2.6.32-431.23.3.el6, python-perf 2.6.32-431.23.3.el6, kernel-debuginfo-common-i686 2.6.32-431.23.3.el6, kernel-debuginfo-common-x86_64 2.6.32-431.23.3.el6
fixed: vendor fix RHSA-2014:0981
Red Hat Enterprise Linux Workstation Optional (v. 7) python-perf 3.10.0-123.4.2.el7, kernel-debuginfo-common-x86_64 3.10.0-123.4.2.el7
fixed: vendor fix RHSA-2014:0786
Red Hat MRG Realtime for RHEL 6 Server v.2 kernel-rt 3.10.33-rt32.34.el6rt, kernel-rt-trace 3.10.33-rt32.34.el6rt, kernel-rt-vanilla 3.10.33-rt32.34.el6rt, kernel-rt-firmware 3.10.33-rt32.34.el6rt, kernel-rt-debuginfo-common-x86_64 3.10.33-rt32.34.el6rt
fixed: vendor fix RHSA-2014:0557
Red Hat Enterprise Linux 5 kernel
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

2014-04-14 Published
2014-04-18 First public exploit (EDB-32926)

Exploit prediction

0.95% chance of exploitation in the next 30 days, higher than 61% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

EDB-32926 Linux Kernel - 'group_info' refcounter Overflow Memory Corruption dos, 2014-04-18
git.kernel.org https://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=b04c46190219a4f845e46a459e3102137b7f6cac referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	2.0	6.9	AV:L/AC:M/Au:N/C:C/I:C/A:C

Classification

Weakness

CWE-416 Use After Free

Technology feeds

Linux kernel rss critical rss

References

git.kernel.org /cgit/linux/kernel/git/davem/net.git/commit/?id=b04c46190219a4f845e46a459e3102137b7f6cac
exploit, patch, vendor-advisory
bugzilla.redhat.com /show_bug.cgi?id=1086730
issue-tracking, patch, third-party-advisory
lkml.org /lkml/2014/4/10/736
mailing-list, patch, vendor-advisory
openwall.com /lists/oss-security/2014/04/11/4
mailing-list, patch, third-party-advisory
debian.org /security/2014/dsa-2926
vendor-advisory, third-party-advisory
securitytracker.com /id/1030769
vdb-entry, third-party-advisory
secunia.com /advisories/59386
third-party-advisory, broken-link
secunia.com /advisories/59599
third-party-advisory, broken-link
securityfocus.com /bid/66779
vdb-entry, third-party-advisory

Sources

CVE List CVE-2014-2851
NVD CVE-2014-2851

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

json all entries feed