arch/x86/kernel/entry_64.S in the Linux kernel before 3.17.5 does not properly handle faults associated with the Stack Segment (SS) segment…

published 2014-12-17 11 y ago modified 2026-06-17 4 mo ago also EUVD-2014-9147

cvss: 7.8; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.5%; EPSS 1.5% chance of exploitation in 30 days, percentile 75%
public exploits: 2; Exploit-DB

arch/x86/kernel/entry_64.S in the Linux kernel before 3.17.5 does not properly handle faults associated with the Stack Segment (SS) segment register, which allows local users to gain privileges by triggering an IRET instruction that leads to access to a GS Base address from the wrong space.

Patch / fix

fixed in 1 distros 3 links 5

linux linux_kernel 3.2.65, 3.4.106, 3.10.62, 3.12.35, 3.14.26, 3.16.35, 3.17.5

debian ubuntu red hat

linux Debian 14, Debian 13, Debian 12 3.16.7-ckt2-1

debian advisories DEBIAN-CVE-2014-9322

linux Ubuntu 14.04 LTS 3.13.0-43.72
linux-lts-utopic Ubuntu 14.04 LTS 3.16.0-28.37~14.04.1

ubuntu advisories UBUNTU-CVE-2014-9322

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

kernel RHEL 6 2.6.32-504.3.3.el6
perf RHEL 6 2.6.32-504.3.3.el6
python-perf RHEL 6 2.6.32-504.3.3.el6
kernel-kdump RHEL 6 2.6.32-504.3.3.el6
kernel-firmware RHEL 6 2.6.32-504.3.3.el6
kernel-bootwrapper RHEL 6 2.6.32-504.3.3.el6
kernel-abi-whitelists RHEL 6 2.6.32-504.3.3.el6
kernel-debuginfo-common-i686 RHEL 6 2.6.32-504.3.3.el6

red hat advisories RHSA-2014:1997 RHSA-2014:2009 RHSA-2014:2029 RHSA-2014:2008 RHSA-2014:2028 RHSA-2014:2010

github.com/torvalds/linux@6f442be commit
kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.17.5 advisory
bugzilla.redhat.com/show_bug.cgi?id=1172806 advisory
source.android.com/security/bulletin/2016-04-02.html advisory
openwall.com/lists/oss-security/2014/12/15/6 advisory

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2014-9322 updated 2026-06-27 cvss 8.4

kernel: x86: local privesc due to bad_iret and paranoid entry incompatibility

Red Hat Enterprise Linux (v. 5 server) kernel 2.6.18-400.1.1.el5, kernel-PAE 2.6.18-400.1.1.el5, kernel-xen 2.6.18-400.1.1.el5, kernel-kdump 2.6.18-400.1.1.el5, kernel-debuginfo-common 2.6.18-400.1.1.el5
fixed: vendor fix RHSA-2014:2008
Red Hat Enterprise Linux AS (v. 4 ELS) kernel 2.6.9-106.EL, kernel-smp 2.6.9-106.EL, kernel-xenU 2.6.9-106.EL, kernel-hugemem 2.6.9-106.EL, kernel-largesmp 2.6.9-106.EL
fixed: vendor fix RHSA-2015:0009
Red Hat Enterprise Linux Client (v. 7) perf 3.10.0-123.13.2.el7, kernel 3.10.0-123.13.2.el7, kernel-tools 3.10.0-123.13.2.el7, kernel-tools-libs 3.10.0-123.13.2.el7, kernel-abi-whitelists 3.10.0-123.13.2.el7, kernel-debuginfo-common-x86_64 3.10.0-123.13.2.el7 Red Hat Enterprise Linux Client Optional (v. 7) python-perf 3.10.0-123.13.2.el7, kernel-debuginfo-common-x86_64 3.10.0-123.13.2.el7
fixed: vendor fix RHSA-2014:2010
Red Hat Enterprise Linux Compute Node Optional EUS (v. 6.4) kernel 2.6.32-358.51.2.el6, python-perf 2.6.32-358.51.2.el6, kernel-debuginfo-common-x86_64 2.6.32-358.51.2.el6
fixed: vendor fix RHSA-2014:2030
Red Hat Enterprise Linux Compute Node Optional EUS (v. 6.5) kernel 2.6.32-431.40.2.el6, python-perf 2.6.32-431.40.2.el6, kernel-debuginfo-common-x86_64 2.6.32-431.40.2.el6
fixed: vendor fix RHSA-2014:2009
Red Hat Enterprise Linux ComputeNode (v. 7) perf 3.10.0-123.13.2.el7, kernel 3.10.0-123.13.2.el7, kernel-tools 3.10.0-123.13.2.el7, kernel-tools-libs 3.10.0-123.13.2.el7, kernel-abi-whitelists 3.10.0-123.13.2.el7, kernel-debuginfo-common-x86_64 3.10.0-123.13.2.el7 Red Hat Enterprise Linux ComputeNode Optional (v. 7) python-perf 3.10.0-123.13.2.el7, kernel-debuginfo-common-x86_64 3.10.0-123.13.2.el7
fixed: vendor fix RHSA-2014:2010
Red Hat Enterprise Linux Desktop (v. 5 client) kernel 2.6.18-400.1.1.el5, kernel-PAE 2.6.18-400.1.1.el5, kernel-xen 2.6.18-400.1.1.el5, kernel-debuginfo-common 2.6.18-400.1.1.el5
fixed: vendor fix RHSA-2014:2008
Red Hat Enterprise Linux Desktop (v. 6) perf 2.6.32-504.3.3.el6, kernel 2.6.32-504.3.3.el6, kernel-firmware 2.6.32-504.3.3.el6, kernel-abi-whitelists 2.6.32-504.3.3.el6, kernel-debuginfo-common-i686 2.6.32-504.3.3.el6, kernel-debuginfo-common-x86_64 2.6.32-504.3.3.el6 Red Hat Enterprise Linux Desktop Optional (v. 6) python-perf 2.6.32-504.3.3.el6, kernel-debuginfo-common-i686 2.6.32-504.3.3.el6, kernel-debuginfo-common-x86_64 2.6.32-504.3.3.el6
fixed: vendor fix RHSA-2014:1997

show 22 more

Red Hat Enterprise Linux ES (v. 4 ELS) kernel 2.6.9-106.EL, kernel-smp 2.6.9-106.EL, kernel-xenU 2.6.9-106.EL, kernel-hugemem 2.6.9-106.EL, kernel-largesmp 2.6.9-106.EL
fixed: vendor fix RHSA-2015:0009
Red Hat Enterprise Linux EUS (v. 5.9 server) kernel 2.6.18-348.29.1.el5, kernel-PAE 2.6.18-348.29.1.el5, kernel-xen 2.6.18-348.29.1.el5, kernel-kdump 2.6.18-348.29.1.el5, kernel-debuginfo-common 2.6.18-348.29.1.el5
fixed: vendor fix RHSA-2014:2029
Red Hat Enterprise Linux HPC Node (v. 6) perf 2.6.32-504.3.3.el6, kernel 2.6.32-504.3.3.el6, kernel-firmware 2.6.32-504.3.3.el6, kernel-abi-whitelists 2.6.32-504.3.3.el6, kernel-debuginfo-common-x86_64 2.6.32-504.3.3.el6
fixed: vendor fix RHSA-2014:1997
Red Hat Enterprise Linux HPC Node EUS (v. 6.4) perf 2.6.32-358.51.2.el6, kernel 2.6.32-358.51.2.el6, kernel-firmware 2.6.32-358.51.2.el6, kernel-debuginfo-common-x86_64 2.6.32-358.51.2.el6
fixed: vendor fix RHSA-2014:2030
Red Hat Enterprise Linux HPC Node EUS (v. 6.5) perf 2.6.32-431.40.2.el6, kernel 2.6.32-431.40.2.el6, kernel-firmware 2.6.32-431.40.2.el6, kernel-abi-whitelists 2.6.32-431.40.2.el6, kernel-debuginfo-common-x86_64 2.6.32-431.40.2.el6
fixed: vendor fix RHSA-2014:2009
Red Hat Enterprise Linux HPC Node Optional (v. 6) python-perf 2.6.32-504.3.3.el6, kernel-debuginfo-common-x86_64 2.6.32-504.3.3.el6
fixed: vendor fix RHSA-2014:1997
Red Hat Enterprise Linux Long Life (v. 5.6 server) kernel 2.6.18-238.54.1.el5, kernel-PAE 2.6.18-238.54.1.el5, kernel-xen 2.6.18-238.54.1.el5, kernel-debuginfo-common 2.6.18-238.54.1.el5
fixed: vendor fix RHSA-2014:2031
Red Hat Enterprise Linux Server (v. 6) perf 2.6.32-504.3.3.el6, kernel 2.6.32-504.3.3.el6, kernel-kdump 2.6.32-504.3.3.el6, kernel-firmware 2.6.32-504.3.3.el6, kernel-bootwrapper 2.6.32-504.3.3.el6, kernel-abi-whitelists 2.6.32-504.3.3.el6, +4 more
fixed: vendor fix RHSA-2014:1997
Red Hat Enterprise Linux Server (v. 7) perf 3.10.0-123.13.2.el7, kernel 3.10.0-123.13.2.el7, kernel-kdump 3.10.0-123.13.2.el7, kernel-tools 3.10.0-123.13.2.el7, kernel-tools-libs 3.10.0-123.13.2.el7, kernel-bootwrapper 3.10.0-123.13.2.el7, +4 more
fixed: vendor fix RHSA-2014:2010
Red Hat Enterprise Linux Server AUS (v. 6.2) perf 2.6.32-220.57.1.el6, kernel 2.6.32-220.57.1.el6, kernel-firmware 2.6.32-220.57.1.el6, kernel-debuginfo-common-x86_64 2.6.32-220.57.1.el6
fixed: vendor fix RHSA-2014:2028
Red Hat Enterprise Linux Server EUS (v. 6.4) perf 2.6.32-358.51.2.el6, kernel 2.6.32-358.51.2.el6, kernel-kdump 2.6.32-358.51.2.el6, kernel-firmware 2.6.32-358.51.2.el6, kernel-bootwrapper 2.6.32-358.51.2.el6, kernel-debuginfo-common-i686 2.6.32-358.51.2.el6, +3 more
fixed: vendor fix RHSA-2014:2030
Red Hat Enterprise Linux Server EUS (v. 6.5) perf 2.6.32-431.40.2.el6, kernel 2.6.32-431.40.2.el6, kernel-kdump 2.6.32-431.40.2.el6, kernel-firmware 2.6.32-431.40.2.el6, kernel-bootwrapper 2.6.32-431.40.2.el6, kernel-abi-whitelists 2.6.32-431.40.2.el6, +4 more
fixed: vendor fix RHSA-2014:2009
Red Hat Enterprise Linux Server Optional (v. 6) python-perf 2.6.32-504.3.3.el6, kernel-debuginfo-common-i686 2.6.32-504.3.3.el6, kernel-debuginfo-common-ppc64 2.6.32-504.3.3.el6, kernel-debuginfo-common-s390x 2.6.32-504.3.3.el6, kernel-debuginfo-common-x86_64 2.6.32-504.3.3.el6
fixed: vendor fix RHSA-2014:1997
Red Hat Enterprise Linux Server Optional (v. 7) python-perf 3.10.0-123.13.2.el7, kernel-debuginfo-common-ppc64 3.10.0-123.13.2.el7, kernel-debuginfo-common-s390x 3.10.0-123.13.2.el7, kernel-debuginfo-common-x86_64 3.10.0-123.13.2.el7
fixed: vendor fix RHSA-2014:2010
Red Hat Enterprise Linux Server Optional AUS (v. 6.2) kernel 2.6.32-220.57.1.el6, python-perf 2.6.32-220.57.1.el6, kernel-debuginfo-common-x86_64 2.6.32-220.57.1.el6
fixed: vendor fix RHSA-2014:2028
Red Hat Enterprise Linux Server Optional EUS (v. 6.4) kernel 2.6.32-358.51.2.el6, python-perf 2.6.32-358.51.2.el6, kernel-debuginfo-common-i686 2.6.32-358.51.2.el6, kernel-debuginfo-common-ppc64 2.6.32-358.51.2.el6, kernel-debuginfo-common-s390x 2.6.32-358.51.2.el6, kernel-debuginfo-common-x86_64 2.6.32-358.51.2.el6
fixed: vendor fix RHSA-2014:2030
Red Hat Enterprise Linux Server Optional EUS (v. 6.5) kernel 2.6.32-431.40.2.el6, python-perf 2.6.32-431.40.2.el6, kernel-debuginfo-common-i686 2.6.32-431.40.2.el6, kernel-debuginfo-common-ppc64 2.6.32-431.40.2.el6, kernel-debuginfo-common-s390x 2.6.32-431.40.2.el6, kernel-debuginfo-common-x86_64 2.6.32-431.40.2.el6
fixed: vendor fix RHSA-2014:2009
Red Hat Enterprise Linux Workstation (v. 6) perf 2.6.32-504.3.3.el6, kernel 2.6.32-504.3.3.el6, kernel-firmware 2.6.32-504.3.3.el6, kernel-abi-whitelists 2.6.32-504.3.3.el6, kernel-debuginfo-common-i686 2.6.32-504.3.3.el6, kernel-debuginfo-common-x86_64 2.6.32-504.3.3.el6
fixed: vendor fix RHSA-2014:1997
Red Hat Enterprise Linux Workstation (v. 7) perf 3.10.0-123.13.2.el7, kernel 3.10.0-123.13.2.el7, kernel-tools 3.10.0-123.13.2.el7, kernel-tools-libs 3.10.0-123.13.2.el7, kernel-abi-whitelists 3.10.0-123.13.2.el7, kernel-debuginfo-common-x86_64 3.10.0-123.13.2.el7
fixed: vendor fix RHSA-2014:2010
Red Hat Enterprise Linux Workstation Optional (v. 6) python-perf 2.6.32-504.3.3.el6, kernel-debuginfo-common-i686 2.6.32-504.3.3.el6, kernel-debuginfo-common-x86_64 2.6.32-504.3.3.el6
fixed: vendor fix RHSA-2014:1997
Red Hat Enterprise Linux Workstation Optional (v. 7) python-perf 3.10.0-123.13.2.el7, kernel-debuginfo-common-x86_64 3.10.0-123.13.2.el7
fixed: vendor fix RHSA-2014:2010
Red Hat MRG Realtime for RHEL 6 Server v.2 kernel-rt 3.10.58-rt62.60.el6rt, kernel-rt-trace 3.10.58-rt62.60.el6rt, kernel-rt-vanilla 3.10.58-rt62.60.el6rt, kernel-rt-firmware 3.10.58-rt62.60.el6rt, kernel-rt-debuginfo-common-x86_64 3.10.58-rt62.60.el6rt
fixed: vendor fix RHSA-2014:1998

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

2014-12-17 Published
2015-03-04 First public exploit (EDB-36266)

Exploit prediction

1.54% chance of exploitation in the next 30 days, higher than 75% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

EDB-44205 Linux Kernel - 'BadIRET' Local Privilege Escalation local, 2017-07-24
EDB-36266 Linux Kernel 3.17.5 - IRET Instruction #SS Fault Handling Crash (PoC) dos, 2015-03-04

CVSS scores

assigned by	version	score	vector
NVD	3.1	7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	7.2	AV:L/AC:L/Au:N/C:C/I:C/A:C

Classification

Weakness

CWE-269 Improper Privilege Management

Technology feeds

Linux kernel rss critical rss

References

github.com /torvalds/linux/commit/6f442be2fb22be02cafa606f1769fa1e6f894441
patch, third-party-advisory
kernel.org /pub/linux/kernel/v3.x/ChangeLog-3.17.5
mailing-list, patch, vendor-advisory
bugzilla.redhat.com /show_bug.cgi?id=1172806
issue-tracking, patch, third-party-advisory
source.android.com /security/bulletin/2016-04-02.html
patch, third-party-advisory
openwall.com /lists/oss-security/2014/12/15/6
mailing-list, patch, third-party-advisory
exploit-db.com /exploits/36266
exploit, third-party-advisory, vdb-entry
ubuntu.com /usn/USN-2491-1
vendor-advisory, third-party-advisory
marc.info /?l=bugtraq&m=142722450701342&w=2
vendor-advisory, mailing-list, third-party-advisory
lists.opensuse.org /opensuse-security-announce/2015-04/msg00015.html
vendor-advisory, mailing-list, third-party-advisory
rhn.redhat.com /errata/RHSA-2015-0009.html
vendor-advisory, third-party-advisory
marc.info /?l=bugtraq&m=142722544401658&w=2
vendor-advisory, mailing-list, third-party-advisory
lists.opensuse.org /opensuse-security-announce/2015-03/msg00025.html
vendor-advisory, mailing-list, third-party-advisory
rhn.redhat.com /errata/RHSA-2014-2008.html
vendor-advisory, third-party-advisory
rhn.redhat.com /errata/RHSA-2014-1998.html
vendor-advisory, third-party-advisory
rhn.redhat.com /errata/RHSA-2014-2028.html
vendor-advisory, third-party-advisory
rhn.redhat.com /errata/RHSA-2014-2031.html
vendor-advisory, third-party-advisory
lists.opensuse.org /opensuse-security-announce/2015-04/msg00020.html
vendor-advisory, mailing-list, third-party-advisory
help.joyent.com /entries/98788667-Security-Advisory-ZDI-CAN-3263-ZDI-CAN-3284-and-ZDI-CAN-3364-Vulnerabilities
permissions-required, third-party-advisory
zerodayinitiative.com /advisories/ZDI-16-170
third-party-advisory, vdb-entry
secunia.com /advisories/62336
third-party-advisory, broken-link
git.kernel.org /?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=6f442be2fb22be02cafa606f1769fa1e6f894441
osvdb.org /show/osvdb/115919
vdb-entry, broken-link

Sources

CVE List CVE-2014-9322
NVD CVE-2014-9322

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary