CVE-2014-4611

NameCVE-2014-4611
DescriptionInteger overflow in the LZ4 algorithm implementation, as used in Yann Collet LZ4 before r118 and in the lz4_uncompress function in lib/lz4/lz4_decompress.c in the Linux kernel before 3.15.2, on 32-bit platforms might allow context-dependent attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted Literal Run that would be improperly handled by programs not complying with an API limitation, a different vulnerability than CVE-2014-4715.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severitymedium (attack range: remote)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
linux (PTS)jessie3.16.51-2fixed
jessie (security)3.16.56-1+deb8u1fixed
stretch4.9.82-1+deb9u3fixed
stretch (security)4.9.88-1+deb9u1fixed
buster4.16.12-1fixed
sid4.16.16-1fixed
lz4 (PTS)jessie0.0~r122-2fixed
stretch0.0~r131-2fixed
buster, sid1.8.2-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
linuxsource(unstable)3.14.9-1unimportant
linuxsourcewheezy(not affected)
linux-2.6source(unstable)(not affected)
lz4source(unstable)0.0~r119-1medium

Notes

[wheezy] - linux <not-affected> (LZ4 support introduced in 3.11)
- linux-2.6 <not-affected> (LZ4 support introduced in 3.11)
possible fix in https://lkml.org/lkml/2014/7/4/288
https://bugzilla.novell.com/show_bug.cgi?id=883949#c12
Not exploitable for lz* compressed kernel images: http://fastcompression.blogspot.fr/2014/06/debunking-lz4-20-years-old-bug-myth.html
for lz4: https://code.google.com/p/lz4/issues/detail?id=52 and https://code.google.com/p/lz4/source/detail?r=118

Search for package or bug name: Reporting problems