CVE-2014-0038Linux Kernel Vulnerability
The compat_sys_recvmmsg function in net/compat.c in the Linux kernel before 3.13.2, when CONFIG_X86_X32 is enabled, allows local users to gain privileges via a recvmmsg system call with a crafted timeout pointer parameter.
Published Feb 6, 2014 · Updated Aug 11, 2026 · Also known as DEBIAN-CVE-2014-0038, SUSE-SU-2017:3210-1, SUSE-SU-2017:3249-1
Key Facts
Routine patching- CVE-2014-0038 is a medium-severity vulnerability (CVSS 6.9 v2) affecting Linux Kernel, Opensuse, linux (debian) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. A public exploit is reported by tracking sources, but no code link is listed yet.
- EPSS estimates a 35% probability of exploitation in the next 30 days.
- Fixed versions are available, including dtrace-modules-3.8.13-35.el6uek 0.4.3-4.el6, dtrace-modules-headers 0.4.3-4.el6, dtrace-modules-provider-headers 0.4.3-4.el6.
- Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.
Scores
CVSS v2
6.9
AV:L/AC:M/Au:N/C:C/I:C/A:C
EPSS (30-day exploit likelihood)
35%
Higher than 98.4% of all scored CVEs
Exploit maturity
Weaponized
ATLAS score
56/100
Publication score, see How it works
Exploitation Verdict
KEV listed
Not listed
Federal due date
None
No federal due date
Ransomware use
Not reported
Attributed actors
None named
Exploit & Defence Guidance
Exploit maturity
Weaponized
Public exploit code
5
Proof-of-concept links
In-the-wild evidence
1
Reports of active use
Advisories And Exploit References
- advisoryhttps://github.com/saelo/cve-2014-0038
- advisoryhttps://security-tracker.debian.org/tracker/CVE-2014-0038
- advisoryhttp://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=2def2ef2ae5f3990aabdbe8a755911902707d268
- advisoryopenSUSE-SU-2014:0204
- advisoryopenSUSE-SU-2014:0205
- advisoryhttps://bugzilla.suse.com/1043652
Description
The compat_sys_recvmmsg function in net/compat.c in the Linux kernel before 3.13.2, when CONFIG_X86_X32 is enabled, allows local users to gain privileges via a recvmmsg system call with a crafted timeout pointer parameter.
Affected Products
121 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Linux KernelLinux | See advisory | 3.4.79 |
| OpensuseOpensuse | 12.3 | n/a |
| linuxdebian | See advisory | 3.13.4-1 |
| rootio-linuxrootio | See advisory | 3.13.4-1 |
| dtrace-modules-3.8.13-35.el6uekoracle | See advisory | 0.4.3-4.el6 |
Patched Releases
dtrace-modules-3.8.13-35.el6uek
0.4.3-4.el6
dtrace-modules-headers
0.4.3-4.el6
dtrace-modules-provider-headers
0.4.3-4.el6
kernel-debug
4.8.13-1.1
kernel-debug-base
4.8.13-1.1
kernel-debug-devel
4.8.13-1.1
kernel-default
3.12.61-52.106.1, 3.12.74-60.64.66.1, 4.8.13-1.1
kernel-default-base
3.12.61-52.106.1, 3.12.74-60.64.66.1, 4.8.13-1.1
kernel-default-devel
3.12.61-52.106.1, 3.12.74-60.64.66.1, 4.8.13-1.1
kernel-default-man
3.12.61-52.106.1, 3.12.74-60.64.66.1
kernel-devel
3.12.61-52.106.1, 3.12.74-60.64.66.1, 4.8.13-1.1
kernel-docs
4.8.13-1.1
kernel-docs-html
4.8.13-1.1
kernel-docs-pdf
4.8.13-1.1
kernel-ec2
3.12.61-52.106.1, 3.12.74-60.64.66.1
kernel-macros
3.12.61-52.106.1, 3.12.74-60.64.66.1, 4.8.13-1.1
kernel-obs-build
4.8.13-1.1
kernel-obs-qa
4.8.13-1.1
kernel-pae
4.8.13-1.1
kernel-pae-base
4.8.13-1.1
kernel-pae-devel
4.8.13-1.1
kernel-source
3.12.61-52.106.1, 3.12.74-60.64.66.1, 4.8.13-1.1
kernel-source-vanilla
4.8.13-1.1
kernel-syms
3.12.61-52.106.1, 3.12.74-60.64.66.1, 4.8.13-1.1
kernel-syzkaller
4.8.13-1.1
Timeline
Publicly disclosed
Feb 6, 2014
Last updated
Aug 11, 2026
Weakness Type
- CWE-20 Improper Input Validation
References
- advisorygithub.com · CVE-2014-0038
- advisorysecurity-tracker.debian.org · CVE-2014-0038
- advisorygit.kernel.org
- advisoryopenSUSE-SU-2014:0204
- advisoryopenSUSE-SU-2014:0205
FAQ
Common Questions.
The compat_sys_recvmmsg function in net/compat.c in the Linux kernel before 3.13.2, when CONFIG_X86_X32 is enabled, allows local users to gain privileges via a recvmmsg system call with a crafted timeout pointer parameter.
Affected: Linux Kernel; Opensuse versions 12.3; linux (debian), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
A public exploit is reported by tracking sources, but no code link is listed yet.
Fixed versions are available, including dtrace-modules-3.8.13-35.el6uek 0.4.3-4.el6, dtrace-modules-headers 0.4.3-4.el6, dtrace-modules-provider-headers 0.4.3-4.el6.
Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.
Is CVE-2014-0038 On Your Attack Surface?
Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.
Request A Demo