{"id":"CVE-2014-0196","kind":"vulnerability","aliases":["CVE-2014-0196"],"related":[],"title":"The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty…","description":"The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the \"LECHO & !OPOST\" case, which allows local users to cause a denial of service (memory corruption and system crash) or gain privileges by triggering a race condition involving read and write operations with long strings.","summary":"A race condition in the Linux kernel n_tty_write function lets a local user crash the system or gain root privileges using long read and write operations. CISA lists it as actively exploited in the wild.","severity":"high","cvss":6.9,"epss":null,"exploited":true,"exploited_at":"2023-05-12T00:00:00+00:00","products":[{"name":"linux kernel","fixed":["3.2.59"],"affected":"> 2.6.31, < 3.2.59","ecosystem":"vendor"},{"name":"linux kernel","fixed":["3.4.91"],"affected":">= 3.3, < 3.4.91","ecosystem":"vendor"},{"name":"linux kernel","fixed":["3.10.40"],"affected":">= 3.5, < 3.10.40","ecosystem":"vendor"},{"name":"linux kernel","fixed":["3.12.20"],"affected":">= 3.11, < 3.12.20","ecosystem":"vendor"},{"name":"linux kernel","fixed":["3.14.4"],"affected":">= 3.13, < 3.14.4","ecosystem":"vendor"},{"name":"linux kernel","fixed":[],"affected":"= 2.6.31","ecosystem":"vendor"},{"name":"debian linux","fixed":[],"affected":"= 6.0","ecosystem":"vendor"},{"name":"debian linux","fixed":[],"affected":"= 7.0","ecosystem":"vendor"},{"name":"redhat enterprise linux","fixed":[],"affected":"= 6.0","ecosystem":"vendor"},{"name":"redhat enterprise linux eus","fixed":[],"affected":"= 6.3","ecosystem":"vendor"},{"name":"redhat enterprise linux eus","fixed":[],"affected":"= 6.4","ecosystem":"vendor"},{"name":"redhat enterprise linux server eus","fixed":[],"affected":"= 6.3","ecosystem":"vendor"},{"name":"suse linux enterprise desktop","fixed":[],"affected":"= 11","ecosystem":"vendor"},{"name":"suse linux enterprise high availability extension","fixed":[],"affected":"= 11","ecosystem":"vendor"},{"name":"suse linux enterprise server","fixed":[],"affected":"= 11","ecosystem":"vendor"},{"name":"oracle linux","fixed":[],"affected":"= 6","ecosystem":"vendor"},{"name":"canonical ubuntu linux","fixed":[],"affected":"= 10.04","ecosystem":"vendor"},{"name":"canonical ubuntu linux","fixed":[],"affected":"= 12.04","ecosystem":"vendor"},{"name":"canonical ubuntu linux","fixed":[],"affected":"= 12.10","ecosystem":"vendor"},{"name":"canonical ubuntu linux","fixed":[],"affected":"= 13.10","ecosystem":"vendor"},{"name":"canonical ubuntu linux","fixed":[],"affected":"= 14.04","ecosystem":"vendor"},{"name":"f5 big-ip access policy manager","fixed":[],"affected":">= 11.1.0, <= 11.5.1","ecosystem":"vendor"},{"name":"f5 big-ip advanced firewall manager","fixed":[],"affected":">= 11.3.0, <= 11.5.1","ecosystem":"vendor"},{"name":"f5 big-ip analytics","fixed":[],"affected":">= 11.1.0, <= 11.5.1","ecosystem":"vendor"},{"name":"f5 big-ip application acceleration manager","fixed":[],"affected":">= 11.4.0, <= 11.5.1","ecosystem":"vendor"},{"name":"f5 big-ip application security manager","fixed":[],"affected":">= 11.1.0, <= 11.5.1","ecosystem":"vendor"},{"name":"f5 big-ip edge gateway","fixed":[],"affected":">= 11.1.0, <= 11.3.0","ecosystem":"vendor"},{"name":"f5 big-ip global traffic manager","fixed":[],"affected":">= 11.1.0, <= 11.5.1","ecosystem":"vendor"},{"name":"f5 big-ip link controller","fixed":[],"affected":">= 11.1.0, <= 11.5.1","ecosystem":"vendor"},{"name":"f5 big-ip local traffic manager","fixed":[],"affected":">= 11.1.0, <= 11.5.1","ecosystem":"vendor"},{"name":"f5 big-ip policy enforcement manager","fixed":[],"affected":">= 11.3.0, <= 11.5.1","ecosystem":"vendor"},{"name":"f5 big-ip protocol security module","fixed":[],"affected":">= 11.1.0, <= 11.4.1","ecosystem":"vendor"},{"name":"f5 big-ip wan optimization manager","fixed":[],"affected":">= 11.1.0, <= 11.3.0","ecosystem":"vendor"},{"name":"f5 big-ip webaccelerator","fixed":[],"affected":">= 11.1.0, <= 11.3.0","ecosystem":"vendor"},{"name":"f5 big-iq application delivery controller","fixed":[],"affected":"= 4.5.0","ecosystem":"vendor"},{"name":"f5 big-iq centralized management","fixed":[],"affected":"= 4.6.0","ecosystem":"vendor"},{"name":"f5 big-iq cloud","fixed":[],"affected":">= 4.0.0, <= 4.5.0","ecosystem":"vendor"},{"name":"f5 big-iq cloud and orchestration","fixed":[],"affected":"= 1.0.0","ecosystem":"vendor"},{"name":"f5 big-iq device","fixed":[],"affected":">= 4.2.0, <= 4.5.0","ecosystem":"vendor"},{"name":"f5 big-iq security","fixed":[],"affected":">= 4.0.0, <= 4.5.0","ecosystem":"vendor"},{"name":"Linux Kernel","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","linux","self-hosted","shared-hosts"],"not_affected_if":["no-local-untrusted-users","unpatched-kernel-not-used"],"how_to_check":"uname -r to see the running kernel version; compare against the kernel release that carries the 2014 n_tty fix (unknown from sources)","fix":"Update to a patched Linux kernel from your distribution; the sources do not name the fixed version.\nIf the kernel is end-of-life and cannot be patched, CISA says to disconnect it from use.","status":"open","published_at":"2014-05-07T10:55:04+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:06:47+00:00","updated_at":"2026-10-24T00:09:51+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T21:06:47Z","model":"claude-haiku-5-5","output":{"fix":"Update to a patched Linux kernel from your distribution; the sources do not name the fixed version.\nIf the kernel is end-of-life and cannot be patched, CISA says to disconnect it from use.","reach":"local","impact":"high","summary":"A race condition in the Linux kernel n_tty_write function lets a local user crash the system or gain root privileges using long read and write operations. CISA lists it as actively exploited in the wild.","category":"infrastructure","who_cares":["linux","self-hosted","shared-hosts"],"confidence":0.7,"needs_auth":"yes","worst_case":"Local user gains root privileges or crashes the kernel.","analyst_note":"Find the fixed kernel versions and distro advisories for CVE-2014-0196 (the n_tty_write race) at the NVD or kernel.org stable changelog, since the sources give no fixed version.","how_to_check":"uname -r to see the running kernel version; compare against the kernel release that carries the 2014 n_tty fix (unknown from sources)\nunknown","needs_analyst":true,"not_affected_if":["unpatched-kernel-not-used","no-local-untrusted-users"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000498,"input_tokens":2806,"output_tokens":434,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-0196':21A,24A '-2014':20A,23A '3.14.3':13A,268C 'acceleration':112A 'access':92A,275C 'activ':251B 'advanced':99A 'allow':282C 'analytics':106A 'and':196A 'application':111A,118A,177A 'availability':65A 'big':90A,97A,104A,109A,116A,123A,129A,136A,142A,149A,156A,163A,170A,175A,182A,188A,193A,200A,205A 'big-ip':89A,96A,103A,108A,115A,122A,128A,135A,141A,148A,155A,162A,169A 'big-iq':174A,181A,187A,192A,199A,204A 'canonical':73A,76A,79A,82A,85A 'case':280C 'caus':286C 'centralized':184A 'cisa':247B 'cloud':190A,195A 'condit':221B,303C 'controller':139A,179A 'corrupt':292C 'crash':234B,295C 'cve':19A,22A 'debian':37A,39A 'delivery':178A 'denial':288C 'desktop':60A 'device':202A 'driver':274C 'drivers/tty/n_tty.c':7A,262C 'edge':125A 'enforcement':152A 'enterprise':42A,45A,49A,53A,59A,63A,69A 'eus':47A,51A,56A 'exploit':210B,252B 'extension':66A 'f5':88A,95A,102A,107A,114A,121A,127A,134A,140A,147A,154A,161A,168A,173A,180A,186A,191A,198A,203A 'firewall':100A 'function':5A,229B,260C 'gain':238B,297C 'gateway':126A 'global':131A 'high':64A 'host':215B,218B 'infrastructur':211B 'involv':304C 'ip':91A,98A,105A,110A,117A,124A,130A,137A,143A,150A,157A,164A,171A 'iq':176A,183A,189A,194A,201A,206A 'kernel':11A,26A,28A,30A,32A,34A,36A,209A,225B,266C 'lecho':278C 'let':230B 'link':138A 'linux':10A,25A,27A,29A,31A,33A,35A,38A,40A,43A,46A,50A,54A,58A,62A,68A,72A,75A,78A,81A,84A,87A,208A,212B,224B,265C 'list':248B 'local':144A,232B,283C 'long':242B,310C 'manag':17A,272C 'management':185A 'manager':94A,101A,113A,120A,133A,146A,153A,167A 'memori':291C 'module':160A 'n':2A,226B,257C 'oper':246B,308C 'opost':279C 'optimization':166A 'oracle':71A 'orchestration':197A 'policy':93A,151A 'privileg':240B,298C 'proper':16A,271C 'protocol':158A 'race':220B,302C 'read':243B,305C 'redhat':41A,44A,48A,52A 'root':239B 'security':119A,159A,207A 'self':214B 'self-host':213B 'server':55A,70A 'servic':290C 'share':217B 'shared-host':216B 'string':311C 'suse':57A,61A,67A 'system':236B,294C 'traffic':132A,145A 'trigger':300C 'tti':3A,18A,227B,258C,273C 'ubuntu':74A,77A,80A,83A,86A 'use':241B 'user':233B,284C 'wan':165A 'webaccelerator':172A 'wild':255B 'write':4A,228B,245B,259C,307C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2014-05-07T10:55:04+00:00","kev":{"dateAdded":"2023-05-12","dueDate":"2023-06-02","requiredAction":"The impacted product is end-of-life and should be disconnected if still in use.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2014-0196","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-0196","severity":null,"published_at":"2023-05-12T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T10:39:06+00:00","note":null},{"source":"nvd","external_id":"CVE-2014-0196","url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0196","severity":null,"published_at":"2014-05-07T10:55:04+00:00","modified_at":"2026-06-17T00:02:29+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}