CVE-2014-0196

CVE-2014-0196 is a race condition (CWE-362) in the n_tty_write function of the Linux kernel's TTY line discipline, where concurrent read and write operations involving long strings can corrupt memory. A local user triggers it by running a crafted program that performs simultaneous reads and writes of long data strings against a terminal (TTY) device, such as a PTY. Successful exploitation can crash the system (denial of service) or, in favorable memory layouts, let the local user execute code with elevated privileges; because it requires local access, a remote attacker would first need a foothold on the machine. Any Linux deployment running a vulnerable, unpatched kernel is affected, with the greatest risk on legacy or end-of-life systems that never received the 2014 fixes and on multi-user machines where untrusted users can open TTYs. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2023-05-12, indicating exploitation in the wild; ransomware use is unknown, no public proof-of-concept is catalogued here, and EPSS estimates roughly a 22.5% chance of exploitation in the next 30 days (98th percentile).

What to do: Patch kernels on all affected hosts with a kernel containing the May 2014 n_tty_write race fix (upstream 3.14.4 or later, or your distribution's backport). Because CISA states the impacted product is end-of-life, prioritize legacy appliances, embedded devices and OS builds that no longer receive kernel updates, and disconnect or replace any EOL system that cannot be patched. In the interim, restrict untrusted local shell access, since exploitation requires the ability to read and write long strings to a TTY.