CVE-2014-3153

CVE-2014-3153 is a local privilege escalation flaw in the futex_requeue function of kernel/futex.c in the Linux kernel, where the code does not ensure that a requeue operation involves two different futex addresses. A local, unprivileged user triggers it by issuing crafted futex system calls that requeue a futex back to the same address, corrupting kernel state in the futex priority-inheritance queue. An attacker who exploits it can execute code with kernel-level (root) privileges, fully compromising the host without any network access; the bug was also the basis of the 2014 'Towelroot' one-click Android rooting exploit. Any Linux system running an affected, unpatched kernel is exposed - servers, Android handsets, and embedded devices - although exploitation requires the ability to run code locally on the target. The vulnerability is listed in CISA KEV (added 2022-05-25), indicating known in-the-wild exploitation, with EPSS at 37.2% (98th percentile) and no public PoC catalogued in the source data.

What to do: Apply kernel updates per vendor instructions (CISA required action): upgrade affected Linux systems to a kernel release from your distribution that includes the futex fix, and confirm the running version with 'uname -r' against your vendor's advisory. Because exploitation requires local code execution, prioritize multi-tenant servers, shared/embedded appliances, and Android device fleets where untrusted users or apps run locally, and monitor those systems for signs of local privilege escalation until patched.