Lutomirski had recently reported the CVE-2014-9090 which was caused due to improper handling of faults associated with the Stack Segment (SS) register on the x86 architecture. After notification of CVE-2014-9090, Borislav Petkov pointed out to Lutomirski some further flaws that existed even after vulnerability. After research Lutomirski discovered that there were two bugs in the improper handling of Stack Segment (SS) register. The new kernel kernel vulnerability is now identified CVE-2014-9322 and allows potential hacker to gain privilege escalation on all X86_64 systems.
Privilege Escalation Vulnerability in Linux #CVE-2014-9322
“Any kernel that is not patched against CVE-2014-9090 is vulnerable to privilege escalation due to incorrect handling of a #SS fault caused by an IRET instruction. In particular, if IRET executes on a writeable kernel stack (this was always the case before 3.16 and is sometimes the case on 3.16 and newer), the assembly function general_protection will execute with the user’s gsbase and the kernel’s gsbase swapped,” Lutomirski explained in an advisory.
He added that, “This is likely to be easy to exploit for privilege escalation, except on systems with SMAP or UDEREF. On those systems, assuming that the mitigation works correctly, the impact of this bug may be limited to massive memory corruption and an eventual crash or reboot.”