CVE-2014-0101

The sctp_sf_do_5_1D_ce function in net/sctp/sm_statefuns.c in the Linux kernel through 3.13.6 does not validate certain auth_enable and auth_capable fields before making an sctp_sf_authenticate call, which allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via an SCTP handshake with a modified INIT chunk and a crafted AUTH chunk before a COOKIE_ECHO chunk.

Published: 2014-03-11 Last update: 2026-05-06 Assigner: [email protected] Source: [email protected]
NVD Status：Modified，CVE State: published
View at NVD, CVE.org, EUVD

CVE-2014-0101 is rated Moderate Risk (61.1/100): CVSS High severity, with medium exploitation likelihood (EPSS 3.09%). Review affected assets and schedule remediation.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Exploit prediction scoring system (EPSS) score for CVE-2014-0101

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2025-08-19 3.34% 3.09% -0.25%
2 2025-03-30 8.54% 3.34% -5.19%
3 2025-03-29 — 8.54% —

Full EPSS history (13 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2014-0101

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
7.8 2.0 HIGH
AV:N/AC:L/Au:N/C:N/I:N/A:C Click to expand
Access vector (AV:N)
Can be exploited remotely over network reachability.
Access complexity (AC:L)
Exploitation conditions are straightforward and predictable.
Authentication (AU:N)
No authentication is required.
Confidentiality impact (C:N)
No confidentiality impact.
Integrity impact (I:N)
No integrity impact.
Availability impact (A:C)
Complete availability impact.
 10.0 6.9 [email protected]

Weakness enumeration for CVE-2014-0101

OS Trackers for CVE-2014-0101

vendor priority summary link
debian not yet assigned CVE-2014-0101 not yet assigned priority: Debian including 1 source packages (linux), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5. https://security-tracker.debian.org/tracker/CVE-2014-0101
redhat high — https://access.redhat.com/security/cve/CVE-2014-0101
ubuntu medium CVE-2014-0101 medium priority: Ubuntu including 31 source packages (linux, linux-2.6, …), 326 status rows across 12 suites (lucid, precise, quantal, saucy, trusty, upstream, utopic, vivid, wily, xenial, yakkety, zesty): DNE 228, released 41, ignored 36, not-affected 21. https://ubuntu.com/security/CVE-2014-0101

Affected software / configurations for CVE-2014-0101

Vendor Product Version Raw CPE
linux linux_kernel >= 2.6.24, < 3.2.56 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
linux linux_kernel >= 3.3, < 3.4.84 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
linux linux_kernel >= 3.5, < 3.10.34 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
linux linux_kernel >= 3.11, < 3.12.15 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
linux linux_kernel >= 3.13, < 3.13.7 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
redhat enterprise_linux_desktop 6.0 cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
redhat enterprise_linux_eus 6.3 cpe:2.3:o:redhat:enterprise_linux_eus:6.3:*:*:*:*:*:*:*
redhat enterprise_linux_eus 6.4 cpe:2.3:o:redhat:enterprise_linux_eus:6.4:*:*:*:*:*:*:*
redhat enterprise_linux_eus 6.5 cpe:2.3:o:redhat:enterprise_linux_eus:6.5:*:*:*:*:*:*:*
redhat enterprise_linux_server 6.0 cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
redhat enterprise_linux_server_aus 6.4 cpe:2.3:o:redhat:enterprise_linux_server_aus:6.4:*:*:*:*:*:*:*
redhat enterprise_linux_server_aus 6.5 cpe:2.3:o:redhat:enterprise_linux_server_aus:6.5:*:*:*:*:*:*:*
redhat enterprise_linux_server_tus 6.5 cpe:2.3:o:redhat:enterprise_linux_server_tus:6.5:*:*:*:*:*:*:*
redhat enterprise_linux_workstation 6.0 cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
canonical ubuntu_linux 10.04 cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:*
f5 big-ip_access_policy_manager >= 11.1.0, <= 11.5.3 cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
f5 big-ip_advanced_firewall_manager >= 11.3.0, <= 11.5.3 cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*
f5 big-ip_analytics >= 11.1.0, <= 11.5.3 cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*
f5 big-ip_application_acceleration_manager >= 11.4.0, <= 11.5.3 cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*
f5 big-ip_application_security_manager >= 11.1.0, <= 11.5.3 cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*
f5 big-ip_edge_gateway >= 11.1.0, <= 11.3.0 cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:*
f5 big-ip_enterprise_manager >= 2.1.0, <= 2.3.0 cpe:2.3:a:f5:big-ip_enterprise_manager:*:*:*:*:*:*:*:*
f5 big-ip_enterprise_manager >= 3.0.0, <= 3.1.1 cpe:2.3:a:f5:big-ip_enterprise_manager:*:*:*:*:*:*:*:*
f5 big-ip_global_traffic_manager >= 11.1.0, <= 11.5.3 cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*
f5 big-ip_link_controller >= 11.1.0, <= 11.5.3 cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*
f5 big-ip_local_traffic_manager >= 11.1.0, <= 11.5.3 cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*
f5 big-ip_policy_enforcement_manager >= 11.3.0, <= 11.5.3 cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*
f5 big-ip_protocol_security_module >= 11.1.0, <= 11.4.1 cpe:2.3:a:f5:big-ip_protocol_security_module:*:*:*:*:*:*:*:*
f5 big-ip_wan_optimization_manager >= 11.1.0, <= 11.3.0 cpe:2.3:a:f5:big-ip_wan_optimization_manager:*:*:*:*:*:*:*:*
f5 big-ip_webaccelerator >= 11.1.0, <= 11.3.0 cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*
f5 big-iq_adc 4.5.0 cpe:2.3:a:f5:big-iq_adc:4.5.0:*:*:*:*:*:*:*
f5 big-iq_centralized_management 4.6.0 cpe:2.3:a:f5:big-iq_centralized_management:4.6.0:*:*:*:*:*:*:*
f5 big-iq_cloud >= 4.0.0, <= 4.5.0 cpe:2.3:a:f5:big-iq_cloud:*:*:*:*:*:*:*:*
f5 big-iq_device >= 4.2.0, <= 4.5.0 cpe:2.3:a:f5:big-iq_device:*:*:*:*:*:*:*:*
f5 big-iq_security >= 4.0.0, <= 4.5.0 cpe:2.3:a:f5:big-iq_security:*:*:*:*:*:*:*:*

References for CVE-2014-0101

URL Tags
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=ec0223ec48a90cb605244b45f7c62de856403729
http://rhn.redhat.com/errata/RHSA-2014-0328.html Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2014-0419.html Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2014-0432.html Third Party Advisory
http://secunia.com/advisories/59216 Third Party Advisory
http://support.f5.com/kb/en-us/solutions/public/15000/300/sol15317.html Third Party Advisory
http://www.openwall.com/lists/oss-security/2014/03/04/6 Mailing List Patch Third Party Advisory
http://www.securityfocus.com/bid/65943 Third Party Advisory VDB Entry
http://www.ubuntu.com/usn/USN-2173-1 Third Party Advisory
http://www.ubuntu.com/usn/USN-2174-1 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1070705 Issue Tracking Patch Third Party Advisory
https://github.com/torvalds/linux/commit/ec0223ec48a90cb605244b45f7c62de856403729 Patch Third Party Advisory
cvelogic Threat Intelligence