CVE-2014-4699

What it actually does

The kernel fails to sanitize a non-canonical saved RIP value on return from certain system calls that bypass IRET, allowing a local process to trigger a race between ptrace and fork that results in privilege escalation or a double-fault denial of service.

Why it matters to the business

An unprivileged local user can obtain full root access on affected systems or crash the machine, enabling data theft, persistence, or service disruption on any Linux deployment still running kernels older than 3.15.4.

How an attack unfolds

An attacker compiles a program that repeatedly forks while attaching ptrace to the child, supplies a crafted non-canonical RIP value, and wins the race to redirect execution into kernel memory, yielding a root shell or triggering a double fault.

How to fix it

Upgrade the Linux kernel to version 3.15.4 or later on every affected distribution; apply the vendor-supplied backported patches if a full kernel update is not immediately feasible.

How to confirm the fix worked

Run 'uname -r' and confirm the running kernel is 3.15.4 or newer; re-execute the original proof-of-concept binary under the patched kernel and verify that it no longer yields elevated privileges or crashes the system.

Typical attack path

1. Compile and run a local exploit binary on the target host
2. Use ptrace to attach to a newly forked child process
3. Force the child through a system call that stores a non-canonical RIP
4. Win the race window to corrupt the return address
5. Execute arbitrary code with kernel privileges or cause double fault

How to detect it

Review authentication and process-creation logs for unexpected root shells spawned from non-privileged accounts; look for repeated ptrace and fork sequences in auditd or eBPF traces on systems that may still be vulnerable.

What your security team should do

• Immediately inventory all Linux hosts and identify those running kernels older than 3.15.4
• Prioritize patching production systems that allow untrusted local accounts
• Disable ptrace for unprivileged users via Yama LSM where the feature is not required
• Monitor for new local processes that combine ptrace and fork in rapid succession