CVE-2014-9715

What it actually does

Insufficient data type size for netfilter extension data triggers NULL pointer dereference and kernel OOPS on extension load from outbound traffic.

Why it matters to the business

Local users can trigger kernel crashes on Linux systems configured with PPTP tunnels in NAT setups, causing unplanned downtime and service interruption.

How an attack unfolds

A local attacker configures a PPTP tunnel in a NAT environment and generates outbound network traffic that forces netfilter extension loading, resulting in a NULL pointer dereference and kernel panic.

How to fix it

Upgrade the Linux kernel to version 3.14.5 or later where the data type size issue is resolved.

How to confirm the fix worked

Verify kernel version is at least 3.14.5; reproduce the PPTP/NAT traffic scenario and confirm absence of OOPS in dmesg.

Typical attack path

1. Obtain local shell access on affected Linux kernel
2. Configure PPTP tunnel in NAT environment
3. Generate outbound network traffic that triggers conntrack extension loading
4. Trigger NULL pointer dereference leading to OOPS

How to detect it

Review kernel logs (dmesg, /var/log/kern.log) for NULL pointer dereference or OOPS messages originating from nf_conntrack_extend or netfilter during PPTP or NAT traffic.

• nf_conntrack_extend.*NULL pointer dereference
• kernel: [OOPS] netfilter
• PPTP tunnel.*conntrack extension

What your security team should do

• Prioritize kernel upgrade to 3.14.5+ on all affected systems
• Restrict local user ability to configure network tunnels until patched
• Monitor kernel logs for netfilter-related oops entries