CVE catalog

CVE-2014-9645

busybox: CVE-2014-9645

[CVE catalog]

Severity
Medium · CVSS 5.5CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.64% · Oct 25, 2026

The add_probe function in modutils/modprobe.c in BusyBox before 1.23.0 allows local users to bypass intended restrictions on loading kernel modules via a / (slash) character in a module name, as demonstrated by an "ifconfig /usbserial up" command or a "mount -t /snd_pcm none /" command.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianbusyboxsid1:1.38.0-3fixed
Debianbusyboxforky1:1.38.0-3fixed
Debianbusyboxtrixie1:1.37.0-6fixed
Debianbusyboxbookworm1:1.35.0-4+deb12u1fixed
Susebusyboxlinux enterprise module for basesystem 15 sp41.35.0-150400.3.8.1fixed
Opensusebusyboxleap 15.41.35.0-150400.3.8.1fixed
Opensusebusybox-linksleap 15.41.35.0-150400.4.3.14fixed
Susebusyboxlinux enterprise module for basesystem 15 sp31.35.0-150000.4.14.1fixed
Susebusyboxlinux enterprise high performance computing 15-espos1.35.0-150000.4.14.1fixed
Susebusyboxlinux enterprise high performance computing 15-ltss1.35.0-150000.4.14.1fixed
Susebusyboxlinux enterprise high performance computing 15 sp1-espos1.35.0-150000.4.14.1fixed
Susebusyboxlinux enterprise high performance computing 15 sp1-ltss1.35.0-150000.4.14.1fixed
Susebusyboxlinux enterprise high performance computing 15 sp2-espos1.35.0-150000.4.14.1fixed
Susebusyboxlinux enterprise high performance computing 15 sp2-ltss1.35.0-150000.4.14.1fixed
Susebusyboxlinux enterprise server 15-ltss1.35.0-150000.4.14.1fixed
Susebusyboxlinux enterprise server 15 sp1-bcl1.35.0-150000.4.14.1fixed
Susebusyboxlinux enterprise server 15 sp1-ltss1.35.0-150000.4.14.1fixed
Susebusyboxlinux enterprise server 15 sp2-bcl1.35.0-150000.4.14.1fixed
Susebusyboxlinux enterprise server 15 sp2-ltss1.35.0-150000.4.14.1fixed
Susebusyboxlinux enterprise server for sap applications 151.35.0-150000.4.14.1fixed
Susebusyboxlinux enterprise server for sap applications 15 sp11.35.0-150000.4.14.1fixed
Susebusyboxlinux enterprise server for sap applications 15 sp21.35.0-150000.4.14.1fixed
Susebusyboxmanager proxy 4.11.35.0-150000.4.14.1fixed
Susebusyboxmanager retail branch server 4.11.35.0-150000.4.14.1fixed
Susebusyboxmanager server 4.11.35.0-150000.4.14.1fixed
Susebusyboxenterprise storage 61.35.0-150000.4.14.1fixed
Susebusyboxenterprise storage 71.35.0-150000.4.14.1fixed
Opensusebusyboxleap 15.31.35.0-150000.4.14.1fixed
Ubuntubusybox14.041:1.20.0-8.1ubuntu1vulnerable
Ubuntubusybox14.041:1.20.0-9ubuntu1vulnerable
Ubuntubusybox14.041:1.20.0-9ubuntu2vulnerable
Ubuntubusybox14.041:1.21.0-1ubuntu1vulnerable
Ubuntubusybox14.041:1.21.0-1ubuntu1.4fixed
Susebusyboxlinux enterprise desktop 121.21.1-3.3fixed
Susebusyboxlinux enterprise server 121.21.1-3.3fixed
Susebusyboxlinux enterprise server for sap applications 121.21.1-3.3fixed
Opensusebusyboxtumbleweed1.35.0-6.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianbusyboxsourcesid1:1.22.0-15lowNot reported[776186]
Debianbusyboxsourceforky1:1.22.0-15lowNot reported[776186]
Debianbusyboxsourcetrixie1:1.22.0-15lowNot reported[776186]
Debianbusyboxsourcebookworm1:1.22.0-15lowNot reported[776186]
Susebusyboxrpmlinux enterprise module for basesystem 15 sp41.35.0-150400.3.8.1Not reportedSUSE-SU-2022:4371-1Not reported
Opensusebusyboxrpmleap 15.41.35.0-150400.3.8.1Not reportedSUSE-SU-2022:4371-1Not reported
Opensusebusybox-linksrpmleap 15.41.35.0-150400.4.3.14Not reportedSUSE-SU-2022:4371-1Not reported
Susebusyboxrpmlinux enterprise module for basesystem 15 sp31.35.0-150000.4.14.1Not reportedSUSE-SU-2022:4260-1Not reported
Susebusyboxrpmlinux enterprise high performance computing 15-espos1.35.0-150000.4.14.1Not reportedSUSE-SU-2022:4260-1Not reported
Susebusyboxrpmlinux enterprise high performance computing 15-ltss1.35.0-150000.4.14.1Not reportedSUSE-SU-2022:4260-1Not reported
Susebusyboxrpmlinux enterprise high performance computing 15 sp1-espos1.35.0-150000.4.14.1Not reportedSUSE-SU-2022:4260-1Not reported
Susebusyboxrpmlinux enterprise high performance computing 15 sp1-ltss1.35.0-150000.4.14.1Not reportedSUSE-SU-2022:4260-1Not reported
Susebusyboxrpmlinux enterprise high performance computing 15 sp2-espos1.35.0-150000.4.14.1Not reportedSUSE-SU-2022:4260-1Not reported
Susebusyboxrpmlinux enterprise high performance computing 15 sp2-ltss1.35.0-150000.4.14.1Not reportedSUSE-SU-2022:4260-1Not reported
Susebusyboxrpmlinux enterprise server 15-ltss1.35.0-150000.4.14.1Not reportedSUSE-SU-2022:4260-1Not reported
Susebusyboxrpmlinux enterprise server 15 sp1-bcl1.35.0-150000.4.14.1Not reportedSUSE-SU-2022:4260-1Not reported
Susebusyboxrpmlinux enterprise server 15 sp1-ltss1.35.0-150000.4.14.1Not reportedSUSE-SU-2022:4260-1Not reported
Susebusyboxrpmlinux enterprise server 15 sp2-bcl1.35.0-150000.4.14.1Not reportedSUSE-SU-2022:4260-1Not reported
Susebusyboxrpmlinux enterprise server 15 sp2-ltss1.35.0-150000.4.14.1Not reportedSUSE-SU-2022:4260-1Not reported
Susebusyboxrpmlinux enterprise server for sap applications 151.35.0-150000.4.14.1Not reportedSUSE-SU-2022:4260-1Not reported
Susebusyboxrpmlinux enterprise server for sap applications 15 sp11.35.0-150000.4.14.1Not reportedSUSE-SU-2022:4260-1Not reported
Susebusyboxrpmlinux enterprise server for sap applications 15 sp21.35.0-150000.4.14.1Not reportedSUSE-SU-2022:4260-1Not reported
Susebusyboxrpmmanager proxy 4.11.35.0-150000.4.14.1Not reportedSUSE-SU-2022:4260-1Not reported
Susebusyboxrpmmanager retail branch server 4.11.35.0-150000.4.14.1Not reportedSUSE-SU-2022:4260-1Not reported
Susebusyboxrpmmanager server 4.11.35.0-150000.4.14.1Not reportedSUSE-SU-2022:4260-1Not reported
Susebusyboxrpmenterprise storage 61.35.0-150000.4.14.1Not reportedSUSE-SU-2022:4260-1Not reported
Susebusyboxrpmenterprise storage 71.35.0-150000.4.14.1Not reportedSUSE-SU-2022:4260-1Not reported
Opensusebusyboxrpmleap 15.31.35.0-150000.4.14.1Not reportedSUSE-SU-2022:4260-1Not reported
Ubuntubusyboxdeb14.041:1.21.0-1ubuntu1.4Not reportedUBUNTU-CVE-2014-9645Not reported
Susebusyboxrpmlinux enterprise desktop 121.21.1-3.3Not reportedSUSE-SU-2015:1445-1Not reported
Susebusyboxrpmlinux enterprise server 121.21.1-3.3Not reportedSUSE-SU-2015:1445-1Not reported
Susebusyboxrpmlinux enterprise server for sap applications 121.21.1-3.3Not reportedSUSE-SU-2015:1445-1Not reported
Opensusebusyboxrpmtumbleweed1.35.0-6.1Not reportedOPENSUSE-SU-2024:12415-1Not reported

[Debian bug #776186]

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • [busybox-static]Unknown

    Source package: [busybox]

    Details (1)

    • 1.38.0-2.1 · x86_64 · tumbleweed

      Unknown · Fixed: 1.35.0-6.1

      Version impact unknown

      dsa · busybox · opensuse · tumbleweed

  • [busybox-testsuite]Unknown

    Source package: [busybox]

    Details (1)

    • 1.38.0-2.1 · x86_64 · tumbleweed

      Unknown · Fixed: 1.35.0-6.1

      Version impact unknown

      dsa · busybox · opensuse · tumbleweed

  • [busybox-warewulf3]Unknown

    Source package: [busybox]

    Details (1)

    • 1.38.0-2.1 · x86_64 · tumbleweed

      Unknown · Fixed: 1.35.0-6.1

      Version impact unknown

      dsa · busybox · opensuse · tumbleweed

  • [busybox]Fixed

    Source package: [busybox]

    Details (1)

    • 1.38.0-2.1 · x86_64 · tumbleweed

      Fixed · Fixed: 1.35.0-6.1

      dsa · busybox · opensuse · tumbleweed

[Debian 12 (Bookworm)]

  • [busybox]Fixed

    Source package: [busybox]

    Details (2)

    • 1:1.35.0-4+deb12u1+b1 · amd64 · bookworm

      Fixed · Fixed: 1:1.22.0-15

      dsa · busybox · debian · bookworm; dsa · busybox · debian · 12

    • 1:1.35.0-4+deb12u1+b1 · arm64 · bookworm

      Fixed · Fixed: 1:1.22.0-15

      dsa · busybox · debian · bookworm; dsa · busybox · debian · 12

  • [busybox-static]Fixed

    Source package: [busybox]

    Details (2)

    • 1:1.35.0-4+deb12u1+b1 · amd64 · bookworm

      Fixed · Fixed: 1:1.22.0-15

      dsa · busybox · debian · bookworm; dsa · busybox · debian · 12

    • 1:1.35.0-4+deb12u1+b1 · arm64 · bookworm

      Fixed · Fixed: 1:1.22.0-15

      dsa · busybox · debian · bookworm; dsa · busybox · debian · 12

  • [busybox-syslogd]Fixed

    Source package: [busybox]

    Details (2)

    • 1:1.35.0-4+deb12u1 · all · bookworm

      Fixed · Fixed: 1:1.22.0-15

      dsa · busybox · debian · bookworm; dsa · busybox · debian · 12

    • 1:1.35.0-4+deb12u1 · all · bookworm

      Fixed · Fixed: 1:1.22.0-15

      dsa · busybox · debian · bookworm; dsa · busybox · debian · 12

  • [udhcpc]Fixed

    Source package: [busybox]

    Details (2)

    • 1:1.35.0-4+deb12u1+b1 · amd64 · bookworm

      Fixed · Fixed: 1:1.22.0-15

      dsa · busybox · debian · bookworm; dsa · busybox · debian · 12

    • 1:1.35.0-4+deb12u1+b1 · arm64 · bookworm

      Fixed · Fixed: 1:1.22.0-15

      dsa · busybox · debian · bookworm; dsa · busybox · debian · 12

  • [udhcpd]Fixed

    Source package: [busybox]

    Details (2)

    • 1:1.35.0-4+deb12u1+b1 · amd64 · bookworm

      Fixed · Fixed: 1:1.22.0-15

      dsa · busybox · debian · bookworm; dsa · busybox · debian · 12

    • 1:1.35.0-4+deb12u1+b1 · arm64 · bookworm

      Fixed · Fixed: 1:1.22.0-15

      dsa · busybox · debian · bookworm; dsa · busybox · debian · 12

[Debian 13 (Trixie)]

  • [busybox]Fixed

    Source package: [busybox]

    Details (2)

    • 1:1.37.0-6+b8 · amd64 · trixie

      Fixed · Fixed: 1:1.22.0-15

      dsa · busybox · debian · 13

    • 1:1.37.0-6+b8 · arm64 · trixie

      Fixed · Fixed: 1:1.22.0-15

      dsa · busybox · debian · 13

  • [busybox-static]Fixed

    Source package: [busybox]

    Details (2)

    • 1:1.37.0-6+b8 · amd64 · trixie

      Fixed · Fixed: 1:1.22.0-15

      dsa · busybox · debian · 13

    • 1:1.37.0-6+b8 · arm64 · trixie

      Fixed · Fixed: 1:1.22.0-15

      dsa · busybox · debian · 13

  • [busybox-syslogd]Fixed

    Source package: [busybox]

    Details (2)

    • 1:1.37.0-6 · all · trixie

      Fixed · Fixed: 1:1.22.0-15

      dsa · busybox · debian · 13

    • 1:1.37.0-6 · all · trixie

      Fixed · Fixed: 1:1.22.0-15

      dsa · busybox · debian · 13

  • [udhcpc]Fixed

    Source package: [busybox]

    Details (2)

    • 1:1.37.0-6 · all · trixie

      Fixed · Fixed: 1:1.22.0-15

      dsa · busybox · debian · 13

    • 1:1.37.0-6 · all · trixie

      Fixed · Fixed: 1:1.22.0-15

      dsa · busybox · debian · 13

  • [udhcpd]Fixed

    Source package: [busybox]

    Details (2)

    • 1:1.37.0-6 · all · trixie

      Fixed · Fixed: 1:1.22.0-15

      dsa · busybox · debian · 13

    • 1:1.37.0-6 · all · trixie

      Fixed · Fixed: 1:1.22.0-15

      dsa · busybox · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]