CVE-2014-0196

What Is the Linux Kernel TTY Subsystem?

The Linux kernel's TTY (teletypewriter) subsystem manages terminal devices — both physical serial terminals and pseudoterminals (ptys) used by SSH sessions, terminal emulators, and shell processes. The n_tty line discipline is the default processing layer for TTY devices, handling input/output buffering, line editing (backspace, tab expansion), echo, and flow control. Because virtually every interactive Linux session flows through the TTY subsystem, vulnerabilities here can affect local privilege escalation paths for any authenticated user.

Overview

CVE-2014-0196 is a race condition vulnerability in the n_tty_write() function in the Linux kernel's TTY line discipline. When a TTY device is in LECHO (local echo) mode with OPOST (output post-processing) disabled, concurrent read and write operations on the same TTY can race, causing a kernel memory corruption or null pointer dereference. The primary impact is a kernel panic (denial of service), but in some kernel configurations and architectures the race may be exploitable for local privilege escalation.

Affected Versions

All major Linux distributions shipped backport patches in their stable kernel packages. Any system running kernel 3.14.0 or 3.14.1 without vendor patches was vulnerable.

Technical Details

Root Cause: Unsynchronized Concurrent TTY Read/Write

The race condition exists in drivers/tty/n_tty.c in the n_tty_write() function. When output post-processing (OPOST) is disabled but local echo (LECHO) is enabled, the write path processes characters and echoes them via a code path that is not properly synchronized with concurrent reads on the same TTY.

Under concurrent read and write pressure on the same TTY device, two threads can simultaneously access the TTY's internal buffers without adequate locking:

1. Thread A calls n_tty_write() and is in the middle of echoing output
2. Thread B reads from the same TTY, advancing the read position
3. The resulting unsynchronized state can produce a null pointer dereference or out-of-bounds memory access

The primary consequence is a kernel oops/panic (denial of service). On certain kernel versions and hardware configurations, the memory corruption may be leveraged for privilege escalation, as the corrupted data can influence kernel control flow.

Attack Characteristics

Discovery

Reported by Peter Hurley to the Linux kernel security team in late April 2014. The fix was merged into the mainline kernel in Linux 3.14.2.

Exploitation Context

• Requires local access (shell login or code execution on the target system)
• Primarily exploited as a denial-of-service (kernel crash) to disrupt systems or as a step in a local privilege escalation chain
• CISA added to KEV in May 2023 — exploitation confirmed against legacy Linux systems (older enterprise deployments, embedded Linux, IoT devices running end-of-life kernels)
• End-of-life kernel versions on unpatched systems (particularly in embedded systems and older server deployments) remain vulnerable

Remediation

1. Update the kernel to 3.14.2 or later, or apply the distribution-provided backport patch. For major distros: apt update && apt upgrade linux-image-* (Debian/Ubuntu) or equivalent.

2. Check current kernel version: uname -r. Kernels below 3.14.2 without vendor patches are vulnerable.

3. Decommission legacy systems running end-of-life kernel versions that cannot be patched. These are persistent attack targets for local privilege escalation.

4. Minimize local access on systems that cannot be patched — restrict shell access to trusted users only and audit SSH authorized keys.