CVE-2014-2885

Multiple integer overflows in TrueCrypt 7.1a allow local users to (1) obtain sensitive information via vectors involving a crafted item->OriginalLength value in the MainThreadProc function in EncryptedIoQueue.c or (2) cause a denial of service (memory consumption) via vectors involving large StartingOffset and Length values in the ProcessVolumeDeviceControlIrp function in Ntdriver.c.

Score

CVSS 3.0 7.1 High

Status

Modified - secalert@redhat.com

Published

2018-03-19

Last modified

2024-08-06

Weaknesses

CWE-190, CWE-200, CWE-400

Affected products

• Truecrypt (Truecrypt Project)

References

• http://www.openwall.com/lists/oss-security/2014/04/17/7
• https://opencryptoaudit.org/reports/iSec_Final_Open_Crypto_Audit_Project_TrueCrypt_Security_Assessment.pdf