Summary
Detail | |||
---|---|---|---|
Vendor | Linux | First view | 1998-06-22 |
Product | Linux Kernel | Last view | 2024-07-17 |
Version | 2.0.11 | Type | Os |
Update | * | ||
Edition | * | ||
Language | * | ||
Sofware Edition | * | ||
Target Software | * | ||
Target Hardware | * | ||
Other | * | ||
CPE Product | cpe:2.3:o:linux:linux_kernel |
Activity : Overall
Related : CVE
Date | Alert | Description | |
---|---|---|---|
5.5 | 2024-07-17 | CVE-2024-41010 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix too early release of tcx_entry Pedro Pinto and later independently also Hyunwoo Kim and Wongi Lee reported an issue that the tcx_entry can be released too early leading to a use after free (UAF) when an active old-style ingress or clsact qdisc with a shared tc block is later replaced by another ingress or clsact instance. Essentially, the sequence to trigger the UAF (one example) can be as follows: 1. A network namespace is created rtnetlink_rcv_msg() 5. Finally, the network namespace is closed. This registers the cleanup_net() There are also other variants, the gist is to add an ingress (or clsact) qdisc with a specific shared block, then to replace that qdisc, waiting for the tcx_entry kfree_rcu() to be executed and subsequently accessing the current active qdisc's miniq one way or another. The correct fix is to turn the miniq_active boolean into a counter. What can be observed, at step 2 above, the counter transitions from 0->1, at step [a] from 1->2 (in order for the miniq object to remain active during the replacement), then in [b] from 2->1 and finally [c] 1->0 with the eventual release. The reference counter in general ranges from [0,2] and it does not need to be atomic since all access to the counter is protected by the rtnl mutex. With this in place, there is no longer a UAF happening and the tcx_entry is freed at the correct time. |
5.5 | 2024-07-17 | CVE-2024-41009 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix overrunning reservations in ringbuf The BPF ring buffer internally is implemented as a power-of-2 sized circular buffer, with two logical and ever-increasing counters: consumer_pos is the consumer counter to show which logical position the consumer consumed the data, and producer_pos which is the producer counter denoting the amount of data reserved by all producers. Each time a record is reserved, the producer that "owns" the record will successfully advance producer counter. In user space each time a record is read, the consumer of the data advanced the consumer counter once it finished processing. Both counters are stored in separate pages so that from user space, the producer counter is read-only and the consumer counter is read-write. One aspect that simplifies and thus speeds up the implementation of both producers and consumers is how the data area is mapped twice contiguously back-to-back in the virtual memory, allowing to not take any special measures for samples that have to wrap around at the end of the circular buffer data area, because the next page after the last data page would be first data page again, and thus the sample will still appear completely contiguous in virtual memory. Each record has a struct bpf_ringbuf_hdr { u32 len; u32 pg_off; } header for book-keeping the length and offset, and is inaccessible to the BPF program. Helpers like bpf_ringbuf_reserve() return `(void *)hdr + BPF_RINGBUF_HDR_SZ` for the BPF program to use. Bing-Jhong and Muhammad reported that it is however possible to make a second allocated memory chunk overlapping with the first chunk and as a result, the BPF program is now able to edit first chunk's header. For example, consider the creation of a BPF_MAP_TYPE_RINGBUF map with size of 0x4000. Next, the consumer_pos is modified to 0x3000 /before/ a call to bpf_ringbuf_reserve() is made. This will allocate a chunk A, which is in [0x0,0x3008], and the BPF program is able to edit [0x8,0x3008]. Now, lets allocate a chunk B with size 0x3000. This will succeed because consumer_pos was edited ahead of time to pass the `new_prod_pos - cons_pos > rb->mask` check. Chunk B will be in range [0x3008,0x6010], and the BPF program is able to edit [0x3010,0x6010]. Due to the ring buffer memory layout mentioned earlier, the ranges [0x0,0x4000] and [0x4000,0x8000] point to the same data pages. This means that chunk B at [0x4000,0x4008] is chunk A's header. bpf_ringbuf_submit() / bpf_ringbuf_discard() use the header's pg_off to then locate the bpf_ringbuf itself via bpf_ringbuf_restore_from_rec(). Once chunk B modified chunk A's header, then bpf_ringbuf_commit() refers to the wrong page and could cause a crash. Fix it by calculating the oldest pending_pos and check whether the range from the oldest outstanding record to the newest would span beyond the ring buffer size. If that is the case, then reject the request. We've tested with the ring buffer benchmark in BPF selftests (./benchs/run_bench_ringbufs.sh) before/after the fix and while it seems a bit slower on some benchmarks, it is still not significantly enough to matter. |
7.1 | 2024-07-16 | CVE-2022-48866 | In the Linux kernel, the following vulnerability has been resolved: HID: hid-thrustmaster: fix OOB read in thrustmaster_interrupts Syzbot reported an slab-out-of-bounds Read in thrustmaster_probe() bug. The root case is in missing validation check of actual number of endpoints. Code should not blindly access usb_host_interface::endpoint array, since it may contain less endpoints than code expects. Fix it by adding missing validaion check and print an error if number of endpoints do not match expected number |
5.5 | 2024-07-16 | CVE-2022-48865 | In the Linux kernel, the following vulnerability has been resolved: tipc: fix kernel panic when enabling bearer When enabling a bearer on a node, a kernel panic is observed: [ 4.498085] RIP: 0010:tipc_mon_prep+0x4e/0x130 [tipc] ... [ 4.520030] Call Trace: [ 4.520689] The node in question is receiving activate messages in another thread after changing bearer status to allow message sending/ receiving in current thread: thread 1 | thread 2 Monitoring pointer in thread 2 is dereferenced before monitoring data is allocated in thread 1. This causes kernel panic. This commit fixes it by allocating the monitoring data before enabling the bearer to receive messages. |
5.5 | 2024-07-16 | CVE-2022-48864 | In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: add validation for VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET command When control vq receives a VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET command request from the driver, presently there is no validation against the number of queue pairs to configure, or even if multiqueue had been negotiated or not is unverified. This may lead to kernel panic due to uninitialized resource for the queues were there any bogus request sent down by untrusted driver. Tie up the loose ends there. |
5.5 | 2024-07-16 | CVE-2022-48863 | In the Linux kernel, the following vulnerability has been resolved: mISDN: Fix memory leak in dsp_pipeline_build() dsp_pipeline_build() allocates dup pointer by kstrdup(cfg), but then it updates dup variable by strsep(&dup, "|"). As a result when it calls kfree(dup), the dup variable contains NULL. Found by Linux Driver Verification project (linuxtesting.org) with SVACE. |
5.5 | 2024-07-16 | CVE-2022-48862 | In the Linux kernel, the following vulnerability has been resolved: vhost: fix hung thread due to erroneous iotlb entries In vhost_iotlb_add_range_ctx(), range size can overflow to 0 when start is 0 and last is ULONG_MAX. One instance where it can happen is when userspace sends an IOTLB message with iova=size=uaddr=0 (vhost_process_iotlb_msg). So, an entry with size = 0, start = 0, last = ULONG_MAX ends up in the iotlb. Next time a packet is sent, iotlb_access_ok() loops indefinitely due to that erroneous entry. Call Trace: Reported by syzbot at: To fix this, do two things: 1. Return -EINVAL in vhost_chr_write_iter() when userspace asks to map |
5.5 | 2024-07-16 | CVE-2022-48861 | In the Linux kernel, the following vulnerability has been resolved: vdpa: fix use-after-free on vp_vdpa_remove When vp_vdpa driver is unbind, vp_vdpa is freed in vdpa_unregister_device and then vp_vdpa->mdev.pci_dev is dereferenced in vp_modern_remove, triggering use-after-free. Call Trace of unbinding driver free vp_vdpa : do_syscall_64 Call Trace of dereference vp_vdpa->mdev.pci_dev: vp_modern_remove |
5.5 | 2024-07-16 | CVE-2022-48860 | In the Linux kernel, the following vulnerability has been resolved: ethernet: Fix error handling in xemaclite_of_probe This node pointer is returned by of_parse_phandle() with refcount incremented in this function. Calling of_node_put() to avoid the refcount leak. As the remove function do. |
5.5 | 2024-07-16 | CVE-2022-48859 | In the Linux kernel, the following vulnerability has been resolved: net: marvell: prestera: Add missing of_node_put() in prestera_switch_set_base_mac_addr This node pointer is returned by of_find_compatible_node() with refcount incremented. Calling of_node_put() to aovid the refcount leak. |
7 | 2024-07-16 | CVE-2022-48858 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix a race on command flush flow Fix a refcount use after free warning due to a race on command entry. Such race occurs when one of the commands releases its last refcount and frees its index and entry while another process running command flush flow takes refcount to this command entry. The process which handles commands flush may see this command as needed to be flushed if the other process released its refcount but didn't release the index yet. Fix it by adding the needed spin lock. It fixes the following warning trace: refcount_t: addition on 0; use-after-free. WARNING: CPU: 11 PID: 540311 at lib/refcount.c:25 refcount_warn_saturate+0x80/0xe0 ... RIP: 0010:refcount_warn_saturate+0x80/0xe0 ... Call Trace: |
5.5 | 2024-07-16 | CVE-2022-48857 | In the Linux kernel, the following vulnerability has been resolved: NFC: port100: fix use-after-free in port100_send_complete Syzbot reported UAF in port100_send_complete(). The root case is in missing usb_kill_urb() calls on error handling path of ->probe function. port100_send_complete() accesses devm allocated memory which will be freed on probe failure. We should kill this urbs before returning an error from probe function to prevent reported use-after-free Fail log: BUG: KASAN: use-after-free in port100_send_complete+0x16e/0x1a0 drivers/nfc/port100.c:935 Read of size 1 at addr ffff88801bb59540 by task ksoftirqd/2/26 ... Call Trace: ... Allocated by task 1255: Freed by task 1255: |
5.5 | 2024-07-16 | CVE-2022-48856 | In the Linux kernel, the following vulnerability has been resolved: gianfar: ethtool: Fix refcount leak in gfar_get_ts_info The of_find_compatible_node() function returns a node pointer with refcount incremented, We should use of_node_put() on it when done Add the missing of_node_put() to release the refcount. |
7.1 | 2024-07-16 | CVE-2022-48855 | In the Linux kernel, the following vulnerability has been resolved: sctp: fix kernel-infoleak for SCTP sockets syzbot reported a kernel infoleak [1] of 4 bytes. After analysis, it turned out r->idiag_expires is not initialized if inet_sctp_diag_fill() calls inet_diag_msg_common_fill() Make sure to clear idiag_timer/idiag_retrans/idiag_expires and let inet_diag_msg_sctpasoc_fill() fill them again if needed. [1] BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:121 [inline] BUG: KMSAN: kernel-infoleak in copyout lib/iov_iter.c:154 [inline] BUG: KMSAN: kernel-infoleak in _copy_to_iter+0x6ef/0x25a0 lib/iov_iter.c:668 Uninit was created at: Bytes 68-71 of 2508 are uninitialized Memory access of size 2508 starts at ffff888114f9b000 Data copied to user address 00007f7fe09ff2e0 CPU: 1 PID: 3478 Comm: syz-executor306 Not tainted 5.17.0-rc4-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 |
7.8 | 2024-07-16 | CVE-2022-48854 | In the Linux kernel, the following vulnerability has been resolved: net: arc_emac: Fix use after free in arc_mdio_probe() If bus->state is equal to MDIOBUS_ALLOCATED, mdiobus_free(bus) will free the "bus". But bus->name is still used in the next line, which will lead to a use after free. We can fix it by putting the name in a local variable and make the bus->name point to the rodata section "name",then use the name in the error message without referring to bus to avoid the uaf. |
5.5 | 2024-07-16 | CVE-2022-48853 | In the Linux kernel, the following vulnerability has been resolved: swiotlb: fix info leak with DMA_FROM_DEVICE The problem I'm addressing was discovered by the LTP test covering cve-2018-1000204. A short description of what happens follows: 1) The test case issues a command code 00 (TEST UNIT READY) via the SG_IO One can argue that this is an swiotlb problem, because without swiotlb we leak all zeros, and the swiotlb should be transparent in a sense that it does not affect the outcome (if all other participants are well behaved). Copying the content of the original buffer into the swiotlb buffer is the only way I can think of to make swiotlb transparent in such scenarios. So let's do just that if in doubt, but allow the driver to tell us that the whole mapped buffer is going to be overwritten, in which case we can preserve the old behavior and avoid the performance impact of the extra bounce. |
3.3 | 2024-07-16 | CVE-2022-48852 | In the Linux kernel, the following vulnerability has been resolved: drm/vc4: hdmi: Unregister codec device on unbind On bind we will register the HDMI codec device but we don't unregister it on unbind, leading to a device leakage. Unregister our device at unbind. |
7.8 | 2024-07-16 | CVE-2022-48851 | In the Linux kernel, the following vulnerability has been resolved: staging: gdm724x: fix use after free in gdm_lte_rx() The netif_rx_ni() function frees the skb so we can't dereference it to save the skb->len. |
5.5 | 2024-07-16 | CVE-2022-48850 | In the Linux kernel, the following vulnerability has been resolved: net-sysfs: add check for netdevice being present to speed_show When bringing down the netdevice or system shutdown, a panic can be triggered while accessing the sysfs path because the device is already removed. [ 755.549084] mlx5_core 0000:12:00.1: Shutdown was called crash> bt crash> net_device.state ffff89443b0c0000 To prevent this scenario, we also make sure that the netdevice is present. |
5.5 | 2024-07-16 | CVE-2022-48849 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: bypass tiling flag check in virtual display case (v2) vkms leverages common amdgpu framebuffer creation, and also as it does not support FB modifier, there is no need to check tiling flags when initing framebuffer when virtual display is enabled. This can fix below calltrace: amdgpu 0000:00:08.0: GFX9+ requires FB check based on format modifier WARNING: CPU: 0 PID: 1023 at drivers/gpu/drm/amd/amdgpu/amdgpu_display.c:1150 amdgpu_display_framebuffer_init+0x8e7/0xb40 [amdgpu] v2: check adev->enable_virtual_display instead as vkms can be |
7.8 | 2024-07-16 | CVE-2022-48848 | In the Linux kernel, the following vulnerability has been resolved: tracing/osnoise: Do not unregister events twice Nicolas reported that using: # trace-cmd record -e all -M 10 -p osnoise --poll Resulted in the following kernel warning: ------------[ cut here ]------------ The warning complains about an attempt to unregister an unregistered tracepoint. This happens on trace-cmd because it first stops tracing, and then switches the tracer to nop. Which is equivalent to: # cd /sys/kernel/tracing/ The osnoise tracer stops the workload when no trace instance is actually collecting data. This can be caused both by disabling tracing or disabling the tracer itself. To avoid unregistering events twice, use the existing trace_osnoise_callback_enabled variable to check if the events (and the workload) are actually active before trying to deactivate them. |
7.8 | 2024-07-16 | CVE-2022-48847 | In the Linux kernel, the following vulnerability has been resolved: watch_queue: Fix filter limit check In watch_queue_set_filter(), there are a couple of places where we check that the filter type value does not exceed what the type_filter bitmap can hold. One place calculates the number of bits by: if (tf[i].type >= sizeof(wfilter->type_filter) * 8) which is fine, but the second does: if (tf[i].type >= sizeof(wfilter->type_filter) * BITS_PER_LONG) which is not. This can lead to a couple of out-of-bounds writes due to a too-large type: (1) __set_bit() on wfilter->type_filter Fix this by just using the proper WATCH_TYPE__NR instead, which is the number of types we actually know about. The bug may cause an oops looking something like: BUG: KASAN: slab-out-of-bounds in watch_queue_set_filter+0x659/0x740 Allocated by task 611: The buggy address belongs to the object at ffff88800d2c66a0 |
5.5 | 2024-07-16 | CVE-2022-48846 | In the Linux kernel, the following vulnerability has been resolved: block: release rq qos structures for queue without disk blkcg_init_queue() may add rq qos structures to request queue, previously blk_cleanup_queue() calls rq_qos_exit() to release them, but commit 8e141f9eb803 ("block: drain file system I/O on del_gendisk") moves rq_qos_exit() into del_gendisk(), so memory leak is caused because queues may not have disk, such as un-present scsi luns, nvme admin queue, ... Fixes the issue by adding rq_qos_exit() to blk_cleanup_queue() back. BTW, v5.18 won't need this patch any more since we move blkcg_init_queue()/blkcg_exit_queue() into disk allocation/release handler, and patches have been in for-5.18/block. |
5.5 | 2024-07-16 | CVE-2022-48845 | In the Linux kernel, the following vulnerability has been resolved: MIPS: smp: fill in sibling and core maps earlier After enabling CONFIG_SCHED_CORE (landed during 5.14 cycle), 2-core 2-thread-per-core interAptiv (CPS-driven) started emitting the following: [ 0.025698] CPU1 revision is: 0001a120 (MIPS interAptiv (multi)) [ 0.048183] ------------[ cut here ]------------ [ 0.048187] WARNING: CPU: 1 PID: 0 at kernel/sched/core.c:6025 sched_core_cpu_starting+0x198/0x240 [ 0.048220] Modules linked in: [ 0.048233] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.17.0-rc3+ #35 b7b319f24073fd9a3c2aa7ad15fb7993eec0b26f [ 0.048247] Stack : 817f0000 00000004 327804c8 810eb050 00000000 00000004 00000000 c314fdd1 [ 0.048278] 830cbd64 819c0000 81800000 817f0000 83070bf4 00000001 830cbd08 00000000 [ 0.048307] 00000000 00000000 815fcbc4 00000000 00000000 00000000 00000000 00000000 [ 0.048334] 00000000 00000000 00000000 00000000 817f0000 00000000 00000000 817f6f34 [ 0.048361] 817f0000 818a3c00 817f0000 00000004 00000000 00000000 4dc33260 0018c933 [ 0.048389] ... [ 0.048396] Call Trace: [ 0.048399] [<8105a7bc>] show_stack+0x3c/0x140 [ 0.048424] [<8131c2a0>] dump_stack_lvl+0x60/0x80 [ 0.048440] [<8108b5c0>] __warn+0xc0/0xf4 [ 0.048454] [<8108b658>] warn_slowpath_fmt+0x64/0x10c [ 0.048467] [<810bd418>] sched_core_cpu_starting+0x198/0x240 [ 0.048483] [<810c6514>] sched_cpu_starting+0x14/0x80 [ 0.048497] [<8108c0f8>] cpuhp_invoke_callback_range+0x78/0x140 [ 0.048510] [<8108d914>] notify_cpu_starting+0x94/0x140 [ 0.048523] [<8106593c>] start_secondary+0xbc/0x280 [ 0.048539] [ 0.048543] ---[ end trace 0000000000000000 ]--- [ 0.048636] Synchronize counters for CPU 1: done. ...for each but CPU 0/boot. Basic debug printks right before the mentioned line say: [ 0.048170] CPU: 1, smt_mask: So smt_mask, which is sibling mask obviously, is empty when entering the function. This is critical, as sched_core_cpu_starting() calculates core-scheduling parameters only once per CPU start, and it's crucial to have all the parameters filled in at that moment (at least it uses cpu_smt_mask() which in fact is `&cpu_sibling_map[cpu]` on MIPS). A bit of debugging led me to that set_cpu_sibling_map() performing the actual map calculation, was being invocated after notify_cpu_start(), and exactly the latter function starts CPU HP callback round (sched_core_cpu_starting() is basically a CPU HP callback). While the flow is same on ARM64 (maps after the notifier, although before calling set_cpu_online()), x86 started calculating sibling maps earlier than starting the CPU HP callbacks in Linux 4.14 (see [0] for the reference). Neither me nor my brief tests couldn't find any potential caveats in calculating the maps right after performing delay calibration, but the WARN splat is now gone. The very same debug prints now yield exactly what I expected from them: [ 0.048433] CPU: 1, smt_mask: 0-1 [0] https://git.kernel.org/pub/scm/linux/kernel/git/mips/linux.git/commit/?id=76ce7cfe35ef |
5.5 | 2024-07-16 | CVE-2022-48844 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Fix leaking sent_cmd skb sent_cmd memory is not freed before freeing hci_dev causing it to leak it contents. |
CWE : Common Weakness Enumeration
% | id | Name |
---|---|---|
14% (377) | CWE-416 | Use After Free |
11% (306) | CWE-476 | NULL Pointer Dereference |
7% (197) | CWE-362 | Race Condition |
7% (189) | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
6% (166) | CWE-200 | Information Exposure |
5% (132) | CWE-20 | Improper Input Validation |
5% (130) | CWE-787 | Out-of-bounds Write |
4% (124) | CWE-401 | Failure to Release Memory Before Removing Last Reference ('Memory L... |
4% (117) | CWE-125 | Out-of-bounds Read |
4% (106) | CWE-399 | Resource Management Errors |
3% (100) | CWE-264 | Permissions, Privileges, and Access Controls |
2% (73) | CWE-190 | Integer Overflow or Wraparound |
2% (52) | CWE-189 | Numeric Errors |
1% (46) | CWE-667 | Insufficient Locking |
1% (46) | CWE-400 | Uncontrolled Resource Consumption ('Resource Exhaustion') |
1% (36) | CWE-415 | Double Free |
1% (36) | CWE-120 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflo... |
0% (25) | CWE-269 | Improper Privilege Management |
0% (17) | CWE-770 | Allocation of Resources Without Limits or Throttling |
0% (17) | CWE-665 | Improper Initialization |
0% (16) | CWE-369 | Divide By Zero |
0% (13) | CWE-772 | Missing Release of Resource after Effective Lifetime |
0% (12) | CWE-755 | Improper Handling of Exceptional Conditions |
0% (12) | CWE-17 | Code |
0% (11) | CWE-310 | Cryptographic Issues |
CAPEC : Common Attack Pattern Enumeration & Classification
id | Name |
---|---|
CAPEC-1 | Accessing Functionality Not Properly Constrained by ACLs |
CAPEC-8 | Buffer Overflow in an API Call |
CAPEC-9 | Buffer Overflow in Local Command-Line Utilities |
CAPEC-10 | Buffer Overflow via Environment Variables |
CAPEC-14 | Client-side Injection-induced Buffer Overflow |
CAPEC-17 | Accessing, Modifying or Executing Executable Files |
CAPEC-24 | Filter Failure through Buffer Overflow |
CAPEC-42 | MIME Conversion |
CAPEC-44 | Overflow Binary Resource File |
CAPEC-45 | Buffer Overflow via Symbolic Links |
CAPEC-46 | Overflow Variables and Tags |
CAPEC-47 | Buffer Overflow via Parameter Expansion |
CAPEC-59 | Session Credential Falsification through Prediction |
CAPEC-60 | Reusing Session IDs (aka Session Replay) |
CAPEC-61 | Session Fixation |
CAPEC-62 | Cross Site Request Forgery (aka Session Riding) |
CAPEC-92 | Forced Integer Overflow |
CAPEC-100 | Overflow Buffers |
CAPEC-112 | Brute Force |
CAPEC-122 | Exploitation of Authorization |
CAPEC-128 | Integer Attacks |
CAPEC-168 | Windows ::DATA Alternate Data Stream |
CAPEC-180 | Exploiting Incorrectly Configured Access Control Security Levels |
CAPEC-232 | Exploitation of Privilege/Trust |
CAPEC-234 | Hijacking a privileged process |
SAINT Exploits
Description | Link |
---|---|
Linux kernel __sock_diag_rcv_msg Netlink message privilege elevation | More info here |
Ubuntu overlayfs privilege elevation | More info here |
Linux kernel futex_requeue privilege elevation | More info here |
Linux Dirty COW Local File Overwrite | More info here |
Open Source Vulnerability Database (OSVDB)
id | Description |
---|---|
78509 | Linux Kernel /proc/<pid>/mem Access Restriction Weakness Local Privileg... |
78303 | Linux Kernel sctp_rcv() / sctp_accept() Socket Lock Race Remote DoS |
78302 | Linux Kernel m_stop() Implementation Local DoS |
78301 | Linux Kernel NSF O_Direct Implementation Local DoS |
78264 | Linux Kernel KVM syscall Instruction Executable Handling Local DoS |
78226 | Linux Kernel fs/xfs/xfs_acl.c xfs_acl_from_disk() Function Memory Corruption |
78225 | Linux Kernel net/ipv4/igmp.c igmp_heard_query() Function IGMP Query Parsing R... |
78014 | Linux Kernel SG_IO SCSI IOCTL Command Parsing Local Privilege Escalation |
77780 | Linux Kernel B.A.T.M.A.N. net/batman/icmp_socket.c bat_socket_read() Packet P... |
77684 | Linux Kernel OMAP4 Bridge Networking Interface Network Packet Parsing Remote DoS |
77683 | Linux Kernel HFS File System Mount Local Privilege Escalation |
77626 | Linux Kernel kvm_vm_ioctl_assign_device Function /dev/kym Local DoS |
77625 | Linux Kernel NFSv4 Mount mknod(2) Syscall Local DoS |
77485 | Linux Kernel /mm/oom_kill.c Local Overflow |
77452 | OpenFabrics Enterprise Distribution (OFED) RDS_FLAG_CONG_BITMAP Flagged RDS M... |
77360 | Linux Kernel TX_SKB_SHARING Local DoS |
77355 | Linux Kernel clock_gettime() Call Parsing Local DoS |
77295 | Linux Kernel UFO IPv6 UDP Datagram Parsing Remote DoS |
77293 | Linux Kernel b43 Driver Wireless Interface Frame Parsing Remote DoS |
76805 | Linux Kernel net/core/net_namespace.c Network Namespace Cleanup Weakness Remo... |
76796 | Linux Kernel taskstats Access Restriction Weakness Local Information Disclosure |
76793 | Linux Kernel security/apparmor/lsm.c apparmor_setprocattr() Function /attr/cu... |
76666 | Linux Kernel ext4 Extent Splitting BUG_ON() Local DoS |
76641 | Linux Kernel fs/xfs/xfs_vnodeops.c xfs_readlink() Function XFS Image Handling... |
76639 | Linux Kernel NULL Pointer Dereference ghash Algorithm Local DoS |
ExploitDB Exploits
id | Description |
---|---|
35370 | Linux Kernel libfutex Local Root for RHEL/CentOS 7.0.1406 |
35161 | Linux Local Root => 2.6.39 (32-bit & 64-bit) - Mempodipper #2 |
34923 | Linux Kernel remount FUSE Exploit |
34134 | Linux Kernel ptrace/sysret - Local Privilege Escalation |
33824 | Linux Kernel <= 3.13 - Local Privilege Escalation PoC (gid) |
33516 | Linux kernel 3.14-rc1 <= 3.15-rc4 - Raw Mode PTY Local Echo Race Condition... |
33336 | Linux Kernel 3.3-3.8 - SOCK_DIAG Local Root Exploit |
32926 | Linux group_info refcounter - Overflow Memory Corruption |
31574 | Linux ARM - Local Root Exploit |
31347 | linux 3.4+ local root (CONFIG_X86_X32=y) |
31346 | Linux 3.4+ Arbitrary write with CONFIG_X86_X32 |
30605 | Linux Kernel 2.6.x ALSA snd-page-alloc Local Proc File Information Disclosure... |
29822 | Man Command -H Flag Local Buffer Overflow Vulnerability |
26131 | Linux kernel perf_swevent_init - Local root Exploit |
24696 | Linux Kernel 2.6.x IPTables Logging Rules Integer Underflow Vulnerability |
18411 | Mempodipper - Linux Local Root for >=2.6.39, 32-bit and 64-bit |
18378 | Linux IGMP Remote Denial Of Service (Introduced in linux-2.6.36) |
17787 | Linux Kernel < 2.6.36.2 Econet Privilege Escalation Exploit |
16973 | Linux <= 2.6.37-rc1 serial_core TIOCGICOUNT Leak Exploit |
16952 | Linux Kernel < 2.6.37-rc2 TCP_MAXSEG Kernel Panic DoS |
16263 | Linux Kernel <= 2.6.37 Local Kernel Denial of Service |
15774 | Linux Kernel < 2.6.37-rc2 ACPI custom_method Privilege Escalation |
15704 | Linux Kernel <= 2.6.37 - Local Privilege Escalation |
15344 | Linux Kernel VIDIOCSMICROCODE IOCTL Local Memory Overwrite Vulnerability |
15285 | Linux RDS Protocol Local Privilege Escalation |
OpenVAS Exploits
id | Description |
---|---|
2013-09-18 | Name : Debian Security Advisory DSA 2389-1 (linux-2.6 - privilege escalation/denial ... File : nvt/deb_2389_1.nasl |
2013-09-18 | Name : Debian Security Advisory DSA 2443-1 (linux-2.6 - privilege escalation/denial ... File : nvt/deb_2443_1.nasl |
2013-09-18 | Name : Debian Security Advisory DSA 2469-1 (linux-2.6 - privilege escalation/denial ... File : nvt/deb_2469_1.nasl |
2012-12-26 | Name : CentOS Update for kernel CESA-2012:1580 centos6 File : nvt/gb_CESA-2012_1580_kernel_centos6.nasl |
2012-12-26 | Name : RedHat Update for kernel RHSA-2012:1580-01 File : nvt/gb_RHSA-2012_1580-01_kernel.nasl |
2012-12-26 | Name : Ubuntu Update for linux USN-1669-1 File : nvt/gb_ubuntu_USN_1669_1.nasl |
2012-12-26 | Name : Ubuntu Update for linux-ti-omap4 USN-1670-1 File : nvt/gb_ubuntu_USN_1670_1.nasl |
2012-12-26 | Name : Ubuntu Update for linux USN-1671-1 File : nvt/gb_ubuntu_USN_1671_1.nasl |
2012-12-26 | Name : Ubuntu Update for linux-ti-omap4 USN-1673-1 File : nvt/gb_ubuntu_USN_1673_1.nasl |
2012-12-26 | Name : Ubuntu Update for linux USN-1677-1 File : nvt/gb_ubuntu_USN_1677_1.nasl |
2012-12-26 | Name : Ubuntu Update for linux-lts-backport-oneiric USN-1678-1 File : nvt/gb_ubuntu_USN_1678_1.nasl |
2012-12-26 | Name : Ubuntu Update for linux-ti-omap4 USN-1679-1 File : nvt/gb_ubuntu_USN_1679_1.nasl |
2012-12-18 | Name : Fedora Update for kernel FEDORA-2012-20240 File : nvt/gb_fedora_2012_20240_kernel_fc16.nasl |
2012-12-14 | Name : Ubuntu Update for linux-ec2 USN-1664-1 File : nvt/gb_ubuntu_USN_1664_1.nasl |
2012-12-11 | Name : Ubuntu Update for linux USN-1660-1 File : nvt/gb_ubuntu_USN_1660_1.nasl |
2012-12-11 | Name : Ubuntu Update for linux USN-1661-1 File : nvt/gb_ubuntu_USN_1661_1.nasl |
2012-12-06 | Name : CentOS Update for kernel CESA-2012:1540 centos5 File : nvt/gb_CESA-2012_1540_kernel_centos5.nasl |
2012-12-06 | Name : RedHat Update for kernel RHSA-2012:1540-01 File : nvt/gb_RHSA-2012_1540-01_kernel.nasl |
2012-12-06 | Name : Ubuntu Update for linux-ec2 USN-1653-1 File : nvt/gb_ubuntu_USN_1653_1.nasl |
2012-12-04 | Name : Fedora Update for kernel FEDORA-2012-19337 File : nvt/gb_fedora_2012_19337_kernel_fc17.nasl |
2012-12-04 | Name : Ubuntu Update for linux USN-1644-1 File : nvt/gb_ubuntu_USN_1644_1.nasl |
2012-12-04 | Name : Ubuntu Update for linux-ti-omap4 USN-1645-1 File : nvt/gb_ubuntu_USN_1645_1.nasl |
2012-12-04 | Name : Ubuntu Update for linux USN-1646-1 File : nvt/gb_ubuntu_USN_1646_1.nasl |
2012-12-04 | Name : Ubuntu Update for linux-ti-omap4 USN-1647-1 File : nvt/gb_ubuntu_USN_1647_1.nasl |
2012-12-04 | Name : Ubuntu Update for linux USN-1648-1 File : nvt/gb_ubuntu_USN_1648_1.nasl |
Information Assurance Vulnerability Management (IAVM)
id | Description |
---|---|
2015-A-0150 | Multiple Security Vulnerabilities in Juniper Networks CTPView Severity: Category I - VMSKEY: V0061073 |
2012-A-0153 | Multiple Vulnerabilities in VMware ESX 4.0 and ESXi 4.0 Severity: Category I - VMSKEY: V0033884 |
2012-A-0148 | Multiple Vulnerabilities in VMware ESXi 4.1 and ESX 4.1 Severity: Category I - VMSKEY: V0033794 |
2012-A-0136 | Multiple Vulnerabilities in Juniper Network Management Products Severity: Category I - VMSKEY: V0033662 |
2012-A-0073 | Multiple Vulnerabilities in VMware ESXi 4.1 and ESX 4.1 Severity: Category I - VMSKEY: V0032171 |
2012-A-0056 | Multiple Vulnerabilities in VMWare ESX 4.0 and ESXi 4.0 Severity: Category I - VMSKEY: V0031979 |
2012-A-0020 | Multiple Vulnerabilities in VMware ESX 4.1 and ESXi 4.1 Severity: Category I - VMSKEY: V0031252 |
2011-A-0147 | Multiple Vulnerabilities in VMware ESX and ESXi Severity: Category I - VMSKEY: V0030545 |
2011-A-0075 | Multiple Vulnerabilities in VMware Products Severity: Category I - VMSKEY: V0028311 |
2011-A-0066 | Multiple Vulnerabilities in VMware Products Severity: Category I - VMSKEY: V0027158 |
2010-B-0085 | Linux Kernel Privilege Escalation Vulnerability Severity: Category I - VMSKEY: V0025410 |
2010-A-0037 | Multiple Vulnerabilities in Linux Kernel Severity: Category I - VMSKEY: V0022704 |
2010-A-0015 | Multiple Vulnerabilities in Red Hat Linux Kernel Severity: Category I - VMSKEY: V0022631 |
2010-A-0001 | Multiple Vulnerabilities in Linux Kernel Severity: Category I - VMSKEY: V0022180 |
2009-A-0105 | Multiple Vulnerabilities in VMware Products Severity: Category I - VMSKEY: V0021867 |
Snort® IPS/IDS
Date | Description |
---|---|
2014-01-10 | record route rr denial of service attempt RuleID : 8730 - Type : PROTOCOL-ICMP - Revision : 6 |
2014-01-10 | IPv6 packets encapsulated in IPv4 RuleID : 8446 - Type : POLICY-OTHER - Revision : 8 |
2020-11-19 | Linux kernel af_packet tpacket_rcv integer overflow attempt RuleID : 56052 - Type : OS-LINUX - Revision : 1 |
2020-11-19 | Linux kernel af_packet tpacket_rcv integer overflow attempt RuleID : 56051 - Type : OS-LINUX - Revision : 1 |
2019-09-26 | Google Android Kernel local denial of service attempt RuleID : 51291 - Type : OS-MOBILE - Revision : 1 |
2019-09-26 | Google Android Kernel local denial of service attempt RuleID : 51290 - Type : OS-MOBILE - Revision : 1 |
2019-01-15 | (tcp)TCPdataoffsetislessthan5 RuleID : 46 - Type : - Revision : 2 |
2017-11-21 | Linux kernel nfsd nfsd4_layout_verify out of bounds read attempt RuleID : 44638 - Type : PROTOCOL-RPC - Revision : 1 |
2017-11-21 | Linux kernel nfsd nfsd4_layout_verify out of bounds read attempt RuleID : 44637 - Type : PROTOCOL-RPC - Revision : 1 |
2017-10-10 | Linux kernel sctp_rcv_ootb invalid chunk length DoS attempt RuleID : 44309 - Type : OS-LINUX - Revision : 1 |
2017-10-10 | Linux kernel sctp_rcv_ootb invalid chunk length DoS attempt RuleID : 44308 - Type : OS-LINUX - Revision : 1 |
2017-08-24 | Linux kernel SCTP invalid chunk length denial of service attempt RuleID : 43692 - Type : OS-LINUX - Revision : 1 |
2017-07-18 | Linux kernel NFSv3 malformed WRITE arbitrary memory read attempt RuleID : 43189 - Type : PROTOCOL-RPC - Revision : 2 |
2017-07-18 | Linux kernel NFSv2 malformed WRITE arbitrary memory read attempt RuleID : 43188 - Type : PROTOCOL-RPC - Revision : 2 |
2017-01-18 | Linux net af_packet.c tpacket version race condition use after free attempt RuleID : 41028 - Type : OS-LINUX - Revision : 2 |
2017-01-18 | Linux net af_packet.c tpacket version race condition use after free attempt RuleID : 41027 - Type : OS-LINUX - Revision : 2 |
2016-11-30 | Linux kernel madvise race condition attempt RuleID : 40566 - Type : OS-LINUX - Revision : 2 |
2016-11-30 | Linux kernel madvise race condition attempt RuleID : 40565 - Type : OS-LINUX - Revision : 2 |
2016-11-30 | Linux kernel madvise race condition attempt RuleID : 40564 - Type : OS-LINUX - Revision : 2 |
2016-11-30 | Linux kernel madvise race condition attempt RuleID : 40563 - Type : OS-LINUX - Revision : 2 |
2016-11-30 | Linux kernel madvise race condition attempt RuleID : 40562 - Type : OS-LINUX - Revision : 2 |
2016-11-30 | Linux kernel madvise race condition attempt RuleID : 40561 - Type : OS-LINUX - Revision : 2 |
2016-11-30 | Linux kernel madvise race condition attempt RuleID : 40560 - Type : OS-LINUX - Revision : 2 |
2016-11-30 | Linux kernel madvise race condition attempt RuleID : 40543 - Type : OS-LINUX - Revision : 2 |
2016-11-30 | Linux kernel madvise race condition attempt RuleID : 40542 - Type : OS-LINUX - Revision : 2 |
Nessus® Vulnerability Scanner
id | Description |
---|---|
2019-01-17 | Name: The remote Fedora host is missing one or more security updates. File: fedora_2019-509c133845.nasl - Type: ACT_GATHER_INFO |
2019-01-17 | Name: The remote Fedora host is missing one or more security updates. File: fedora_2019-f812c9fb22.nasl - Type: ACT_GATHER_INFO |
2019-01-15 | Name: The remote Fedora host is missing one or more security updates. File: fedora_2019-337484d88b.nasl - Type: ACT_GATHER_INFO |
2019-01-15 | Name: The remote Fedora host is missing one or more security updates. File: fedora_2019-b0f7a7b74b.nasl - Type: ACT_GATHER_INFO |
2019-01-14 | Name: The remote Virtuozzo host is missing multiple security updates. File: Virtuozzo_VZA-2016-104.nasl - Type: ACT_GATHER_INFO |
2019-01-14 | Name: The remote Amazon Linux AMI host is missing a security update. File: ala_ALAS-2019-1145.nasl - Type: ACT_GATHER_INFO |
2019-01-11 | Name: The remote Virtuozzo host is missing a security update. File: Virtuozzo_VZA-2018-072.nasl - Type: ACT_GATHER_INFO |
2019-01-11 | Name: The remote Virtuozzo host is missing multiple security updates. File: Virtuozzo_VZA-2018-075.nasl - Type: ACT_GATHER_INFO |
2019-01-11 | Name: The remote Virtuozzo host is missing a security update. File: Virtuozzo_VZA-2018-077.nasl - Type: ACT_GATHER_INFO |
2019-01-11 | Name: The remote Virtuozzo host is missing a security update. File: Virtuozzo_VZA-2018-085.nasl - Type: ACT_GATHER_INFO |
2019-01-11 | Name: The remote Virtuozzo host is missing a security update. File: Virtuozzo_VZA-2018-086.nasl - Type: ACT_GATHER_INFO |
2019-01-11 | Name: The remote Virtuozzo host is missing a security update. File: Virtuozzo_VZA-2018-088.nasl - Type: ACT_GATHER_INFO |
2019-01-11 | Name: The remote Virtuozzo host is missing a security update. File: Virtuozzo_VZA-2018-089.nasl - Type: ACT_GATHER_INFO |
2019-01-10 | Name: The remote Amazon Linux 2 host is missing a security update. File: al2_ALAS-2019-1145.nasl - Type: ACT_GATHER_INFO |
2019-01-10 | Name: The remote device is affected by multiple vulnerabilities. File: juniper_space_jsa10917_183R1.nasl - Type: ACT_GATHER_INFO |
2019-01-10 | Name: The remote device is affected by multiple vulnerabilities. File: juniper_space_jsa10917_184R1.nasl - Type: ACT_GATHER_INFO |
2019-01-03 | Name: The remote Fedora host is missing one or more security updates. File: fedora_2018-0edb45d9db.nasl - Type: ACT_GATHER_INFO |
2019-01-03 | Name: The remote Fedora host is missing one or more security updates. File: fedora_2018-1621b2204a.nasl - Type: ACT_GATHER_INFO |
2019-01-03 | Name: The remote Fedora host is missing one or more security updates. File: fedora_2018-272cf2f9f4.nasl - Type: ACT_GATHER_INFO |
2019-01-03 | Name: The remote Fedora host is missing one or more security updates. File: fedora_2018-2c6bd93875.nasl - Type: ACT_GATHER_INFO |
2019-01-03 | Name: The remote Fedora host is missing one or more security updates. File: fedora_2018-3857a8b41a.nasl - Type: ACT_GATHER_INFO |
2019-01-03 | Name: The remote Fedora host is missing a security update. File: fedora_2018-50075276e8.nasl - Type: ACT_GATHER_INFO |
2019-01-03 | Name: The remote Fedora host is missing one or more security updates. File: fedora_2018-5453baa4af.nasl - Type: ACT_GATHER_INFO |
2019-01-03 | Name: The remote Fedora host is missing one or more security updates. File: fedora_2018-5904d0794d.nasl - Type: ACT_GATHER_INFO |
2019-01-03 | Name: The remote Fedora host is missing a security update. File: fedora_2018-5926c0ffc8.nasl - Type: ACT_GATHER_INFO |