arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel before 3.12 does not have an exit handler for the INVEPT instruction, which allows guest OS users to cause a denial of service (guest OS crash) via a crafted application.
arch/x86/kernel/tls.c in the Thread Local Storage (TLS) implementation in the Linux kernel through 3.18.1 allows local users to bypass the espfix protection mechanism, and consequently makes it easier for local users to bypass the ASLR protection mechanism, via a crafted application that makes a setthreadarea system call and later reads a 16-bit value.
Last updated 24 July 2024
Last updated 24 July 2024
Last updated 24 July 2024
Last updated 24 July 2024
Last updated 24 July 2024
Last updated 24 July 2024
Last updated 24 July 2024
Last updated 24 July 2024
Last updated 24 July 2024
Last updated 24 July 2024
Last updated 24 July 2024
A memory disclosure flaw has been found in the way binfmtscript loadscript() function handled excessive recursions. An unprivileged local user could use this flaw to leak kernel memory.
References: - http://www.halfdog.net/Security/2012/LinuxKernelBinfmtScriptStackDataDisclosure/ - https://lkml.org/lkml/2012/8/18/75
Proposed upstream fix: - https://lkml.org/lkml/2012/9/23/29
Last updated 24 July 2024
Last updated 24 July 2024
A security flaw was found in the way "/dev/ptmx", a character device used to create a pseudo-terminal master (PTM) and slave (PTS) pair, of the Linux kernel, used to transmit data through the PTM when a keystroke was pressed. An unprivileged, local user could use this flaw to determine inter-keystroke timing (measure latency between keystrokes), possibly allowing them to determine effective length of an password being typed in.
References: [1] http://vladz.devzero.fr/013ptmx-timing.php [2] http://users.ece.cmu.edu/~dawnsong/papers/ssh-timing.pdf [3] http://www.openwall.com/lists/oss-security/2013/01/07/5 [4] https://bugzilla.novell.com/showbug.cgi?id=797175
Reproducers: [5] http://vladz.devzero.fr/svn/codes/PoC/ptmx-keystroke-latency.c (to display latency between keystrokes) [6] http://vladz.devzero.fr/svn/codes/PoC/ptmx-su-pwdlen.sh (to determine password length)
This issue was found by researcher with nickname vladz.
Last updated 24 July 2024
Last updated 24 July 2024
Last updated 24 July 2024
Last updated 24 July 2024
Last updated 24 July 2024
Due to the way the Linux kernel handles the creation of IPv6 temporary addresses a malicious LAN user can remotely disable them altogether which may lead to privacy violations and information disclosure.
Reference: -> http://seclists.org/oss-sec/2012/q4/292 -> http://seclists.org/oss-sec/2013/q1/92
A flaw was found in the way netctlpermissions() function in the Linux kernel checked permissions.
As a result, an unprivileged local user could potentially use this flaw to access files in /proc/sys/net in a way that he would otherwise be unable to.
Introduced by:
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=cff109768b2d9c03095848f4cd4b0754117262aa
Fixed by:
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=2433c8f094a008895e66f25bd1773cdb01c91d01
Acknowledgements:
This issue was discovered by Miroslav Vadkerti of Red Hat.
Last updated 24 July 2024
Last updated 24 July 2024
If a system admin provides a disk (which supports the discard aka TRIM or SCSI UNMAP) to a guest as read-only - there are no checks done.
A privileged guest user could use this flaw to destroy data on the disk to which he otherwise wouldn't have write access to.
References:
http://seclists.org/oss-sec/2013/q2/488
Last updated 24 July 2024
The l2tpip6getname function in net/l2tp/l2tpip6.c in the Linux kernel before 3.6 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel stack memory via a crafted application.