It was found that reporting emulation failures to user space could lead to either a local (CVE-2014-7842) or a L2->L1 (CVE-2010-5313) denial of service. In the case of a local denial of service, an attacker must have access to the MMIO area or be able to access an I/O port. Please note that on certain systems, HPET is mapped to userspace as part of vdso (vvar) and thus an unprivileged user may generate MMIO transactions (and enter the emulator) this way.
An SCTP server doing ASCONF will panic on malformed INIT ping-of-death in the form of:
------------ INIT[PARAM: SETPRIMARYIP] ------------>
A remote attacker could use this flaw to crash the system by sending a maliciously prepared SCTP packet in order to trigger a NULL pointer dereference on the server.
Upstream patch:
https://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=e40607cbe270a9e8360907cb1e62ddf0736e4864
Acknowledgements:
This issue was discovered by Liu Wei of Red Hat.
It was found that Linux kernel's sctp stack is prone to remotely triggerable memory pressure issue caused by excessive queueing.
A remote attacker could use this flaw to cause denial-of-service conditions on the system.
Upstream commmit:
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=26b87c7881006311828bb0ab271a551a62dcceb4
Last updated 24 July 2024
Common Vulnerabilities and Exposures assigned an identifier CVE-2014-9090 to the following vulnerability:
Name: CVE-2014-9090 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9090 Assigned: 20141126 Reference: http://www.openwall.com/lists/oss-security/2014/11/26/5 Reference: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=6f442be2fb22be02cafa606f1769fa1e6f894441 Reference: https://github.com/torvalds/linux/commit/6f442be2fb22be02cafa606f1769fa1e6f894441
The dodoublefault function in arch/x86/kernel/traps.c in the Linux kernel through 3.17.4 does not properly handle faults associated with the Stack Segment (SS) segment register when espfix64 is involved, which allows local users to cause a denial of service (panic) via a modifyldt system call, as demonstrated by sigreturn32 in the linux-clock-tests test suite.
A certain Debian patch to the IPv6 implementation in the Linux kernel ...
Last updated 24 July 2024
Last updated 24 July 2024
journalunmapbuffer()'s zapbuffer: code clears a lot of buffer head state ala discardbuffer(), but does not touch Delay or Unwritten as discardbuffer() does.
This can be problematic in some areas of the ext4 code which assume that if they have found a buffer marked unwritten or delay, then it's a live one. They do not check whether a buffer is mapped, so jbd2's partial teardown can be problematic if they assume that this buffer head is still valid.
(Mounting without a journal also avoids the bug, because with no journal we go to unmapbuffer(), which does the right thing).
An unprivileged local user could use this flaw to crash the system.
Last updated 24 July 2024
Last updated 24 July 2024
Last updated 24 July 2024
A NULL pointer dereference flaw has been found in the way a new node's hot-added memory is propagated to other nodes zonelists. An unprivileged local user can use this flaw to crash the system.
Upstream fix: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=08dff7b7d629807dbb1f398c68dd9cd58dd657a1
arch/x86/include/asm/pgtable.h in the Linux kernel before 3.6.2, when transparent huge pages are used, does not properly support PROTNONE memory regions, which allows local users to cause a denial of service (system crash) via a crafted application.
Last updated 24 July 2024
Last updated 24 July 2024
Access to /dev/cpu//msr was protected only using filesystem checks. A local uid 0 (root) user with all capabilities dropped could use this flaw to execute arbitrary code in kernel mode.
Upstream commit: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux.git;a=commitdiff;h=c903f0456bc69176912dee6dd25c6a66ee1aed00
References: http://grsecurity.net/~spender/msr32.c
A flaw was found in the way skbrecvdatagram() processed skbs with no payload when MSGPEEK was requested. An unprivileged local user could use this flaw to cause local denial of service.
Upstream commit: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=77c1090
References: http://seclists.org/oss-sec/2013/q1/310
If a single descriptor crosses a region, the second chunk length should be decremented by size translated so far, instead it includes the full descriptor length. A privileged guest user could use this flaw to crash the host or, potentially, corrupt host memory.
Upstream fix: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=bd97120fc3d1a11f3124c7c9ba1d91f51829eb85
Last updated 24 July 2024
A flaw was found in the way xeniret() used userspace alterable %ds. An unprivileged local guest user in the 32-bit PV Xen domain could use this flaw to crash the guest or, potentially, escalate their privileges.
Acknowledgements:
This issue was discovered by Andrew Jones of Red Hat.
Description of the problem: A buffer overrun flaw was found in kernels from 3.0 to 3.4 when calling logprefix() function from callconsoledrivers(). In logprefix(), the access to "p[1]", "p[2]" or "simplestrtoul(&p[1], &endp, 10)" may cause a buffer overflow as this function is called from callconsoledrivers by passing "&LOGBUF(curindex)" where the index must be masked to do not exceed the buffer's boundary.
A local user able to write to /dev/kmsg could use this flaw to crash the system.
Note: /dev/kmsg is root writable only (at least on RHEL/Fedora), but it still might cause issues in restricted root environments.
References: https://bugs.gentoo.org/458780 https://secunia.com/advisories/52366/
Last updated 24 July 2024
A flaw was found in the way ansi cprng implementation in the Linux kernel processed non-block size aligned requests. If several small requests are made that are less than the instances block size, the remainder for loop code doesn't increment randdatavalid in the last iteration, meaning that the last bytes in the randdata buffer gets reused on the subsequent smaller-than-a-block request for random data.
Acknowledgements:
Red Hat would like to thank Stephan Mueller for reporting this issue.
Buffer overflow in the ozcdevwrite function in drivers/staging/ozwpa ...
Last updated 24 July 2024
Last updated 24 July 2024
A flaw was found in the way Linux kernel's device-mapper subsystem, under certain conditions, interpreted data written to snapshot block devices. Snapshots are constructed from a single "cow" (copy-on-write) device that contains a mixture of data and metadata, and the bug involves a user writing a data block that is later incorrectly interpreted as metadata controlling how blocks are mapped.
An attacker could construct a mapping to read data from disk blocks in 'free space' that is normally inaccessible.
Please note that apart from having security consequences (data leak), this bug is also a data corruptor.
Acknowledgements:
Red Hat would like to thank Fujitsu for reporting this issue.
Last updated 24 July 2024
Last updated 24 July 2024