An out-of-bounds(OOB) memory access vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfxkms.c in GPU component in the Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing a denial of service(DoS).
Last updated 24 July 2024
It was found that reporting emulation failures to user space could lead to either a local (CVE-2014-7842) or a L2->L1 (CVE-2010-5313) denial of service. In the case of a local denial of service, an attacker must have access to the MMIO area or be able to access an I/O port. Please note that on certain systems, HPET is mapped to userspace as part of vdso (vvar) and thus an unprivileged user may generate MMIO transactions (and enter the emulator) this way.
An SCTP server doing ASCONF will panic on malformed INIT ping-of-death in the form of:
------------ INIT[PARAM: SETPRIMARYIP] ------------>
A remote attacker could use this flaw to crash the system by sending a maliciously prepared SCTP packet in order to trigger a NULL pointer dereference on the server.
Upstream patch:
https://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=e40607cbe270a9e8360907cb1e62ddf0736e4864
Acknowledgements:
This issue was discovered by Liu Wei of Red Hat.
It was found that Linux kernel's sctp stack is prone to remotely triggerable memory pressure issue caused by excessive queueing.
A remote attacker could use this flaw to cause denial-of-service conditions on the system.
Upstream commmit:
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=26b87c7881006311828bb0ab271a551a62dcceb4
Last updated 24 July 2024
Common Vulnerabilities and Exposures assigned an identifier CVE-2014-9090 to the following vulnerability:
Name: CVE-2014-9090 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9090 Assigned: 20141126 Reference: http://www.openwall.com/lists/oss-security/2014/11/26/5 Reference: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=6f442be2fb22be02cafa606f1769fa1e6f894441 Reference: https://github.com/torvalds/linux/commit/6f442be2fb22be02cafa606f1769fa1e6f894441
The dodoublefault function in arch/x86/kernel/traps.c in the Linux kernel through 3.17.4 does not properly handle faults associated with the Stack Segment (SS) segment register when espfix64 is involved, which allows local users to cause a denial of service (panic) via a modifyldt system call, as demonstrated by sigreturn32 in the linux-clock-tests test suite.
arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel before 3.12 does not have an exit handler for the INVEPT instruction, which allows guest OS users to cause a denial of service (guest OS crash) via a crafted application.
A certain Debian patch to the IPv6 implementation in the Linux kernel ...
arch/x86/kernel/tls.c in the Thread Local Storage (TLS) implementation in the Linux kernel through 3.18.1 allows local users to bypass the espfix protection mechanism, and consequently makes it easier for local users to bypass the ASLR protection mechanism, via a crafted application that makes a setthreadarea system call and later reads a 16-bit value.
Last updated 24 July 2024
A flaw was found in the Linux kernels implementation of sctp protocol in which a remote attacker can trigger an out of bounds read with an offset of up to 64kB. This may panic the machine with a page-fault and the out-of-bounds data does not seem to be returned to the remote attacker.
For this attack to be sucessful, the kernel needs to have both the SCTP protocol module loaded and a process listening as an SCTP server.
Upstream patch:
https://github.com/torvalds/linux/commit/bf911e985d6bbaa328c20c3e05f4eb03de11fdd6
CVE assignment:
http://seclists.org/oss-sec/2016/q4/509
Last updated 24 July 2024
Last updated 24 July 2024
journalunmapbuffer()'s zapbuffer: code clears a lot of buffer head state ala discardbuffer(), but does not touch Delay or Unwritten as discardbuffer() does.
This can be problematic in some areas of the ext4 code which assume that if they have found a buffer marked unwritten or delay, then it's a live one. They do not check whether a buffer is mapped, so jbd2's partial teardown can be problematic if they assume that this buffer head is still valid.
(Mounting without a journal also avoids the bug, because with no journal we go to unmapbuffer(), which does the right thing).
An unprivileged local user could use this flaw to crash the system.
Commit 503358ae01b70ce6909d19dd01287093f6b6271c ("ext4: avoid divide by zero when trying to mount a corrupted file system") fixes CVE-2009-4307 by performing a sanity check on sloggroupsperflex, since it can be set to a bogus value by an attacker.
More info from Wang Xi: The first commit (503358ae) fixes the division by zero. The fix is not perfect because: 1) Theoretically, a standard-conforming C compiler could generate code that is still vulnerable to division by zero, but I was not aware of any compilers doing that. 2) Logically, we should have groupsperflex = 2^sloggroupsperflex, and the fix doesn't really ensure that. This is obviously not good, but not sure how bad the consequence would be.
Introduced by: http://git.kernel.org/linus/503358ae01b70ce6909d19dd01287093f6b6271c
Upstream commit: http://git.kernel.org/linus/d50f2ab6f050311dbf7b8f5501b25f0bf64a439b
Last updated 24 July 2024
Last updated 24 July 2024
Last updated 24 July 2024
Last updated 24 July 2024
Last updated 24 July 2024
Last updated 24 July 2024
Last updated 24 July 2024
Last updated 24 July 2024
Last updated 24 July 2024
Last updated 24 July 2024
A NULL pointer dereference flaw has been found in the way a new node's hot-added memory is propagated to other nodes zonelists. An unprivileged local user can use this flaw to crash the system.
Upstream fix: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=08dff7b7d629807dbb1f398c68dd9cd58dd657a1
Last updated 24 July 2024
Last updated 24 July 2024
Last updated 24 July 2024