Last updated 24 July 2024
A flaw was found in the Linux kernel's implementation of setsockopt for the SO{SND|RCV}BUF setsockopt() system call. Users with non-namespace CAPNETADMIN are able to trigger this call and create a situation in which the sockets sendbuff data size could be negative.
An integer overflow was found in sndcomprallocatebuffer(), that could result into allocating smaller buffer than expected.
Upstream patch:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b35cc8225845112a616e3a2266d2fde5ab13d3ab
The patch was incomplete and introduced another issues known as CVE-2014-9904.
CVE assignment:
http://seclists.org/oss-sec/2016/q2/616
Florian Weimer of the Red Hat Product Security Team discovere that the mnlnlmsgportidok() function in libmnl 1.0.3 and earlier did not correctly validate the origin of a Netlink message, allowing local attackers to spoof Netlink messages, with context-dependent consequences.
Kernel panic is encountered when sctp stack receives duplicate asconf chunks.
Upstream commmit:
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b69040d8e39f20d5215a03502a8e8b4c6ab78395
An out-of-bounds memory access flaw, CVE-2014-7825, was found in the syscall tracing functionality of the Linux kernel's perf subsystem. A local, unprivileged user could use this flaw to crash the system. Additionally, an out-of-bounds memory access flaw, CVE-2014-7826, was found in the syscall tracing functionality of the Linux kernel's ftrace subsystem. On a system with ftrace syscall tracing enabled, a local, unprivileged user could use this flaw to crash the system, or escalate their privileges.
A buffer overflow is present in the method that the kernel uses to handle libceph auth tokens.
A flaw was found in the TIPC networking subsystem which could allow for memory corruption and possible priveledge escalation. The flaw involves a system with an unusually low MTU (60) on networking devices configured as bearers for the TIPC protocol. Not all devices support or allow MTU's below 68 octets.
An attacker can create a packet which will overwrite memory outside of allocated space and this can allow for priveledge escalation.
The affected code is not enabled on Red Hat Enterprise Linux 6 and 7. The affected code was not included in Red Hat Enterprise Linux 5.
Initial patch: https://www.mail-archive.com/netdev@vger.kernel.org/msg133205.html
The Linux Kernel running on AMD64 systems will sometimes map the contents of PIE executable, the heap or ld.so to where the stack is mapped allowing attackers to more easily manipulate the stack. Linux Kernel version 4.11.5 is affected.
Linux kernels which support unprivileged user namespaces (CLONENEWUSER) and at the same time allow sharing file system information (CLONEFS) between parent process and its newly clone(2)d child process in the new user namespace, are vulnerable to a privilege escalation flaw as presented by Sebastian Krahmer in his chroot exploit [1].
[1] http://stealth.openwall.net/xSports/clown-newuser.c
An unprivileged local user could use this flaw to gain root privileges on a system.
Upstream fix: ------------- -> https://git.kernel.org/linus/e66eded8309ebf679d3d3c1f5820d1f2ca332c71
Reference: ---------- -> http://www.openwall.com/lists/oss-security/2013/03/13/8
Datalen paremeter of sockallocsendpskb() function is not validated before setting frags of allocated skb, which can lead to heap overflow.
On Red Hat Enterprise Linux 5 a user having access to TUN/TAP virtual device could use this flaw to crash the system or to potentially escalate their privileges. The resulting CVSS score is 6.2.
On Red Hat Enterprise Linux 6 a privileged guest user could use this flaw to crash the host or to potentially escalate their privileges on the host. The resulting CVSS score is 7.4.
Last updated 24 July 2024
Integer overflow in drivers/gpu/drm/i915/i915gemexecbuffer.c in the i915 driver in the Direct Rendering Manager (DRM) subsystem in the Linux kernel through 3.8.3, as used in Google Chrome OS before 25.0.1364.173 and other products, allows local users to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted application that triggers many relocation copies, and potentially leads to a race condition.
Last updated 24 July 2024
arch/s390/kernel/ptrace.c in the Linux kernel before 3.15.8 on the s390 platform does not properly restrict address-space control operations in PTRACEPOKEUSRAREA requests, which allows local users to obtain read and write access to kernel memory locations, and consequently gain privileges, via a crafted application that makes a ptrace system call.
A flaw was found in the kernels handling of ceph authentication tickets.
The auth reply could be returned to a client unvalidated.
A data race that can trick the kernel into using initialized memory was found. This vulnerability can at least give access to arbitrary SysV shared memory. It is almost certain that this vulnerability can be used to gain arbitrary code execution in the kernel.
While working on KTSAN, Dmitry Vyukov got a report that says that ipcaddid() installs a not-completely initialized object into the shared object table. In particular, uid/gid are not initialized. ipcobtainobjectcheck() in turn obtains the object and verifies uid/gid for permission purposes. Since the fields are not initialized, the check can falsely succeed.
Race report:
ThreadSanitizer: data-race in ipcobtainobjectcheck
Read at 0xffff88047f810f68 of size 8 by thread 2749 on CPU 5: [<ffffffff8147d84d>] ipcobtainobjectcheck+0x7d/0xd0 ipc/util.c:621 [< inline >] msqobtainobjectcheck ipc/msg.c:90 [<ffffffff8147e708>] msgctlnolock.constprop.9+0x208/0x430 ipc/msg.c:480 [< inline >] SYSCmsgctl ipc/msg.c:538 [<ffffffff8147f061>] SySmsgctl+0xa1/0xb0 ipc/msg.c:522 [<ffffffff81ee3e11>] entrySYSCALL64fastpath+0x31/0x95 arch/x86/entry/entry64.S:188
Previous write at 0xffff88047f810f68 of size 8 by thread 2755 on CPU 4: [<ffffffff8147cf97>] ipcaddid+0x217/0x260 ipc/util.c:257 [<ffffffff8147eb4c>] newque+0xac/0x240 ipc/msg.c:141 [< inline >] ipcgetpublic ipc/util.c:355 [<ffffffff8147daa2>] ipcget+0x202/0x280 ipc/util.c:646 [< inline >] SYSCmsgget ipc/msg.c:255 [<ffffffff8147efaa>] SySmsgget+0x7a/0x90 ipc/msg.c:241 [<ffffffff81ee3e11>] entrySYSCALL64fastpath+0x31/0x95 arch/x86/entry/entry64.S:188
Mutexes locked by thread 2755: Mutex 445417 is locked here: [<ffffffff81ee0d45>] downwrite+0x65/0x80 kernel/locking/rwsem.c:62 [< inline >] ipcgetpublic ipc/util.c:348 [<ffffffff8147d90c>] ipcget+0x6c/0x280 ipc/util.c:646 [< inline >] SYSCmsgget ipc/msg.c:255 [<ffffffff8147efaa>] SySmsgget+0x7a/0x90 ipc/msg.c:241 [<ffffffff81ee3e11>] entrySYSCALL64fastpath+0x31/0x95 arch/x86/entry/entry64.S:188
Mutex 453634 is locked here: [< inline >] rawspinlock include/linux/spinlockapismp.h:158 [<ffffffff81ee37d0>] rawspinlock+0x50/0x70 kernel/locking/spinlock.c:151 [< inline >] spinlock include/linux/spinlock.h:312 [<ffffffff8147ce0e>] ipcaddid+0x8e/0x260 ipc/util.c:238 [<ffffffff8147eb4c>] newque+0xac/0x240 ipc/msg.c:141 [< inline >] ipcgetpublic ipc/util.c:355 [<ffffffff8147daa2>] ipcget+0x202/0x280 ipc/util.c:646 [< inline >] SYSCmsgget ipc/msg.c:255 [<ffffffff8147efaa>] SySmsgget+0x7a/0x90 ipc/msg.c:241 [<ffffffff81ee3e11>] entrySYSCALL64fastpath+0x31/0x95 arch/x86/entry/entry64.S:188
ipcaddid installs new ipc object with idralloc, from this point on it is accessible to other threads. At this point the object contains unitialized garbage. Then it fills in uid, etc:
new->cuid = new->uid = euid; new->gid = new->cgid = egid; new->seq = ids->seq++;
While this happens another thread can get access to the object and do uid check on the unitialized garbage, which can give falsely give accesses to the shared object to a process that should not have access to the object.
Upstream patch:
https://github.com/torvalds/linux/commit/b9a532277938
CVE assignment:
http://seclists.org/oss-sec/2015/q4/7
Buffer overflow in virt/kvm/irqcomm.c in the KVM subsystem in the Linux kernel before 3.2.24 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to Message Signaled Interrupts (MSI), irq routing entries, and an incorrect check by the setuproutingentry function before invoking the kvmsetirq function.
Last updated 24 July 2024
Buffer overflow in the picolcdrawevent function in devices/hid/hid-picolcdcore.c in the PicoLCD HID device driver in the Linux kernel through 3.16.3, as used in Android on Nexus 7 devices, allows physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a crafted device that sends a large report.
It was found that the Linux kernel's Infiniband subsystem did not properly sanitize input parameters while registering memory regions from the userspace via the (u)verbs API. As a result, an unrestricted physical memory access could be achieved.
A local user with access to /dev/infiniband/uverbsX could use this flaw to crash the system or, potentially, escalate their privileges on the system.
Last updated 24 July 2024
If a single descriptor crosses a region, the second chunk length should be decremented by size translated so far, instead it includes the full descriptor length. A privileged guest user could use this flaw to crash the host or, potentially, corrupt host memory.
Upstream fix: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=bd97120fc3d1a11f3124c7c9ba1d91f51829eb85
Buffer overflow in the nfs4getacluncached function in fs/nfs/nfs4proc.c in the Linux kernel before 3.7.2 allows local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact via a getxattr system call for the system.nfs4acl extended attribute of a pathname on an NFSv4 filesystem.
Access to /dev/cpu//msr was protected only using filesystem checks. A local uid 0 (root) user with all capabilities dropped could use this flaw to execute arbitrary code in kernel mode.
Upstream commit: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux.git;a=commitdiff;h=c903f0456bc69176912dee6dd25c6a66ee1aed00
References: http://grsecurity.net/~spender/msr32.c
Last updated 24 July 2024
A flaw was found in the way xeniret() used userspace alterable %ds. An unprivileged local guest user in the 32-bit PV Xen domain could use this flaw to crash the guest or, potentially, escalate their privileges.
Acknowledgements:
This issue was discovered by Andrew Jones of Red Hat.
Last updated 24 July 2024
In some cases it may happen that pmdnoneorclearbad() is called with the mmapsem hold in read mode. In those cases the huge page faults can allocate hugepmds under pmdnoneorclearbad() and that can trigger a false positive from pmdbad() that will not like to see a pmd materializing as trans huge.
A privileged user in the KVM guest can use this flaw to crash the host. An unprivileged local user could use this flaw to crash the system.
Proposed upstream patch: http://comments.gmane.org/gmane.linux.kernel.mm/75413
Last updated 24 July 2024