An unprivileged write to the file handler flaw in the Linux kernel's control groups and namespaces subsystem was found in the way users have access to some less privileged process that are controlled by cgroups and have higher privileged parent process. It is actually both for cgroup2 and cgroup1 versions of control groups. A local user could use this flaw to crash the system or escalate their privileges on the system.
Last updated 29 November 2024
Buffer overflow in the mpoverridelegacyirq() function in arch/x86/kernel/acpi/boot.c in the Linux kernel through 3.2 allows local users to gain privileges via a crafted ACPI table.
An attacker within bluetooth transmission range can cause a stack buffer overflow in the Bluetooth system of the Linux kernel while processing pending L2CAP configuration responses from a client. An unauthenticated user able to connect to a system via Bluetooth could use this flaw to potentially execute arbitrary code with root privileges on the system.
External References:
https://www.armis.com/blueborne/ https://access.redhat.com/security/vulnerabilities/blueborne https://access.redhat.com/solutions/3177231 https://access.redhat.com/blogs/product-security/posts/blueborne
An upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e860d2c904d1a9f38a24eb44c9f34b8f915a6ea3
Last updated 29 November 2024
drivers/uwb/uwbd.c in the Linux kernel before 4.13.6 allows local users to cause a denial of service (general protection fault and system crash) or possibly have unspecified other impact via a crafted USB device.
Last updated 29 November 2024
Last updated 29 November 2024
drivers/usb/core/config.c in the Linux kernel before 4.13.6 allows local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device, related to the USBDTINTERFACEASSOCIATION descriptor.
Last updated 29 November 2024
Last updated 29 November 2024
Last updated 29 November 2024
Last updated 29 November 2024
Last updated 29 November 2024
Last updated 29 November 2024
Last updated 29 November 2024
An issue was discovered in the Linux kernel before 6.0.11. Missing validation of the number of channels in drivers/net/wireless/microchip/wilc1000/cfg80211.c in the WILC1000 wireless driver can trigger a heap-based buffer overflow when copying the list of operating channels from Wi-Fi management frames.
An issue was discovered in the Linux kernel before 6.0.11. Missing validation of IEEE80211P2PATTROPERCHANNEL in drivers/net/wireless/microchip/wilc1000/cfg80211.c in the WILC1000 wireless driver can trigger an out-of-bounds write when parsing the channel list attribute from Wi-Fi management frames.
It was found that the fix for CVE-2016-9576 was incomplete: the Linux kernel's sg implementation did not properly restrict write operations in situations where the KERNELDS option is set. A local attacker to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging write access to a /dev/sg device.
A NULL pointer dereference flaw was found in the way the Linux kernel's network subsystem handled socket creation with an invalid protocol identifier. A local user could use this flaw to crash the system.
A vulnerability was found in the Linux kernel. Payloads of NM entries are not supposed to contain NUL. When such entry is processed, only the part prior to the first NUL goes into the concatenation (i.e. the directory entry name being encoded by a bunch of NM entries). The process stops when the amount collected so far + the claimed amount in the current NM entry exceed 254.
However, the value returned as the total length is the sum of claimed sizes, not the actual amount collected. And that can grow pretty large - not unlimited, since you'd need to put CE entries in between to be able to get more than the maximum that could be contained in one isofs directory entry / continuation chunk and the process stops once it had encountered 32 CEs, but you can get about 8Kb easily. And that's what will be passed to readdir callback as the name length. 8Kb copytouser() from a buffer allocated by getfreepage()
References, CVE-ID request and response:
http://seclists.org/oss-sec/2016/q2/363
http://seclists.org/oss-sec/2016/q2/365
Upstream fix:
https://git.kernel.org/linus/99d825822eade8d827a1817357cbf3f889a552d6
A vulnerabilty was found in the Linux kernels hiddev driver. An attacker with permissions to the USB HID device can call an ioctl with the HIDIOCGUSAGES or HIDIOCSUSAGES command, and passes a report id of HIDREPORTIDUNKNOWN range checks that would prevent oversize buffers being copied from userspace to kernel space were bypassed.
The kernel would loop on a a value passed by userspace and can copy memory outside of the intended range. This can corrupt memory located after the struct in memory, duplicating the kernel memory or crashing the system
Upstream patch:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=93a2001bdfd5376c3dc2158653034c20392d15c5
A vulnerability in the handling of Transactional Memory on powerpc systems was found. An unprivileged local user can crash the kernel by starting a transaction, suspending it, and then calling any of the exec() class system calls.
Patch:
https://patchwork.ozlabs.org/patch/636776/
Test case:
https://patchwork.ozlabs.org/patch/636774/
CVE request:
http://seclists.org/oss-sec/2016/q2/595
It was found that the Linux kernel's IPv6 implementation mishandles socket option data. A local attacker can abuse concurrent access to the socket options to escalate their privileges, or cause a denial of service (use-after-free and system crash) via a crafted sendmsg system call.
Upstream patch:
https://github.com/torvalds/linux/commit/45f6fad84cc305103b28d73482b344d7f5b76f39
Last updated 24 July 2024
A flaw was discovered in the Linux kernels implementation of VFIO. While issuing an IOCTL, the VFIODEVICESETIRQS parameter for vfio PCI devices has a state machine confusion bug where specifying VFIOIRQSETDATANONE along with another bit in VFIOIRQSETDATATYPEMASK in hdr.flags allows integer overflow checks to be skipped for hdr.start/hdr.count.
This might allow memory corruption later in vfiopcisetmsitrigger() with user access to an appropriate vfio device file, but it seems difficult to usefully exploit in practice.
Proposed patch:
https://patchwork.kernel.org/patch/9373631/
CVE assignment:
http://seclists.org/oss-sec/2016/q4/251
A flaw was found in the TIPC networking subsystem which could allow for memory corruption and possible priveledge escalation. The flaw involves a system with an unusually low MTU (60) on networking devices configured as bearers for the TIPC protocol. Not all devices support or allow MTU's below 68 octets.
An attacker can create a packet which will overwrite memory outside of allocated space and this can allow for priveledge escalation.
The affected code is not enabled on Red Hat Enterprise Linux 6 and 7. The affected code was not included in Red Hat Enterprise Linux 5.
Initial patch: https://www.mail-archive.com/netdev@vger.kernel.org/msg133205.html
An integer overflow vulnerability was found in xtalloctableinfo, which on 32-bit systems can lead to small structure allocation and a copyfromuser based heap corruption.
Proposed fix:
patch v1 message: http://marc.info/?l=netfilter-devel&m=145757136822750&w=2 patch v1 thread: http://marc.info/?t=145757149700001&r=1&w=2
patch v2 message: http://marc.info/?l=netfilter-devel&m=145800533813758&w=2 (in netfilter-devel) patch v2 message: http://marc.info/?l=linux-netdev&m=145800538413781&w=2 (in linux-netdev)
CVE request and assignment:
http://seclists.org/oss-sec/2016/q1/581 http://seclists.org/oss-sec/2016/q1/619
A use after free vulnerability was found in pppunregisterchannel function. This is triggered when network namespace is removed while pppasync channel is still registered in it and pppunregisterchannel() tries to access its per-netns data in the defunct namespace.
An attacker who could control this memory that is being used in the defunct namespace could create a denial of service by spinlocking a CPU.
An unprivileged local user could use this flaw to induce kernel memory corruption on the system, leading to a crash. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is unlikely.
Upstream patch:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=1f461dcdd296eecedaffffc6bae2bfa90bd7eb89
CVE request:
http://seclists.org/oss-sec/2016/q2/319
A flaw was discovered in processing setsockopt for 32 bit processes on 64 bit systems. This flaw will allow attackers to alter arbitary kernel memory when unloading a kernel module. This action is usually restricted to root-priveledged users but can also be leveraged if the kernel is compiled with CONFIGUSERNS and CONFIGNETNS and the user is granted elevated priveledges.
This flaw was introduced in commit 52e804c6dfaa,
Upstream fixes
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ce683e5f9d04 http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6e94e0cfb088 http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=bdf533de6968
Discussion on oss-sec: http://www.openwall.com/lists/oss-security/2016/06/24/5