Last updated 29 November 2024

An attacker within bluetooth transmission range can cause a stack buffer overflow in the Bluetooth system of the Linux kernel while processing pending L2CAP configuration responses from a client. An unauthenticated user able to connect to a system via Bluetooth could use this flaw to potentially execute arbitrary code with root privileges on the system.

External References:

https://www.armis.com/blueborne/ https://access.redhat.com/security/vulnerabilities/blueborne https://access.redhat.com/solutions/3177231 https://access.redhat.com/blogs/product-security/posts/blueborne

An upstream patch:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e860d2c904d1a9f38a24eb44c9f34b8f915a6ea3

Last updated 29 November 2024

Last updated 29 November 2024

Last updated 29 November 2024

Last updated 29 November 2024

Last updated 29 November 2024

It was found that the fix for CVE-2016-9576 was incomplete: the Linux kernel's sg implementation did not properly restrict write operations in situations where the KERNELDS option is set. A local attacker to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging write access to a /dev/sg device.

A vulnerability was found in the Linux kernel. Payloads of NM entries are not supposed to contain NUL. When such entry is processed, only the part prior to the first NUL goes into the concatenation (i.e. the directory entry name being encoded by a bunch of NM entries). The process stops when the amount collected so far + the claimed amount in the current NM entry exceed 254.

However, the value returned as the total length is the sum of claimed sizes, not the actual amount collected. And that can grow pretty large - not unlimited, since you'd need to put CE entries in between to be able to get more than the maximum that could be contained in one isofs directory entry / continuation chunk and the process stops once it had encountered 32 CEs, but you can get about 8Kb easily. And that's what will be passed to readdir callback as the name length. 8Kb copytouser() from a buffer allocated by getfreepage()

References, CVE-ID request and response:

http://seclists.org/oss-sec/2016/q2/363

http://seclists.org/oss-sec/2016/q2/365

Upstream fix:

https://git.kernel.org/linus/99d825822eade8d827a1817357cbf3f889a552d6

A vulnerabilty was found in the Linux kernels hiddev driver. An attacker with permissions to the USB HID device can call an ioctl with the HIDIOCGUSAGES or HIDIOCSUSAGES command, and passes a report id of HIDREPORTIDUNKNOWN range checks that would prevent oversize buffers being copied from userspace to kernel space were bypassed.

The kernel would loop on a a value passed by userspace and can copy memory outside of the intended range. This can corrupt memory located after the struct in memory, duplicating the kernel memory or crashing the system

Upstream patch:

https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=93a2001bdfd5376c3dc2158653034c20392d15c5

Last updated 24 July 2024

A flaw was found in the TIPC networking subsystem which could allow for memory corruption and possible priveledge escalation. The flaw involves a system with an unusually low MTU (60) on networking devices configured as bearers for the TIPC protocol. Not all devices support or allow MTU's below 68 octets.

An attacker can create a packet which will overwrite memory outside of allocated space and this can allow for priveledge escalation.

The affected code is not enabled on Red Hat Enterprise Linux 6 and 7. The affected code was not included in Red Hat Enterprise Linux 5.

Initial patch: https://www.mail-archive.com/netdev@vger.kernel.org/msg133205.html

A flaw was found in the Linux kernels implementation of BPF in which systems with more than 32GB of physical memory and unlimited RLIMITMEMLOCK settings an application can overflow a 32 bit refcount.

Additionally in the same environment, malicious applications can overflow a map refcount on larger memory (1Tb). When the overflow wraps to zero a reference can be held while being free'd. This can lead to a use after free

CVE assignment:

http://seclists.org/oss-sec/2016/q2/266

Upstream fix:

https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=92117d8443bc5afacc8d5ba82e541946310f106e

An integer overflow vulnerability was found in xtalloctableinfo, which on 32-bit systems can lead to small structure allocation and a copyfromuser based heap corruption.

Proposed fix:

patch v1 message: http://marc.info/?l=netfilter-devel&m=145757136822750&w=2 patch v1 thread: http://marc.info/?t=145757149700001&r=1&w=2

patch v2 message: http://marc.info/?l=netfilter-devel&m=145800533813758&w=2 (in netfilter-devel) patch v2 message: http://marc.info/?l=linux-netdev&m=145800538413781&w=2 (in linux-netdev)

CVE request and assignment:

http://seclists.org/oss-sec/2016/q1/581 http://seclists.org/oss-sec/2016/q1/619

A use after free vulnerability was found in kernel which allows privilege escalation for users with a local account on the system. When a program was loaded with a bpf program an attacker could exploit this to gain root privileges by an unprivileged user.

When bpf(BPFPROGLOAD, ...) was invoked with a BPF program whose bytecode references a non-map file descriptor as a map file descriptor, the error handling code called fdput() twice instead of once (in bpfmapget() and in replacemapfdwithmapptr()). If the file descriptor table of the current task is shared, this causes fcount to be decremented too much, allowing the struct file to be freed while it is still in use (use-after-free).

Bug was introduced in 0246e64d9a5f and is exploitable since 1be7f75d1668 without the need for CAPSYSADMIN capability.

Upstream patch:

https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8358b02bf67d3a5d8a825070e1aa73f25fb2e4c7

Original report:

https://bugs.chromium.org/p/project-zero/issues/detail?id=808

CVE request:

http://seclists.org/oss-sec/2016/q2/263

A use after free vulnerability was found in pppunregisterchannel function. This is triggered when network namespace is removed while pppasync channel is still registered in it and pppunregisterchannel() tries to access its per-netns data in the defunct namespace.

An attacker who could control this memory that is being used in the defunct namespace could create a denial of service by spinlocking a CPU.

An unprivileged local user could use this flaw to induce kernel memory corruption on the system, leading to a crash. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is unlikely.

Upstream patch:

https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=1f461dcdd296eecedaffffc6bae2bfa90bd7eb89

CVE request:

http://seclists.org/oss-sec/2016/q2/319

A flaw was discovered in processing setsockopt for 32 bit processes on 64 bit systems. This flaw will allow attackers to alter arbitary kernel memory when unloading a kernel module. This action is usually restricted to root-priveledged users but can also be leveraged if the kernel is compiled with CONFIGUSERNS and CONFIGNETNS and the user is granted elevated priveledges.

This flaw was introduced in commit 52e804c6dfaa,

Upstream fixes

http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ce683e5f9d04 http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6e94e0cfb088 http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=bdf533de6968

Discussion on oss-sec: http://www.openwall.com/lists/oss-security/2016/06/24/5

Last updated 24 July 2024

DISPUTED A memory leak in the unittestdataadd() function in drivers/of/unittest.c in the Linux kernel before 5.3.10 allows attackers to cause a denial of service (memory consumption) by triggering offdtunflattentree() failures, aka CID-e13de8fe0d6a. NOTE: third parties dispute the relevance of this because unittest.c can only be reached during boot.

Last updated 25 April 2025

An out-of-bounds (OOB) memory access flaw was found in x25bind in net/x25/afx25.c in the Linux kernel version v5.12-rc5. A bounds check failure allows a local attacker with a user account on the system to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system's integrity and availability.

As .x25addr[] array comes from the user and is not necessarily NUL terminated. Using strnlen() instead of strlen() will prevent a read overflow problem.

An excessive resource consumption flaw was found in the way the Linux kernel's networking subsystem processed TCP Selective Acknowledgment (SACK) segments. While processing SACK segments, the Linux kernel's socket buffer (SKB) data structure becomes fragmented, which leads to increased resource utilization to traverse and process these fragments as further SACK segments are received on the same TCP connection. A remote attacker could use this flaw to cause a denial of service (DoS) by sending a crafted sequence of SACK segments on a TCP connection.

A double free vulnerability was found in netlinkdump, which could cause a denial of service or possibly other unspecified impact.

References:

http://seclists.org/oss-sec/2016/q4/577

http://lists.openwall.net/netdev/2016/05/15/69

Upstream patch:

https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=92964c79b357efd980812c4de5c1fd2ec8bb5520

A flaw was found in the Linux kernel's implementation of setsockopt for the SO{SND|RCV}BUFFORCE setsockopt() system call. Users with non-namespace CAPNETADMIN are able to trigger this call and create a situation in which the sockets sendbuff data size could be negative. This could adversely affect memory allocations and create situations where the system could crash or cause memory corruption.

A race condition vulnerability was found in packetsetring that can lead to use after free on a function pointer. This vulnerability can be used to gain kernel code execution for the local attacker capable of creating AFPACKET sockets. This issue was introduced with following commit:

https://github.com/torvalds/linux/commit/f6fb8f100b807378fda19e83e5ac6828b638603a

It was found that the blkrqmapuseriov() function in the Linux kernel's block device implementation did not properly restrict the type of iterator, which could allow a local attacker to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging write access to a /dev/sg device.

Remotely triggerable unbounded recursion in GRE code was found. If a packet has the layout: IPv4 header | GRE header | IPv4 header | GRE header | ... depending on left over stack, it could run the kernel out of stack due to recursion and so crash the kernel.

Reproducer:

https://bugzilla.suse.com/showbug.cgi?id=1001486#c5 https://bugzilla.suse.com/attachment.cgi?id=695327

Discussion threads:

https://marc.info/?t=145920955700002&r=1&w=2 https://marc.info/?t=145928865300005&r=1&w=2

Upstream patch:

https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=fac8e0f579695a3ecbc4d3cac369139d7f819971

CVE request+assignment:

http://seclists.org/oss-sec/2016/q4/121 http://seclists.org/oss-sec/2016/q4/125

Linux kernel built with the 802.1Q/802.1ad VLAN(CONFIGVLAN8021Q) OR Virtual eXtensible Local Area Network(CONFIGVXLAN) with Transparent Ethernet Bridging(TEB) GRO support, is vulnerable to a stack overflow issue. It could occur while receiving large packets via GRO path; As an unlimited recursion could unfold in both VLAN and TEB modules, leading to a stack corruption in the kernel.

A remote user could use this falw to cause kernel panic by sending maliciously crafted packets to a server that has GRO enabled.

Additional requirement for attacking VLAN is to have 8021q module loaded. Additional requirement for attacking TEB is to have increased MTU.

Upstream patch --------------- -> https://patchwork.ozlabs.org/patch/680412/

A vulnerability leading to a local privilege escalation was found in apparmor in the Linux kernel. When procpidattrwrite() was changed to use memdupuser apparmor's (interface violating) assumption that the setprocattr buffer was always a single page was violated.

Upstream pull request:

http://marc.info/?l=linux-kernel&m=146793642811929&w=2

Upstream fix:

http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=30a46a4647fd1df9cf52e43bf467f0d9265096ca

References:

http://seclists.org/oss-sec/2016/q3/30

arch/x86/kvm/vmx.c in the Linux kernel through 4.6.3 mishandles the APICv on/off state, which allows guest OS users to obtain direct APIC MSR access on the host OS, and consequently cause a denial of service (host OS crash) or possibly execute arbitrary code on the host OS, via x2APIC mode.