Last updated 29 November 2024
Buffer overflow in the mpoverridelegacyirq() function in arch/x86/kernel/acpi/boot.c in the Linux kernel through 3.2 allows local users to gain privileges via a crafted ACPI table.
A flaw was found on the linux kernel which enables a race condition in the L2TPv3 IP Encapsulation feature in the Linux kernel before 4.8.14 allows local users to gain privileges or cause a denial of service (use-after-free) by making multiple bind system calls without properly ascertaining whether a socket has the SOCKZAPPED status, related to net/l2tp/l2tpip.c and net/l2tp/l2tpip6.c.
Upstream patch:
https://github.com/torvalds/linux/commit/32c231164b76
Follow-up upstream patches:
https://github.com/torvalds/linux/commit/0382a25af3c7 https://github.com/torvalds/linux/commit/a3c18422a4b4 https://github.com/torvalds/linux/commit/d5e3a190937a https://github.com/torvalds/linux/commit/df90e6886146 https://github.com/torvalds/linux/commit/31e2f21fb35b
Merge commit of the above series:
https://github.com/torvalds/linux/commit/7752f72748db
Another follow-up upstream patch:
https://github.com/torvalds/linux/commit/94d7ee0baa8b
References:
https://source.android.com/security/bulletin/2017-03-01.html
An attacker within bluetooth transmission range can cause a stack buffer overflow in the Bluetooth system of the Linux kernel while processing pending L2CAP configuration responses from a client. An unauthenticated user able to connect to a system via Bluetooth could use this flaw to potentially execute arbitrary code with root privileges on the system.
External References:
https://www.armis.com/blueborne/ https://access.redhat.com/security/vulnerabilities/blueborne https://access.redhat.com/solutions/3177231 https://access.redhat.com/blogs/product-security/posts/blueborne
An upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e860d2c904d1a9f38a24eb44c9f34b8f915a6ea3
Last updated 29 November 2024
drivers/uwb/uwbd.c in the Linux kernel before 4.13.6 allows local users to cause a denial of service (general protection fault and system crash) or possibly have unspecified other impact via a crafted USB device.
Last updated 29 November 2024
Last updated 29 November 2024
drivers/usb/core/config.c in the Linux kernel before 4.13.6 allows local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device, related to the USBDTINTERFACEASSOCIATION descriptor.
Last updated 29 November 2024
Last updated 29 November 2024
Last updated 29 November 2024
Last updated 29 November 2024
Last updated 29 November 2024
Last updated 29 November 2024
Last updated 29 November 2024
Last updated 29 November 2024
Last updated 29 November 2024
It was found that the fix for CVE-2016-9576 was incomplete: the Linux kernel's sg implementation did not properly restrict write operations in situations where the KERNELDS option is set. A local attacker to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging write access to a /dev/sg device.
A vulnerability was found in the Linux kernel. Payloads of NM entries are not supposed to contain NUL. When such entry is processed, only the part prior to the first NUL goes into the concatenation (i.e. the directory entry name being encoded by a bunch of NM entries). The process stops when the amount collected so far + the claimed amount in the current NM entry exceed 254.
However, the value returned as the total length is the sum of claimed sizes, not the actual amount collected. And that can grow pretty large - not unlimited, since you'd need to put CE entries in between to be able to get more than the maximum that could be contained in one isofs directory entry / continuation chunk and the process stops once it had encountered 32 CEs, but you can get about 8Kb easily. And that's what will be passed to readdir callback as the name length. 8Kb copytouser() from a buffer allocated by getfreepage()
References, CVE-ID request and response:
http://seclists.org/oss-sec/2016/q2/363
http://seclists.org/oss-sec/2016/q2/365
Upstream fix:
https://git.kernel.org/linus/99d825822eade8d827a1817357cbf3f889a552d6
A vulnerabilty was found in the Linux kernels hiddev driver. An attacker with permissions to the USB HID device can call an ioctl with the HIDIOCGUSAGES or HIDIOCSUSAGES command, and passes a report id of HIDREPORTIDUNKNOWN range checks that would prevent oversize buffers being copied from userspace to kernel space were bypassed.
The kernel would loop on a a value passed by userspace and can copy memory outside of the intended range. This can corrupt memory located after the struct in memory, duplicating the kernel memory or crashing the system
Upstream patch:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=93a2001bdfd5376c3dc2158653034c20392d15c5
Last updated 24 July 2024
A flaw was discovered in the Linux kernels implementation of VFIO. While issuing an IOCTL, the VFIODEVICESETIRQS parameter for vfio PCI devices has a state machine confusion bug where specifying VFIOIRQSETDATANONE along with another bit in VFIOIRQSETDATATYPEMASK in hdr.flags allows integer overflow checks to be skipped for hdr.start/hdr.count.
This might allow memory corruption later in vfiopcisetmsitrigger() with user access to an appropriate vfio device file, but it seems difficult to usefully exploit in practice.
Proposed patch:
https://patchwork.kernel.org/patch/9373631/
CVE assignment:
http://seclists.org/oss-sec/2016/q4/251
A flaw was found in the TIPC networking subsystem which could allow for memory corruption and possible priveledge escalation. The flaw involves a system with an unusually low MTU (60) on networking devices configured as bearers for the TIPC protocol. Not all devices support or allow MTU's below 68 octets.
An attacker can create a packet which will overwrite memory outside of allocated space and this can allow for priveledge escalation.
The affected code is not enabled on Red Hat Enterprise Linux 6 and 7. The affected code was not included in Red Hat Enterprise Linux 5.
Initial patch: https://www.mail-archive.com/netdev@vger.kernel.org/msg133205.html
drivers/media/v4l2-core/videobuf2-v4l2.c in the Linux kernel before 4.5.3 allows local users to cause a denial of service (kernel memory write operation) or possibly have unspecified other impact via a crafted number of planes in a VIDIOCDQBUF ioctl call.
Last updated 24 July 2024
A flaw was found in the Linux kernels implementation of BPF in which systems with more than 32GB of physical memory and unlimited RLIMITMEMLOCK settings an application can overflow a 32 bit refcount.
Additionally in the same environment, malicious applications can overflow a map refcount on larger memory (1Tb). When the overflow wraps to zero a reference can be held while being free'd. This can lead to a use after free
CVE assignment:
http://seclists.org/oss-sec/2016/q2/266
Upstream fix:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=92117d8443bc5afacc8d5ba82e541946310f106e
An integer overflow vulnerability was found in xtalloctableinfo, which on 32-bit systems can lead to small structure allocation and a copyfromuser based heap corruption.
Proposed fix:
patch v1 message: http://marc.info/?l=netfilter-devel&m=145757136822750&w=2 patch v1 thread: http://marc.info/?t=145757149700001&r=1&w=2
patch v2 message: http://marc.info/?l=netfilter-devel&m=145800533813758&w=2 (in netfilter-devel) patch v2 message: http://marc.info/?l=linux-netdev&m=145800538413781&w=2 (in linux-netdev)
CVE request and assignment:
http://seclists.org/oss-sec/2016/q1/581 http://seclists.org/oss-sec/2016/q1/619
A use after free vulnerability was found in kernel which allows privilege escalation for users with a local account on the system. When a program was loaded with a bpf program an attacker could exploit this to gain root privileges by an unprivileged user.
When bpf(BPFPROGLOAD, ...) was invoked with a BPF program whose bytecode references a non-map file descriptor as a map file descriptor, the error handling code called fdput() twice instead of once (in bpfmapget() and in replacemapfdwithmapptr()). If the file descriptor table of the current task is shared, this causes fcount to be decremented too much, allowing the struct file to be freed while it is still in use (use-after-free).
Bug was introduced in 0246e64d9a5f and is exploitable since 1be7f75d1668 without the need for CAPSYSADMIN capability.
Upstream patch:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8358b02bf67d3a5d8a825070e1aa73f25fb2e4c7
Original report:
https://bugs.chromium.org/p/project-zero/issues/detail?id=808
CVE request:
http://seclists.org/oss-sec/2016/q2/263
A use after free vulnerability was found in pppunregisterchannel function. This is triggered when network namespace is removed while pppasync channel is still registered in it and pppunregisterchannel() tries to access its per-netns data in the defunct namespace.
An attacker who could control this memory that is being used in the defunct namespace could create a denial of service by spinlocking a CPU.
An unprivileged local user could use this flaw to induce kernel memory corruption on the system, leading to a crash. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is unlikely.
Upstream patch:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=1f461dcdd296eecedaffffc6bae2bfa90bd7eb89
CVE request:
http://seclists.org/oss-sec/2016/q2/319