A flaw was discovered in processing setsockopt for 32 bit processes on 64 bit systems. This flaw will allow attackers to alter arbitary kernel memory when unloading a kernel module. This action is usually restricted to root-priveledged users but can also be leveraged if the kernel is compiled with CONFIGUSERNS and CONFIGNETNS and the user is granted elevated priveledges.
This flaw was introduced in commit 52e804c6dfaa,
Upstream fixes
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ce683e5f9d04 http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6e94e0cfb088 http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=bdf533de6968
Discussion on oss-sec: http://www.openwall.com/lists/oss-security/2016/06/24/5
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 47.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Last updated 24 July 2024
A use after free vulnerability was found in pppunregisterchannel function. This is triggered when network namespace is removed while pppasync channel is still registered in it and pppunregisterchannel() tries to access its per-netns data in the defunct namespace.
An attacker who could control this memory that is being used in the defunct namespace could create a denial of service by spinlocking a CPU.
An unprivileged local user could use this flaw to induce kernel memory corruption on the system, leading to a crash. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is unlikely.
Upstream patch:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=1f461dcdd296eecedaffffc6bae2bfa90bd7eb89
CVE request:
http://seclists.org/oss-sec/2016/q2/319
A weakness was found in the Linux ASLR implementation. Any user able to running 32-bit applications in a x86 machine can disable the ASLR by setting the RLIMITSTACK resource to unlimited.
External references:
http://hmarco.org/bugs/CVE-2016-3672-Unlimiting-the-stack-not-longer-disables-ASLR.html http://seclists.org/bugtraq/2016/Apr/34
Upstream fix:
http://git.kernel.org/cgit/linux/kernel/git/tip/tip.git/commit/?id=8b8addf891de8a00e4d39fc32f93f7c5eb8feceb
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8b8addf891de8a00e4d39fc32f93f7c5eb8feceb
In the marksourcechains function (net/ipv4/netfilter/iptables.c) it is possible for a user-supplied iptentry structure to have a large nextoffset field. This field is not bounds checked prior to writing a counter value at the supplied offset.
Proposed fix:
patch v1 message: http://marc.info/?l=netfilter-devel&m=145757134822741&w=2 patch v2 thread: http://marc.info/?t=145757149500006&r=1&w=2
patch v2 message: http://marc.info/?l=netfilter-devel&m=145762719008418&w=2 patch v2 thread: (none yet) http://marc.info/?l=netfilter-devel&r=4&b=201603&w=2
CVE request and assignment:
http://seclists.org/oss-sec/2016/q1/581 http://seclists.org/oss-sec/2016/q1/619
Audit done by netfilter team found several related bugs, patches to better validate rulesets are currently queued in pablos nf-next tree upstream (use "parent" link to cycle to next one - there are 17 additional patches):
https://git.kernel.org/cgit/linux/kernel/git/pablo/nf-next.git/commit/?id=d7591f0c41ce3e67600a982bab6989ef0f07b3ce
Quickly plugging in and unplugging a USB hub can lead to a null pointer dereference in kernel (local denial of service) or the USB port to which the hub is connected becomes unusable, for kernel versions 2.6.32 < 4.4. The issue occurs when the USB hub gets disconnected before or while the routine for USB hub activation is running - hubactivate() function.
Upstream patch:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e50293ef9775c5
External references:
http://www.spinics.net/lists/linux-usb/msg132311.html
CVE-ID request and assignment:
http://seclists.org/oss-sec/2016/q1/404
http://seclists.org/oss-sec/2016/q1/413
Last updated 24 July 2024
Last updated 24 July 2024
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 38.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Buffer overflow in the XML parser in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allows remote attackers to execute arbitrary code by providing a large amount of compressed XML data, a related issue to CVE-2015-1283.
Kernel panic is encountered when sctp stack receives duplicate asconf chunks.
Upstream commmit:
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b69040d8e39f20d5215a03502a8e8b4c6ab78395