CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2019-15789 – Microk8s Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2019-15789
Privilege escalation vulnerability in MicroK8s allows a low privilege user with local access to obtain root access to the host by provisioning a privileged container. Fixed in MicroK8s 1.15.3. Una vulnerabilidad de escalada de privilegios en MicroK8s, permite a un usuario con pocos privilegios con acceso local conseguir acceso de tipo root al host por medio del aprovisionamiento de un contenedor privilegiado. Corregido en MicroK8s versión 1.15.3. • https://discuss.kubernetes.io/t/explicit-use-of-sudo-in-microk8s-cli/7605 https://github.com/ubuntu/microk8s/pull/590 https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-15789.html https://pulsesecurity.co.nz/advisories/microk8s-privilege-escalation • CWE-269: Improper Privilege Management •
CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 1CVE-2020-8834 – Linux kernel KVM Power8 conflicting use of HSTATE_HOST_R1
https://notcve.org/view.php?id=CVE-2020-8834
KVM in the Linux kernel on Power8 processors has a conflicting use of HSTATE_HOST_R1 to store r1 state in kvmppc_hv_entry plus in kvmppc_{save,restore}_tm, leading to a stack corruption. Because of this, an attacker with the ability run code in kernel space of a guest VM can cause the host kernel to panic. There were two commits that, according to the reporter, introduced the vulnerability: f024ee098476 ("KVM: PPC: Book3S HV: Pull out TM state save/restore into separate procedures") 87a11bb6a7f7 ("KVM: PPC: Book3S HV: Work around XER[SO] bug in fake suspend mode") The former landed in 4.8, the latter in 4.17. This was fixed without realizing the impact in 4.18 with the following three commits, though it's believed the first is the only strictly necessary commit: 6f597c6b63b6 ("KVM: PPC: Book3S PR: Add guest MSR parameter for kvmppc_save_tm()/kvmppc_restore_tm()") 7b0e827c6970 ("KVM: PPC: Book3S HV: Factor fake-suspend handling out of kvmppc_save/restore_tm") 009c872a8bc4 ("KVM: PPC: Book3S PR: Move kvmppc_save_tm/kvmppc_restore_tm to separate file") KVM en el kernel de Linux en los procesadores Power8, presenta un uso conflictivo de HSTATE_HOST_R1 para almacenar el estado r1 en plus kvmppc_hv_entry en kvmppc_ {save, restore} _tm, conllevando a una corrupción de la pila. Debido a esto, un atacante con la capacidad de ejecutar código en el espacio del kernel de una Máquina Virtual invitada puede causar que el kernel del host entre en pánico. • http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00035.html https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1867717 https://usn.ubuntu.com/4318-1 https://usn.ubuntu.com/usn/usn-4318-1 https://www.openwall.com/lists/oss-security/2020/04/06/2 https://access.redhat.com/security/cve/CVE-2020-8834 https://bugzilla.redhat.com/show_bug.cgi?id=1819615 • CWE-121: Stack-based Buffer Overflow CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-368: Context Switching Race Condition •
CVSS: 4.9EPSS: 0%CPEs: 3EXPL: 0CVE-2020-11609
https://notcve.org/view.php?id=CVE-2020-11609
An issue was discovered in the stv06xx subsystem in the Linux kernel before 5.6.1. drivers/media/usb/gspca/stv06xx/stv06xx.c and drivers/media/usb/gspca/stv06xx/stv06xx_pb0100.c mishandle invalid descriptors, as demonstrated by a NULL pointer dereference, aka CID-485b06aadb93. Se detectó un problema en el subsistema stv06xx en el kernel de Linux versiones anteriores a 5.6.1. Los archivos drivers/media/usb/gspca/stv06xx/stv06xx.c y drivers/media/usb/gspca/stv06xx/stv06xx_pb0100.c manejan inapropiadamente los descriptores no válidos, como es demostrado por una desreferencia del puntero NULL, también se conoce como CID-485b06aadb93. • http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00022.html https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.6.1 https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=485b06aadb933190f4bc44e006076bc27a23f205 https://github.com/torvalds/linux/commit/485b06aadb933190f4bc44e006076bc27a23f205 https://lists.debian.org/debian-lts-announce/2020/06/msg00011.html https://lists.debian.org/debian-lts-announce/2020/06/msg00012.html https://lists.debian.org/debian-lts-a • CWE-476: NULL Pointer Dereference •
CVSS: 4.9EPSS: 0%CPEs: 3EXPL: 0CVE-2020-11608 – kernel: NULL pointer dereferences in ov511_mode_init_regs and ov518_mode_init_regs in drivers/media/usb/gspca/ov519.c
https://notcve.org/view.php?id=CVE-2020-11608
An issue was discovered in the Linux kernel before 5.6.1. drivers/media/usb/gspca/ov519.c allows NULL pointer dereferences in ov511_mode_init_regs and ov518_mode_init_regs when there are zero endpoints, aka CID-998912346c0d. Se detectó un problema en el kernel de Linux versiones anteriores a 5.6.1. El archivo drivers/media/usb/gspca/ov519.c, permite desreferencias del puntero NULL en las funciones ov511_mode_init_regs y ov518_mode_init_regs cuando hay cero endpoints, también se conoce como CID-998912346c0d. A flaw was found in the way the ov519 driver in the Linux kernel handled certain types of USB descriptors. This flaw allows an attacker with the ability to induce the error conditions to crash the system. • http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00022.html https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.6.1 https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=998912346c0da53a6dbb71fab3a138586b596b30 https://github.com/torvalds/linux/commit/998912346c0da53a6dbb71fab3a138586b596b30 https://lists.debian.org/debian-lts-announce/2020/06/msg00011.html https://lists.debian.org/debian-lts-announce/2020/06/msg00012.html https://lists.debian.org/debian-lts-a • CWE-476: NULL Pointer Dereference •
CVSS: 6.0EPSS: 0%CPEs: 5EXPL: 0CVE-2020-11565 – kernel: out-of-bounds write in mpol_parse_str function in mm/mempolicy.c
https://notcve.org/view.php?id=CVE-2020-11565
An issue was discovered in the Linux kernel through 5.6.2. mpol_parse_str in mm/mempolicy.c has a stack-based out-of-bounds write because an empty nodelist is mishandled during mount option parsing, aka CID-aa9f7d5172fa. NOTE: Someone in the security community disagrees that this is a vulnerability because the issue “is a bug in parsing mount options which can only be specified by a privileged user, so triggering the bug does not grant any powers not already held.” ** EN DISPUTA ** Se detectó un problema en el kernel de Linux versiones hasta 5.6.2. La función mpol_parse_str en el archivo mm/mempolicy.c presenta una escritura fuera de límites en la región stack de la memoria porque una lista de nodos vacía es manejada inapropiadamente durante el análisis de la opción de montaje, también se conoce como CID-aa9f7d5172fa. NOTA: Alguien en la comunidad de seguridad no está de acuerdo en que se trata de una vulnerabilidad porque el problema "es un error en el análisis de las opciones de montaje que sólo puede ser especificado por un usuario privilegiado, por lo que la activación del error no otorga ningún poder que no se tenga ya". An out-of-bounds write flaw was found in the Linux kernel. • https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=aa9f7d5172fac9bf1f09e678c35e287a40a7b7dd https://github.com/torvalds/linux/commit/aa9f7d5172fac9bf1f09e678c35e287a40a7b7dd https://lists.debian.org/debian-lts-announce/2020/06/msg00011.html https://lists.debian.org/debian-lts-announce/2020/06/msg00012.html https://lists.debian.org/debian-lts-announce/2020/06/msg00013.html https://usn.ubuntu.com/4363-1 https://usn.ubuntu.com/4364-1 https://usn.ubuntu.com/4367-1 https:&# • CWE-787: Out-of-bounds Write •