CVSS: 7.8EPSS: 0%CPEs: 19EXPL: 0CVE-2022-1652
https://notcve.org/view.php?id=CVE-2022-1652
Linux Kernel could allow a local attacker to execute arbitrary code on the system, caused by a concurrency use-after-free flaw in the bad_flp_intr function. By executing a specially-crafted program, an attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service condition on the system. El Kernel de Linux podría permitir a un atacante local ejecutar código arbitrario en el sistema, causado por un fallo de uso de memoria previamente liberada concurrente en la función bad_flp_intr. Al ejecutar un programa especialmente diseñado, un atacante podría explotar esta vulnerabilidad para ejecutar código arbitrario o causar una condición de denegación de servicio en el sistema • https://bugzilla.redhat.com/show_bug.cgi?id=1832397 https://francozappa.github.io/about-bias https://kb.cert.org/vuls/id/647177 https://security.netapp.com/advisory/ntap-20220722-0002 https://www.debian.org/security/2022/dsa-5173 • CWE-416: Use After Free •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2022-1419
https://notcve.org/view.php?id=CVE-2022-1419
The root cause of this vulnerability is that the ioctl$DRM_IOCTL_MODE_DESTROY_DUMB can decrease refcount of *drm_vgem_gem_object *(created in *vgem_gem_dumb_create*) concurrently, and *vgem_gem_dumb_create *will access the freed drm_vgem_gem_object. La causa principal de esta vulnerabilidad es que el ioctl$DRM_IOCTL_MODE_DESTROY_DUMB puede disminuir el refcount de *drm_vgem_gem_object *(creado en *vgem_gem_dumb_create*) simultáneamente, y *vgem_gem_dumb_create *accederá al drm_vgem_gem_object liberado • https://bugzilla.redhat.com/show_bug.cgi?id=2077560 https://www.debian.org/security/2022/dsa-5173 • CWE-416: Use After Free •
CVSS: 6.3EPSS: 0%CPEs: 4EXPL: 1CVE-2022-1462 – kernel: possible race condition in drivers/tty/tty_buffers.c
https://notcve.org/view.php?id=CVE-2022-1462
An out-of-bounds read flaw was found in the Linux kernel’s TeleTYpe subsystem. The issue occurs in how a user triggers a race condition using ioctls TIOCSPTLCK and TIOCGPTPEER and TIOCSTI and TCXONC with leakage of memory in the flush_to_ldisc function. This flaw allows a local user to crash the system or read unauthorized random data from memory. Se ha encontrado un fallo de lectura fuera de límites en el subsistema TeleTYpe del kernel de Linux. El problema es producido en la forma en que un usuario desencadena una condición de carrera usando los ioctls TIOCSPTLCK y TIOCGPTPEER y TIOCSTI y TCXONC con fuga de memoria en la función flush_to_ldisc. • https://bugzilla.redhat.com/show_bug.cgi?id=2078466 https://lists.debian.org/debian-lts-announce/2022/10/msg00000.html https://seclists.org/oss-sec/2022/q2/155 https://access.redhat.com/security/cve/CVE-2022-1462 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-366: Race Condition within a Thread •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 1CVE-2022-1942 – Heap-based Buffer Overflow in vim/vim
https://notcve.org/view.php?id=CVE-2022-1942
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. Un Desbordamiento de Búfer en la Región Heap de la Memoria en el repositorio de GitHub vim/vim versiones anteriores a 8.2 • http://seclists.org/fulldisclosure/2022/Oct/28 http://seclists.org/fulldisclosure/2022/Oct/41 https://github.com/vim/vim/commit/71223e2db87c2bf3b09aecb46266b56cda26191d https://huntr.dev/bounties/67ca4d3b-9175-43c1-925c-72a7091bc071 https://lists.debian.org/debian-lts-announce/2022/11/msg00032.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TYNK6SDCMOLQJOI3B4AOE66P2G2IH4ZM https://security.gentoo.org/glsa/202208-32 https://security.gentoo.org/glsa/202305-16 https • CWE-122: Heap-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 9.8EPSS: 4%CPEs: 2EXPL: 1CVE-2022-31003 – Heap-based Buffer Overflow and Out-of-bounds Write in Sofia-SIP
https://notcve.org/view.php?id=CVE-2022-31003
Sofia-SIP is an open-source Session Initiation Protocol (SIP) User-Agent library. Prior to version 1.13.8, when parsing each line of a sdp message, `rest = record + 2` will access the memory behind `\0` and cause an out-of-bounds write. An attacker can send a message with evil sdp to FreeSWITCH, causing a crash or more serious consequence, such as remote code execution. Version 1.13.8 contains a patch for this issue. Sofia-SIP es una biblioteca de agente de usuario del Protocolo de Iniciación de Sesión (SIP) de código abierto. • https://github.com/freeswitch/sofia-sip/commit/907f2ac0ee504c93ebfefd676b4632a3575908c9 https://github.com/freeswitch/sofia-sip/security/advisories/GHSA-8w5j-6g2j-pxcp https://lists.debian.org/debian-lts-announce/2022/09/msg00001.html https://security.gentoo.org/glsa/202210-18 https://www.debian.org/security/2023/dsa-5410 • CWE-122: Heap-based Buffer Overflow CWE-787: Out-of-bounds Write •