CVSS: 7.0EPSS: 0%CPEs: 68EXPL: 1CVE-2021-3609 – kernel: race condition in net/can/bcm.c leads to local privilege escalation
https://notcve.org/view.php?id=CVE-2021-3609
.A flaw was found in the CAN BCM networking protocol in the Linux kernel, where a local attacker can abuse a flaw in the CAN subsystem to corrupt memory, crash the system or escalate privileges. ... Se ha encontrado un fallo en el protocolo de red CAN BCM en el kernel de Linux, donde un atacante local puede abusar de un fallo en el subsistema CAN para corromper la memoria, bloquear el sistema o escalar privilegios. Esta condición de carrera en el archivo net/can/bcm.c en el kernel de Linux permite una escalada de privilegios local a root A flaw was found in the CAN BCM networking protocol in the Linux kernel, where a local attacker can abuse a flaw in the CAN subsystem to corrupt memory, crash the system or escalate privileges. • https://bugzilla.redhat.com/show_bug.cgi?id=1971651 https://github.com/nrb547/kernel-exploitation/blob/main/cve-2021-3609/cve-2021-3609.md https://github.com/torvalds/linux/commit/d5f9023fa61ee8b94f37a93f08e94b136cf1e463 https://security.netapp.com/advisory/ntap-20220419-0004 https://www.openwall.com/lists/oss-security/2021/06/19/1 https://access.redhat.com/security/cve/CVE-2021-3609 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2018-8043
https://notcve.org/view.php?id=CVE-2018-8043
The unimac_mdio_probe function in drivers/net/phy/mdio-bcm-unimac.c in the Linux kernel through 4.15.8 does not validate certain resource availability, which allows local users to cause a denial of service (NULL pointer dereference). La función unimac_mdio_probe en drivers/net/phy/mdio-bcm-unimac.c en el kernel de Linux hasta la versión 4.15.8 no valida la disponibilidad de ciertos recursos. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=297a6961ffb8ff4dc66c9fbf53b924bd1dda05d5 http://www.securitytracker.com/id/1040749 https://github.com/torvalds/linux/commit/297a6961ffb8ff4dc66c9fbf53b924bd1dda05d5 https://usn.ubuntu.com/3619-1 https://usn.ubuntu.com/3619-2 https://usn.ubuntu.com/3630-1 https://usn.ubuntu.com/3630-2 https://usn.ubuntu.com/3632-1 • CWE-476: NULL Pointer Dereference •
CVSS: 4.9EPSS: 0%CPEs: 288EXPL: 0CVE-2013-4515
https://notcve.org/view.php?id=CVE-2013-4515
The bcm_char_ioctl function in drivers/staging/bcm/Bcmchar.c in the Linux kernel before 3.12 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory via an IOCTL_BCM_GET_DEVICE_DRIVER_INFO ioctl call. La función bcm_char_ioctl en drivers/staging/bcm/Bcmchar.c del kernel de Linux anterior a la versión 3.12 no inicializa una estructura de datos determinada, lo que permite a usuarios locales obtener información sensible de la memoria del kernel a través de una llamada IOCTL_BCM_GET_DEVICE_DRIVER_INFO ioctl. • http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=8d1e72250c847fa96498ec029891de4dc638a5ba http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00002.html http://lists.opensuse.org/opensuse-updates/2014-02/msg00045.html http://www.openwall.com/lists/oss-security/2013/11/04/22 http://www.ubuntu.com/usn/USN-2066-1 http://www.ubuntu.com/usn/USN-2067-1 http://www.ubuntu.com/usn/USN-2068-1 http://www.ubuntu.com/usn/USN-2069-1 h • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.9EPSS: 0%CPEs: 7EXPL: 0CVE-2011-1598 – kernel: missing check in can/bcm and can/raw socket releases
https://notcve.org/view.php?id=CVE-2011-1598
The bcm_release function in net/can/bcm.c in the Linux kernel before 2.6.39-rc6 does not properly validate a socket data structure, which allows local users to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via a crafted release operation. La función bcm_release en net/can/bcm.c del kernel de linux en versiones anteriores a v2.6.39-rc6 no valida correctamente una estructura de toma de datos, lo cual permite a usuarios locales causar una denegación de servicio ( desreferenciar un puntero NULL ) o posiblemente tener un impacto no especificado a través de una operación de liberación manipulada. • http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=c6914a6f261aca0c9f715f883a353ae7ff51fe83 http://openwall.com/lists/oss-security/2011/04/20/2 http://openwall.com/lists/oss-security/2011/04/20/6 http://openwall.com/lists/oss-security/2011/04/20/7 http://openwall.com/lists/oss-security/2011/04/21/1 http://openwall.com/lists/oss-security/2011/04/21/2 http://openwall.com/lists/oss-security/2011/04/21/7 http://openwall.com/l • CWE-476: NULL Pointer Dereference •
CVSS: 4.9EPSS: 0%CPEs: 7EXPL: 0CVE-2011-1748 – kernel: missing check in can/bcm and can/raw socket releases
https://notcve.org/view.php?id=CVE-2011-1748
The raw_release function in net/can/raw.c in the Linux kernel before 2.6.39-rc6 does not properly validate a socket data structure, which allows local users to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via a crafted release operation. La función raw_release en net/can/raw.c en el Kernel de Linux anterior a v2.6.39-rc6 no valida adecuadamente una estructura de datos socket, lo que permite a usuarios locales provocar una denegación de servicio (desreferencia a puntero NULL) o posiblemente tener otro impacto no especificado a través de una liberación de operación. • http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=10022a6c66e199d8f61d9044543f38785713cbbd http://openwall.com/lists/oss-security/2011/04/20/7 http://openwall.com/lists/oss-security/2011/04/21/1 http://openwall.com/lists/oss-security/2011/04/21/2 http://openwall.com/lists/oss-security/2011/04/21/7 http://openwall.com/lists/oss-security/2011/04/22/2 http://openwall.com/lists/oss-security/2011/04/25/4 http://permalink.gmane. • CWE-476: NULL Pointer Dereference •