CVSS: 7.8EPSS: 0%CPEs: 15EXPL: 0CVE-2022-1998 – kernel: fanotify misuses fd_install() which could lead to use-after-free
https://notcve.org/view.php?id=CVE-2022-1998
A use after free in the Linux kernel File System notify functionality was found in the way user triggers copy_info_records_to_user() call to fail in copy_event_to_user(). A local user could use this flaw to crash the system or potentially escalate their privileges on the system. Se ha encontrado un uso de memoria previamente liberada en la funcionalidad de notificación del sistema de archivos del kernel de Linux en la forma en que el usuario activa la llamada copy_info_records_to_user() para fallar en copy_event_to_user(). Un usuario local podría usar este fallo para bloquear el sistema o potencialmente escalar sus privilegios en el sistema A use-after-free flaw was found in the Linux kernel’s File System notify functionality in the way a user triggers the copy_info_records_to_user() function call to fail in copy_event_to_user(). This flaw allows a local user to crash or potentially escalate their privileges on the system. • https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/fs/notify/fanotify/fanotify_user.c?h=v5.17&id=ee12595147ac1fbfb5bcb23837e26dd58d94b15d https://seclists.org/oss-sec/2022/q1/99 https://security.netapp.com/advisory/ntap-20220707-0009 https://access.redhat.com/security/cve/CVE-2022-1998 https://bugzilla.redhat.com/show_bug.cgi?id=2052312 • CWE-416: Use After Free •
CVSS: 7.1EPSS: 0%CPEs: 13EXPL: 0CVE-2022-1671
https://notcve.org/view.php?id=CVE-2022-1671
A NULL pointer dereference flaw was found in rxrpc_preparse_s in net/rxrpc/server_key.c in the Linux kernel. This flaw allows a local attacker to crash the system or leak internal kernel information. Se ha encontrado un fallo de desreferencia de puntero NULL en la función rxrpc_preparse_s en el archivo net/rxrpc/server_key.c en el kernel de Linux. Este fallo permite a un atacante local bloquear el sistema o filtrar información interna del kernel. • https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ff8376ade4f668130385839cef586a0990f8ef87 https://security.netapp.com/advisory/ntap-20220901-0004 https://security.netapp.com/advisory/ntap-20220901-0008 • CWE-476: NULL Pointer Dereference •
CVSS: 8.8EPSS: 0%CPEs: 22EXPL: 6CVE-2022-32250 – Linux Kernel nf_tables_expr_destroy Use-After-Free Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2022-32250
net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to a use-after-free. El archivo net/netfilter/nf_tables_api.c en el kernel de Linux versiones hasta 5.18.1, permite a un usuario local (capaz de crear espacios de nombres de usuario/red) escalar privilegios a root porque una comprobación incorrecta de NFT_STATEFUL_EXPR conlleva a un uso de memoria previamente liberada A use-after-free vulnerability was found in the Linux kernel's Netfilter subsystem in net/netfilter/nf_tables_api.c. This flaw allows a local attacker with user access to cause a privilege escalation issue. This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the nf_tables_expr_destroy method. • https://github.com/theori-io/CVE-2022-32250-exploit https://github.com/ysanatomic/CVE-2022-32250-LPE https://github.com/Kristal-g/CVE-2022-32250 http://www.openwall.com/lists/oss-security/2022/06/03/1 http://www.openwall.com/lists/oss-security/2022/06/04/1 http://www.openwall.com/lists/oss-security/2022/06/20/1 http://www.openwall.com/lists/oss-security/2022/07/03/5 http://www.openwall.com/lists/oss-security/2022/07/03/6 http://www.openwall&# • CWE-416: Use After Free •
CVSS: 8.1EPSS: 0%CPEs: 23EXPL: 1CVE-2022-27778
https://notcve.org/view.php?id=CVE-2022-27778
A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is used together with `--remove-on-error`. Una vulnerabilidad en el uso de nombres resueltos incorrectamente, corregida en versión 7.83.1, podía eliminar el archivo equivocado cuando es usado "--no-clobber" junto con "--remove-on-error" • https://hackerone.com/reports/1553598 https://security.netapp.com/advisory/ntap-20220609-0009 https://security.netapp.com/advisory/ntap-20220729-0004 https://www.oracle.com/security-alerts/cpujul2022.html • CWE-706: Use of Incorrectly-Resolved Name or Reference •
CVSS: 5.3EPSS: 0%CPEs: 18EXPL: 1CVE-2022-27779
https://notcve.org/view.php?id=CVE-2022-27779
libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a trailing dot.curl can be told to receive and send cookies. curl's "cookie engine" can bebuilt with or without [Public Suffix List](https://publicsuffix.org/)awareness. If PSL support not provided, a more rudimentary check exists to atleast prevent cookies from being set on TLDs. This check was broken if thehost name in the URL uses a trailing dot.This can allow arbitrary sites to set cookies that then would get sent to adifferent and unrelated site or domain. libcurl permite erróneamente que se establezcan cookies para Dominios de Alto Nivel (TLDs) si el nombre de host es proporcionado con un punto al final. curl puede recibir y enviar cookies. "cookie engine" de curl puede construirse con o sin conocimiento de la [Lista de Sufijos Públicos] (https://publicsuffix.org/). Si no es proporcionado soporte de PSL, se presenta una comprobación más rudimentaria para al menos evitar que sean establecidas cookies en los TLD. • https://hackerone.com/reports/1553301 https://security.gentoo.org/glsa/202212-01 https://security.netapp.com/advisory/ntap-20220609-0009 • CWE-201: Insertion of Sensitive Information Into Sent Data •