CVSS: 7.0EPSS: 0%CPEs: 13EXPL: 0CVE-2022-2961
https://notcve.org/view.php?id=CVE-2022-2961
A use-after-free flaw was found in the Linux kernel’s PLP Rose functionality in the way a user triggers a race condition by calling bind while simultaneously triggering the rose_bind() function. This flaw allows a local user to crash or potentially escalate their privileges on the system. Se ha encontrado un fallo de uso de memoria previamente liberada en la funcionalidad PLP Rose del kernel de Linux en la forma en que un usuario desencadena una condición de carrera al llamar a bind mientras es desencadenada simultáneamente la función rose_bind(). Este fallo permite a un usuario local bloquearse o escalar potencialmente sus privilegios en el sistema • https://access.redhat.com/security/cve/CVE-2022-2961 https://security.netapp.com/advisory/ntap-20230214-0004 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-416: Use After Free •
CVSS: 5.5EPSS: 0%CPEs: 9EXPL: 0CVE-2022-0171
https://notcve.org/view.php?id=CVE-2022-0171
A flaw was found in the Linux kernel. The existing KVM SEV API has a vulnerability that allows a non-root (host) user-level application to crash the host kernel by creating a confidential guest VM instance in AMD CPU that supports Secure Encrypted Virtualization (SEV). Se ha encontrado un fallo en el kernel de Linux. La API existente de KVM SEV presenta una vulnerabilidad que permite que una aplicación a nivel de usuario no root (anfitrión) bloquee el kernel del anfitrión al crear una instancia de VM de invitado confidencial en la CPU de AMD que admite la virtualización cifrada segura (SEV). • https://access.redhat.com/security/cve/CVE-2022-0171 https://bugzilla.redhat.com/show_bug.cgi?id=2038940 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=683412ccf61294d727ead4a73d97397396e69a6b https://lists.debian.org/debian-lts-announce/2022/11/msg00001.html https://www.debian.org/security/2022/dsa-5257 • CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer CWE-459: Incomplete Cleanup •
CVSS: 4.4EPSS: 0%CPEs: 3EXPL: 0CVE-2021-4159
https://notcve.org/view.php?id=CVE-2021-4159
A vulnerability was found in the Linux kernel's EBPF verifier when handling internal data structures. Internal memory locations could be returned to userspace. A local attacker with the permissions to insert eBPF code to the kernel can use this to leak internal kernel memory details defeating some of the exploit mitigations in place for the kernel. Se encontró una vulnerabilidad en el verificador EBPF del kernel de Linux cuando son manejadas estructuras de datos internas. Las ubicaciones de memoria interna podían ser devueltas al espacio de usuario. • https://access.redhat.com/security/cve/CVE-2021-4159 https://bugzilla.redhat.com/show_bug.cgi?id=2036024 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=294f2fc6da27620a506e6c050241655459ccd6bd https://lists.debian.org/debian-lts-announce/2022/10/msg00000.html https://security-tracker.debian.org/tracker/CVE-2021-4159 • CWE-202: Exposure of Sensitive Information Through Data Queries •
CVSS: 7.1EPSS: 0%CPEs: 14EXPL: 1CVE-2021-4204 – kernel: improper input validation may lead to privilege escalation
https://notcve.org/view.php?id=CVE-2021-4204
An out-of-bounds (OOB) memory access flaw was found in the Linux kernel's eBPF due to an Improper Input Validation. This flaw allows a local attacker with a special privilege to crash the system or leak internal information. Se ha encontrado un fallo de acceso a memoria fuera de límites (OOB) en el eBPF del kernel de Linux debido a una comprobación de entrada inapropiada. Este fallo permite a un atacante local con un privilegio especial bloquear el sistema o filtrar información interna. • https://github.com/tr3ee/CVE-2021-4204 https://access.redhat.com/security/cve/CVE-2021-4204 https://bugzilla.redhat.com/show_bug.cgi?id=2039178 https://security-tracker.debian.org/tracker/CVE-2021-4204 https://security.netapp.com/advisory/ntap-20221228-0003 https://www.openwall.com/lists/oss-security/2022/01/11/4 • CWE-20: Improper Input Validation CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-3736
https://notcve.org/view.php?id=CVE-2021-3736
A flaw was found in the Linux kernel. A memory leak problem was found in mbochs_ioctl in samples/vfio-mdev/mbochs.c in Virtual Function I/O (VFIO) Mediated devices. This flaw could allow a local attacker to leak internal kernel information. Se ha encontrado un fallo en el kernel de Linux. Se encontró un problema de pérdida de memoria en la función mbochs_ioctl en el archivo samples/vfio-mdev/mbochs.c en dispositivos mediados por Virtual Function I/O (VFIO). • https://access.redhat.com/security/cve/CVE-2021-3736 https://bugzilla.redhat.com/show_bug.cgi?id=1995570 https://github.com/torvalds/linux/commit/de5494af4815a4c9328536c72741229b7de88e7f • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-401: Missing Release of Memory after Effective Lifetime •