CVSS: 7.9EPSS: 0%CPEs: 36EXPL: 1CVE-2021-3752 – kernel: possible use-after-free in bluetooth module
https://notcve.org/view.php?id=CVE-2021-3752
A use-after-free flaw was found in the Linux kernel’s Bluetooth subsystem in the way user calls connect to the socket and disconnect simultaneously due to a race condition. This flaw allows a user to crash the system or escalate their privileges. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Se ha encontrado un fallo de uso de memoria previamente liberada en el subsistema Bluetooth del kernel de Linux en la forma en que las llamadas de usuario son conectadas al socket y son desconectadas simultáneamente debido a una condición de carrera. Este fallo permite a un usuario bloquear el sistema o escalar sus privilegios. • https://bugzilla.redhat.com/show_bug.cgi?id=1999544 https://lists.debian.org/debian-lts-announce/2022/03/msg00011.html https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html https://lore.kernel.org/lkml/20211115165435.133245729%40linuxfoundation.org https://security.netapp.com/advisory/ntap-20220318-0009 https://www.debian.org/security/2022/dsa-5096 https://www.openwall.com/lists/oss-security/2021/09/15/4 https://www.oracle.com/security-alerts/cpujul2022.html https:/ • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-416: Use After Free •
CVSS: 7.0EPSS: 0%CPEs: 31EXPL: 1CVE-2021-3640 – kernel: use-after-free vulnerability in function sco_sock_sendmsg()
https://notcve.org/view.php?id=CVE-2021-3640
A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in the way user calls ioct UFFDIO_REGISTER or other way triggers race condition of the call sco_conn_del() together with the call sco_sock_sendmsg() with the expected controllable faulting memory page. A privileged local user could use this flaw to crash the system or escalate their privileges on the system. Se encontró un fallo de uso de memoria previamente liberada en la función sco_sock_sendmsg() del subsistema HCI del kernel de Linux en la forma en que el usuario llama a ioct UFFDIO_REGISTER o de otra manera desencadena una condición de carrera de la llamada sco_conn_del() junto con la llamada sco_sock_sendmsg() con la página de memoria de fallo controlable esperada. Un usuario local privilegiado podría usar este fallo para bloquear el sistema o escalar sus privilegios en el sistema • https://bugzilla.redhat.com/show_bug.cgi?id=1980646 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/net/bluetooth/sco.c?h=v5.16&id=99c23da0eed4fd20cae8243f2b51e10e66aa0951 https://github.com/torvalds/linux/commit/99c23da0eed4fd20cae8243f2b51e10e66aa0951 https://lists.debian.org/debian-lts-announce/2022/03/msg00011.html https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html https://security.netapp.com/advisory/ntap-20220419-0003 https://ubuntu.com/security/CVE-2021- • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-416: Use After Free •
CVSS: 7.8EPSS: 0%CPEs: 20EXPL: 2CVE-2022-24122
https://notcve.org/view.php?id=CVE-2022-24122
kernel/ucount.c in the Linux kernel 5.14 through 5.16.4, when unprivileged user namespaces are enabled, allows a use-after-free and privilege escalation because a ucounts object can outlive its namespace. El archivo kernel/ucount.c en el kernel de Linux versiones 5.14 hasta 5.16.4, cuando los espacios de nombres de los usuarios no privilegiados están habilitados, permite un uso de memoria previamente liberada y una escalada de privilegios porque un objeto ucounts puede sobrevivir a su espacio de nombres • https://github.com/meowmeowxw/CVE-2022-24122 https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f9d87929d451d3e649699d0f1d74f71f77ad38f5 https://github.com/torvalds/linux/commit/f9d87929d451d3e649699d0f1d74f71f77ad38f5 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSR3AI2IQGRKZCHNKF6S25JGDKUEAWWL https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VVSZKUJAZ2VN6LJ35J2B6YD6BOPQTU3B https://security.netapp.com/advisory/ntap-20220221-0001 htt • CWE-416: Use After Free •
CVSS: 7.8EPSS: 0%CPEs: 21EXPL: 4CVE-2022-23222 – kernel: local privileges escalation in kernel/bpf/verifier.c
https://notcve.org/view.php?id=CVE-2022-23222
kernel/bpf/verifier.c in the Linux kernel through 5.15.14 allows local users to gain privileges because of the availability of pointer arithmetic via certain *_OR_NULL pointer types. El archivo kernel/bpf/verifier.c en el kernel de Linux versiones hasta 5.15.14, permite a usuarios locales alcanzar privilegios debido a una disponibilidad de la aritmética de punteros por medio de determinados tipos de punteros *_OR_NULL A flaw was found in the Linux kernel's adjust_ptr_min_max_vals in the kernel/bpf/verifier.c function. In this flaw, a missing sanity check for *_OR_NULL pointer types that perform pointer arithmetic may cause a kernel information leak issue. • https://github.com/tr3ee/CVE-2022-23222 https://github.com/PenteraIO/CVE-2022-23222-POC https://github.com/FridayOrtiz/CVE-2022-23222 http://www.openwall.com/lists/oss-security/2022/01/14/1 http://www.openwall.com/lists/oss-security/2022/01/18/2 http://www.openwall.com/lists/oss-security/2022/06/01/1 http://www.openwall.com/lists/oss-security/2022/06/04/3 http://www.openwall.com/lists/oss-security/2022/06/07/3 https://bugzilla.suse.com/show_ • CWE-476: NULL Pointer Dereference CWE-763: Release of Invalid Pointer or Reference •
CVSS: 5.1EPSS: 0%CPEs: 10EXPL: 1CVE-2021-4002 – kernel: possible leak or coruption of data residing on hugetlbfs
https://notcve.org/view.php?id=CVE-2021-4002
A memory leak flaw in the Linux kernel's hugetlbfs memory usage was found in the way the user maps some regions of memory twice using shmget() which are aligned to PUD alignment with the fault of some of the memory pages. A local user could use this flaw to get unauthorized access to some data. Se encontró un fallo de pérdida de memoria en el uso de memoria hugetlbfs del kernel de Linux en la forma en que el usuario mapea algunas regiones de memoria dos veces usando shmget() que están alineadas a la alineación PUD con el fallo de algunas de las páginas de memoria. Un usuario local podría usar este fallo para conseguir acceso no autorizado a algunos datos • https://bugzilla.redhat.com/show_bug.cgi?id=2025726 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=13e4ad2ce8df6e058ef482a31fdd81c725b0f7ea https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a4a118f2eead1d6c49e00765de89878288d4b890 https://lists.debian.org/debian-lts-announce/2022/03/msg00011.html https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html https://www.debian.org/security/2022/dsa-5096 https://www.openwall.com/list • CWE-401: Missing Release of Memory after Effective Lifetime CWE-459: Incomplete Cleanup •