CVSS: 7.8EPSS: 0%CPEs: 32EXPL: 1CVE-2022-27666 – kernel: buffer overflow in IPsec ESP transformation code
https://notcve.org/view.php?id=CVE-2022-27666
A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and net/ipv6/esp6.c. This flaw allows a local attacker with a normal user privilege to overwrite kernel heap objects and may cause a local privilege escalation threat. Se ha encontrado un fallo de desbordamiento del búfer de la pila en el código de transformación de IPsec ESP en net/ipv4/esp4.c y net/ipv6/esp6.c. Este fallo permite a un atacante local con un privilegio de usuario normal sobrescribir los objetos de la pila del núcleo y puede causar una amenaza de escalada de privilegios local • https://github.com/plummm/CVE-2022-27666 https://bugzilla.redhat.com/show_bug.cgi?id=2061633 https://github.com/torvalds/linux/commit/ebe48d368e97d007bfeb76fcb065d6cfc4c96645 https://security.netapp.com/advisory/ntap-20220429-0001 https://www.debian.org/security/2022/dsa-5127 https://www.debian.org/security/2022/dsa-5173 https://access.redhat.com/security/cve/CVE-2022-27666 • CWE-122: Heap-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 0%CPEs: 20EXPL: 0CVE-2021-4197 – kernel: cgroup: Use open-time creds and namespace for migration perm checks
https://notcve.org/view.php?id=CVE-2021-4197
An unprivileged write to the file handler flaw in the Linux kernel's control groups and namespaces subsystem was found in the way users have access to some less privileged process that are controlled by cgroups and have higher privileged parent process. It is actually both for cgroup2 and cgroup1 versions of control groups. A local user could use this flaw to crash the system or escalate their privileges on the system. Se encontró un fallo de escritura no privilegiado en el manejador de archivos en el subsistema de grupos de control y espacios de nombres del kernel de Linux en la forma en que los usuarios presentan acceso a algunos procesos menos privilegiados que son controlados por cgroups y presentan procesos padres con mayores privilegios. En realidad se trata de las versiones cgroup2 y cgroup1 de los grupos de control. • https://bugzilla.redhat.com/show_bug.cgi?id=2035652 https://lore.kernel.org/lkml/20211209214707.805617-1-tj%40kernel.org/T https://security.netapp.com/advisory/ntap-20220602-0006 https://www.debian.org/security/2022/dsa-5127 https://www.debian.org/security/2022/dsa-5173 https://www.oracle.com/security-alerts/cpujul2022.html https://access.redhat.com/security/cve/CVE-2021-4197 • CWE-287: Improper Authentication •
CVSS: 7.5EPSS: 0%CPEs: 17EXPL: 0CVE-2022-0667 – Assertion failure on delayed DS lookup
https://notcve.org/view.php?id=CVE-2022-0667
When the vulnerability is triggered the BIND process will exit. BIND 9.18.0 Cuando es desencadenada la vulnerabilidad, el proceso BIND saldrá. BIND versión 9.18.0 • https://kb.isc.org/v1/docs/cve-2022-0667 https://security.netapp.com/advisory/ntap-20220408-0001 • CWE-617: Reachable Assertion •
CVSS: 9.1EPSS: 0%CPEs: 34EXPL: 0CVE-2022-0742 – Memory leak in ICMP6 in Linux Kernel
https://notcve.org/view.php?id=CVE-2022-0742
Memory leak in icmp6 implementation in Linux Kernel 5.13+ allows a remote attacker to DoS a host by making it go out-of-memory via icmp6 packets of type 130 or 131. We recommend upgrading past commit 2d3916f3189172d5c69d33065c3c21119fe539fc. Una pérdida de memoria en la implementación de icmp6 en el Kernel de Linux versión 5.13+, permite a un atacante remoto hacer DoS a un host haciendo que salga de la memoria por medio de paquetes icmp6 de tipo 130 o 131. Recomendamos actualizar el commit 2d3916f3189172d5c69d33065c3c21119fe539fc • https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=2d3916f3189172d5c69d33065c3c21119fe539fc https://security.netapp.com/advisory/ntap-20220425-0001 https://www.openwall.com/lists/oss-security/2022/03/15/3 • CWE-275: Permission Issues CWE-401: Missing Release of Memory after Effective Lifetime •
CVSS: 5.5EPSS: 0%CPEs: 17EXPL: 3CVE-2021-45868
https://notcve.org/view.php?id=CVE-2021-45868
In the Linux kernel before 5.15.3, fs/quota/quota_tree.c does not validate the block number in the quota tree (on disk). This can, for example, lead to a kernel/locking/rwsem.c use-after-free if there is a corrupted quota file. En el kernel de Linux versiones anteriores a 5.15.3, el archivo fs/quota/quota_tree.c no comprueba el número de bloque en el árbol de cuotas (en disco). Esto puede, por ejemplo, conllevar a un uso de memoria previamente liberada del archivo kernel/locking/rwsem.c si se presenta un archivo de cuotas corrupto • https://bugzilla.kernel.org/show_bug.cgi?id=214655 https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.3 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9bf3d20331295b1ecb81f4ed9ef358c51699a050 https://security.netapp.com/advisory/ntap-20220419-0003 https://www.openwall.com/lists/oss-security/2022/03/17/1 https://www.openwall.com/lists/oss-security/2022/03/17/2 • CWE-416: Use After Free •