CVSS: 8.6EPSS: 0%CPEs: 27EXPL: 2CVE-2022-1055 – Use after Free in tc_new_tfilter allowing for privilege escalation in Linux Kernel
https://notcve.org/view.php?id=CVE-2022-1055
A use-after-free exists in the Linux Kernel in tc_new_tfilter that could allow a local attacker to gain privilege escalation. The exploit requires unprivileged user namespaces. We recommend upgrading past commit 04c2a47ffb13c29778e2a14e414ad4cb5a5db4b5 se presenta un uso de memoria previamente liberada en el Kernel de Linux en la función tc_new_tfilter que podría permitir a un atacante local alcanzar una escalada de privilegios. La explotación requiere espacios de nombres de usuarios no privilegiados. Recomendamos actualizar el commit 04c2a47ffb13c29778e2a14e414ad4cb5a5db4b5 A use-after-free vulnerability was found in the tc_new_tfilter function in net/sched/cls_api.c in the Linux kernel. • http://packetstormsecurity.com/files/167386/Kernel-Live-Patch-Security-Notice-LSN-0086-1.html https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=04c2a47ffb13c29778e2a14e414ad4cb5a5db4b5 https://kernel.dance/#04c2a47ffb13c29778e2a14e414ad4cb5a5db4b5 https://security.netapp.com/advisory/ntap-20220506-0007 https://syzkaller.appspot.com/bug?id=2212474c958978ab86525fe6832ac8102c309ffc https://access.redhat.com/security/cve/CVE-2022-1055 https://bugzilla.redhat.com/show_bug.cgi?id=2070220 • CWE-416: Use After Free •
CVSS: 9.0EPSS: 0%CPEs: 60EXPL: 2CVE-2022-0435 – kernel: remote stack overflow via kernel panic on systems using TIPC may lead to DoS
https://notcve.org/view.php?id=CVE-2022-0435
A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user sends a packet with malicious content where the number of domain member nodes is higher than the 64 allowed. This flaw allows a remote user to crash the system or possibly escalate their privileges if they have access to the TIPC network. Se ha encontrado un fallo de desbordamiento de pila en la funcionalidad del protocolo TIPC del kernel de Linux en la forma en que un usuario envía un paquete con contenido malicioso cuando el número de nodos miembros del dominio es superior a los 64 permitidos. Este fallo permite a un usuario remoto bloquear el sistema o posiblemente escalar sus privilegios si presenta acceso a la red TIPC A stack overflow flaw was found in the Linux kernel’s TIPC protocol functionality in the way a user sends a packet with malicious content where the number of domain member nodes is higher than the 64 allowed. This flaw allows a remote user to crash the system or possibly escalate their privileges if they have access to the TIPC network. • https://github.com/wlswotmd/CVE-2022-0435 https://bugzilla.redhat.com/show_bug.cgi?id=2048738 https://security.netapp.com/advisory/ntap-20220602-0001 https://www.openwall.com/lists/oss-security/2022/02/10/1 https://access.redhat.com/security/cve/CVE-2022-0435 • CWE-787: Out-of-bounds Write •
CVSS: 9.8EPSS: 0%CPEs: 9EXPL: 1CVE-2021-3773 – kernel: lack of port sanity checking in natd and netfilter leads to exploit of OpenVPN clients
https://notcve.org/view.php?id=CVE-2021-3773
A flaw in netfilter could allow a network-connected attacker to infer openvpn connection endpoint information for further use in traditional network attacks. Un fallo en netfilter podría permitir a un atacante conectado a la red inferir información del endpoint de la conexión openvpn para su posterior uso en ataques de red tradicionales • https://github.com/d0rb/CVE-2021-3773 https://bugzilla.redhat.com/show_bug.cgi?id=2004949 https://www.oracle.com/security-alerts/cpujul2022.html https://citizenlab.ca/2024/07/vulnerabilities-in-vpns-paper-presented-at-the-privacy-enhancing-technologies-symposium-2024 https://access.redhat.com/security/cve/CVE-2021-3773 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 1CVE-2022-1043 – Linux Kernel io_uring Use-After-Free Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2022-1043
A flaw was found in the Linux kernel’s io_uring implementation. This flaw allows an attacker with a local account to corrupt system memory, crash the system or escalate privileges. Se ha encontrado un fallo en la implementación io_uring del kernel de Linux. Este fallo permite a un atacante con una cuenta local corromper la memoria del sistema, bloquear el sistema o escalar privilegios This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of credentials in io_uring. • http://packetstormsecurity.com/files/170834/io_uring-Same-Type-Object-Reuse-Privilege-Escalation.html https://access.redhat.com/security/cve/CVE-2022-1043 https://bugzilla.redhat.com/show_bug.cgi?id=1997328 https://github.com/torvalds/linux/commit/a30f895ad3239f45012e860d4f94c1a388b36d14 https://www.zerodayinitiative.com/advisories/ZDI-22-362 - • CWE-416: Use After Free •
CVSS: 8.8EPSS: 0%CPEs: 5EXPL: 1CVE-2021-4093 – kernel: KVM: SVM: out-of-bounds read/write in sev_es_string_io
https://notcve.org/view.php?id=CVE-2021-4093
A flaw was found in the KVM's AMD code for supporting the Secure Encrypted Virtualization-Encrypted State (SEV-ES). A KVM guest using SEV-ES can trigger out-of-bounds reads and writes in the host kernel via a malicious VMGEXIT for a string I/O instruction (for example, outs or ins) using the exit reason SVM_EXIT_IOIO. This issue results in a crash of the entire system or a potential guest-to-host escape scenario. Se ha encontrado un fallo en el código de AMD de KVM para soportar la Virtualización Segura Encriptada-Estado Encriptado (SEV-ES). Un huésped de KVM que use SEV-ES puede desencadenar lecturas y escrituras fuera de límites en el núcleo anfitrión por medio de un VMGEXIT malicioso para una instrucción de E/S de cadena (por ejemplo, outs o ins) usando el motivo de salida SVM_EXIT_IOIO. • https://bugs.chromium.org/p/project-zero/issues/detail?id=2222 https://bugzilla.redhat.com/show_bug.cgi?id=2028584 https://access.redhat.com/security/cve/CVE-2021-4093 • CWE-125: Out-of-bounds Read CWE-787: Out-of-bounds Write •