CVSS: 4.7EPSS: 0%CPEs: 3EXPL: 1CVE-2019-16994 – kernel: Memory leak in sit_init_net() in net/ipv6/sit.c
https://notcve.org/view.php?id=CVE-2019-16994
In the Linux kernel before 5.0, a memory leak exists in sit_init_net() in net/ipv6/sit.c when register_netdev() fails to register sitn->fb_tunnel_dev, which may cause denial of service, aka CID-07f12b26e21a. En el kernel de Linux versiones anteriores a 5.0, se presenta una pérdida de memoria en la función sit_init_net() en el archivo net/ipv6/sit.c cuando la función register_netdev() no puede registrar sitn-)fb_tunnel_dev, lo que puede causar una denegación de servicio, también se conoce como CID-07f12b26e21a. A flaw was found in the way the sit_init_net function in the Linux kernel handled resource cleanup on errors. This flaw allows an attacker to use the error conditions to crash the system. • http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00021.html https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=07f12b26e21ab359261bf75cfcb424fdc7daeb6d https://github.com/torvalds/linux/commit/07f12b26e21ab359261bf75cfcb424fdc7daeb6d https://security.netapp.com/advisory/ntap-20191031-0005 https://access.redhat.com/security/cve/CVE-2019-16994 https://bugzilla.redhat.com/show_bug.cgi?id=1759681 • CWE-400: Uncontrolled Resource Consumption CWE-401: Missing Release of Memory after Effective Lifetime •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2019-16921
https://notcve.org/view.php?id=CVE-2019-16921
In the Linux kernel before 4.17, hns_roce_alloc_ucontext in drivers/infiniband/hw/hns/hns_roce_main.c does not initialize the resp data structure, which might allow attackers to obtain sensitive information from kernel stack memory, aka CID-df7e40425813. En el kernel de Linux versiones anteriores a 4.17, la función hns_roce_alloc_ucontext en el archivo drivers/infiniband/hw/hns/hns_roce_main.c no inicializa la estructura de datos resp, lo que podría permitir a atacantes obtener información confidencial de la memoria de la pila del kernel, también se conoce como CID-df7e40425813. • https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=df7e40425813c50cd252e6f5e348a81ef1acae56 https://github.com/torvalds/linux/commit/df7e40425813c50cd252e6f5e348a81ef1acae56 • CWE-665: Improper Initialization •
CVSS: 7.5EPSS: 1%CPEs: 4EXPL: 0CVE-2019-16714
https://notcve.org/view.php?id=CVE-2019-16714
In the Linux kernel before 5.2.14, rds6_inc_info_copy in net/rds/recv.c allows attackers to obtain sensitive information from kernel stack memory because tos and flags fields are not initialized. En el kernel de Linux versiones anteriores a 5.2.14, la función rds6_inc_info_copy en el archivo net/rds/recv.c permite a atacantes obtener información confidencial de la memoria de la pila del kernel porque los campos tos y flags no están inicializados. • http://www.openwall.com/lists/oss-security/2019/09/24/2 http://www.openwall.com/lists/oss-security/2019/09/25/1 https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.14 https://github.com/torvalds/linux/commit/7d0a06586b2686ba80c4a2da5f91cb10ffbea736 https://security.netapp.com/advisory/ntap-20191031-0005 https://support.f5.com/csp/article/K48351130?utm_source=f5support&%3Butm_medium=RSS https://usn.ubuntu.com/4157-1 https://usn.ubuntu.com/4157-2 • CWE-909: Missing Initialization of Resource •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2019-16413
https://notcve.org/view.php?id=CVE-2019-16413
An issue was discovered in the Linux kernel before 5.0.4. The 9p filesystem did not protect i_size_write() properly, which causes an i_size_read() infinite loop and denial of service on SMP systems. Se detectó un problema en el kernel de Linux versiones anteriores a 5.0.4. El sistema de archivos 9p no protegió apropiadamente la función i_size_write(), lo que causa un bucle infinito de la función i_size_read() y la denegación de servicio sobre los sistemas SMP. • https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.0.4 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5e3cc1ee1405a7eb3487ed24f786dec01b4cbe1f https://patchwork.kernel.org/patch/10753365 https://security.netapp.com/advisory/ntap-20191004-0001 https://support.f5.com/csp/article/K43239141?utm_source=f5support&%3Butm_medium=RSS • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 7.5EPSS: 0%CPEs: 14EXPL: 0CVE-2019-9009
https://notcve.org/view.php?id=CVE-2019-9009
An issue was discovered in 3S-Smart CODESYS before 3.5.15.0 . Crafted network packets cause the Control Runtime to crash. Se descubrió un problema en 3S-Smart CODESYS versiones anteriores a 3.5.15.0. Unos paquetes de red diseñados causan que el Control Runtime se bloquee. • https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=12941&token=50fabe3870c7bdc41701eb1799dddeec103de40c&download= https://www.us-cert.gov/ics/advisories/icsa-19-255-05 • CWE-755: Improper Handling of Exceptional Conditions •