CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2017-13695
https://notcve.org/view.php?id=CVE-2017-13695
The acpi_ns_evaluate() function in drivers/acpi/acpica/nseval.c in the Linux kernel through 4.12.9 does not flush the operand cache and causes a kernel stack dump, which allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism (in the kernel through 4.9) via a crafted ACPI table. La función acpi_ns_evaluate() en drivers/acpi/acpica/nseval.c en el kernel Linux en su versión 4.12.9 no vacía la caché operativa y provoca un volcado de pila de kernel, lo que permite que usuarios locales obtengan información sensible de la memoria del kernel y omitan el mecanismo de protección KASLR (en la versión 4.9 del kernel) mediante una tabla ACPI manipulada. • http://www.securityfocus.com/bid/100497 https://github.com/acpica/acpica/pull/296/commits/37f2c716f2c6ab14c3ba557a539c3ee3224931b5 https://patchwork.kernel.org/patch/9850567 https://usn.ubuntu.com/3696-1 https://usn.ubuntu.com/3696-2 https://usn.ubuntu.com/3762-1 https://usn.ubuntu.com/3762-2 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.6EPSS: 0%CPEs: 13EXPL: 1CVE-2017-10661 – Linux kernel < 4.10.15 - Race Condition Privilege Escalation
https://notcve.org/view.php?id=CVE-2017-10661
Race condition in fs/timerfd.c in the Linux kernel before 4.10.15 allows local users to gain privileges or cause a denial of service (list corruption or use-after-free) via simultaneous file-descriptor operations that leverage improper might_cancel queueing. Una condición de carrera en fs/timerfd.c en el kernel Linux en versiones anteriores a la 4.10.15 permite que usuarios locales obtengan privilegios o provoquen una denegación de servicio (corrupción de lista o use-after-free) mediante operaciones simultáneas de descriptor de archivo que aprovechan la cola inadecuada might_cancel. A race condition was found in the Linux kernel before version 4.11-rc1 in 'fs/timerfd.c' file which allows a local user to cause a kernel list corruption or use-after-free via simultaneous operations with a file descriptor which leverage improper 'might_cancel' queuing. An unprivileged local user could use this flaw to cause a denial of service of the system. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is unlikely. • https://www.exploit-db.com/exploits/43345 http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=1e38da300e1e395a15048b0af1e5305bd91402f6 http://www.debian.org/security/2017/dsa-3981 http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.10.15 http://www.securityfocus.com/bid/100215 https://access.redhat.com/errata/RHSA-2018:3083 https://access.redhat.com/errata/RHSA-2018:3096 https://access.redhat.com/errata/RHSA-2019:4057 https://access.redhat.com/e • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-416: Use After Free •
CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 0CVE-2017-10662
https://notcve.org/view.php?id=CVE-2017-10662
The sanity_check_raw_super function in fs/f2fs/super.c in the Linux kernel before 4.11.1 does not validate the segment count, which allows local users to gain privileges via unspecified vectors. La función sanity_check_raw_super en fs/f2fs/super.c en el kernel Linux en versiones anteriores a la 4.11.1 no valida el conteo de segmentos, lo que permite que usuarios locales obtengan privilegios mediante vectores sin especificar. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b9dd46188edc2f0d1f37328637860bb65a771124 http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.11.1 http://www.securityfocus.com/bid/100215 https://bugzilla.redhat.com/show_bug.cgi?id=1481146 https://github.com/torvalds/linux/commit/b9dd46188edc2f0d1f37328637860bb65a771124 https://source.android.com/security/bulletin/2017-08-01 •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2006-3635
https://notcve.org/view.php?id=CVE-2006-3635
The ia64 subsystem in the Linux kernel before 2.6.26 allows local users to cause a denial of service (stack consumption and system crash) via a crafted application that leverages the mishandling of invalid Register Stack Engine (RSE) state. El subsistema ia64 en el kernel de Linux antes de la versión 2.6.26 permite a los usuarios locales causar una denegación de servicio (consumo de pila y caída del sistema) utilizando una aplicación manipulada que aprovecha el uso incorrecto del estado no válido del Register Stack Engine (RSE). • http://ftp.naist.jp/pub/linux/kernel/v2.6/ChangeLog-2.6.26 http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4dcc29e1574d88f4465ba865ed82800032f76418 https://bugzilla.suse.com/show_bug.cgi?id=199440 https://github.com/torvalds/linux/commit/4dcc29e1574d88f4465ba865ed82800032f76418 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2017-7542 – kernel: Integer overflow in ip6_find_1stfragopt() causes infinite loop
https://notcve.org/view.php?id=CVE-2017-7542
The ip6_find_1stfragopt function in net/ipv6/output_core.c in the Linux kernel through 4.12.3 allows local users to cause a denial of service (integer overflow and infinite loop) by leveraging the ability to open a raw socket. La función ip6_find_1stfragopt en el archivo net/ipv6/output_core.c en el kernel de Linux hasta la versión 4.12.3, permite a los usuarios locales causar una denegación de servicio (desbordamiento de enteros y bucle infinito) mediante la explotación de la capacidad de abrir un socket sin procesar. An integer overflow vulnerability in ip6_find_1stfragopt() function was found. A local attacker that has privileges (of CAP_NET_RAW) to open raw socket can cause an infinite loop inside the ip6_find_1stfragopt() function. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6399f1fae4ec29fab5ec76070435555e256ca3a6 http://www.debian.org/security/2017/dsa-3927 http://www.debian.org/security/2017/dsa-3945 http://www.securityfocus.com/bid/99953 https://access.redhat.com/errata/RHSA-2017:2918 https://access.redhat.com/errata/RHSA-2017:2930 https://access.redhat.com/errata/RHSA-2017:2931 https://access.redhat.com/errata/RHSA-2018:0169 https://github.com/torvalds/linux/commit/6399f • CWE-190: Integer Overflow or Wraparound CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •