CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-20854
https://notcve.org/view.php?id=CVE-2018-20854
An issue was discovered in the Linux kernel before 4.20. drivers/phy/mscc/phy-ocelot-serdes.c has an off-by-one error with a resultant ctrl->phys out-of-bounds read. Se detectó un problema en el kernel de Linux anterior a versión 4.20. El archivo drivers/phy/mscc/phy-ocelot-serdes.c presenta un error por un paso (off-by-one) con un resultado de lectura fuera de límites de ctrl-)phys. • https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6acb47d1a318e5b3b7115354ebc4ea060c59d3a1 https://github.com/torvalds/linux/commit/6acb47d1a318e5b3b7115354ebc4ea060c59d3a1 https://security.netapp.com/advisory/ntap-20190905-0002 https://support.f5.com/csp/article/K32450233 https://support.f5.com/csp/article/K32450233?utm_source=f5support&%3Butm_medium=RSS • CWE-125: Out-of-bounds Read •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2019-13648 – kernel: denial of service in arch/powerpc/kernel/signal_32.c and arch/powerpc/kernel/signal_64.c via sigreturn() system call
https://notcve.org/view.php?id=CVE-2019-13648
In the Linux kernel through 5.2.1 on the powerpc platform, when hardware transactional memory is disabled, a local user can cause a denial of service (TM Bad Thing exception and system crash) via a sigreturn() system call that sends a crafted signal frame. This affects arch/powerpc/kernel/signal_32.c and arch/powerpc/kernel/signal_64.c. En el kernel de Linux hasta versión 5.2.1 sobre la plataforma powerpc, cuando la memoria transaccional de hardware está deshabilitada, un usuario local puede causar una denegación de servicio (excepción de TM Bad Thing y bloqueo del sistema) por medio de una llamada de sistema de la función sigreturn() que envía una trama de señal diseñada. Esto afecta a los archivos arch/powerpc/kernel/signal_32.c y arch/powerpc/kernel/signal_64.c. A flaw was found in the PowerPc platform, where the kernel will panic if the transactional memory is disabled. • http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00055.html http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00056.html http://packetstormsecurity.com/files/154059/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html http://www.openwall.com/lists/oss-security/2019/07/30/1 https://git.kernel.org/torvalds/c/f16d80b75a096c52354c6e0a574993f3b0dfbdfe https://lists.debian.org/debian-lts-announce/2019/08/msg00017.html https://lists.fedoraproject.org/archives/list/package-announce • CWE-399: Resource Management Errors CWE-400: Uncontrolled Resource Consumption •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-13631 – kernel: OOB writes in parse_hid_report_descriptor in drivers/input/tablet/gtco.c
https://notcve.org/view.php?id=CVE-2019-13631
In parse_hid_report_descriptor in drivers/input/tablet/gtco.c in the Linux kernel through 5.2.1, a malicious USB device can send an HID report that triggers an out-of-bounds write during generation of debugging messages. En la función parse_hid_report_descriptor en el archivo drivers/input/tablet/gtco.c en el kernel de Linux hasta versión 5.2.1, un dispositivo USB malicioso puede enviar un informe HID que desencadena una escritura fuera de límites durante la generación de mensajes de depuración. A flaw was found in the Linux kernel's implementation of GTCO tablet/digitizer's version of the parse_hid_report_descriptor in drivers. An attacker with local access could use this flaw to create a specially crafted USB device inserted into the host to corrupt memory, trigger an out-of-bounds write during the generation of debugging messages, or possibly escalate the privileges of a process. • http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00055.html http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00056.html http://packetstormsecurity.com/files/154059/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html http://www.securityfocus.com/bid/109291 https://lists.debian.org/debian-lts-announce/2019/08/msg00016.html https://lists.debian.org/debian-lts-announce/2019/08/msg00017.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject& • CWE-125: Out-of-bounds Read CWE-787: Out-of-bounds Write •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2019-10638 – Kernel: net: weak IP ID generation leads to remote device tracking
https://notcve.org/view.php?id=CVE-2019-10638
In the Linux kernel before 5.1.7, a device can be tracked by an attacker using the IP ID values the kernel produces for connection-less protocols (e.g., UDP and ICMP). When such traffic is sent to multiple destination IP addresses, it is possible to obtain hash collisions (of indices to the counter array) and thereby obtain the hashing key (via enumeration). An attack may be conducted by hosting a crafted web page that uses WebRTC or gQUIC to force UDP traffic to attacker-controlled IP addresses. En el kernel de Linux anterior a versión 5.1.7, un atacante puede rastrear un dispositivo utilizando los valores ID de IP que el kernel produce para los protocolos sin conexión (por ejemplo, UDP e ICMP). Cuando dicho tráfico se envía a múltiples direcciones IP de destino, es posible obtener colisiones de hash (de índices en la matriz counter) y, de este modo, obtener la clave de hashing (mediante enumeración). • http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00014.html http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00025.html http://packetstormsecurity.com/files/155212/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html http://www.securityfocus.com/bid/109092 https://access.redhat.com/errata/RHSA-2019:3309 https://access.redhat.com/errata/RHSA-2019:3517 https://arxiv.org/pdf/1906.10478.pdf https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.0.8 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-326: Inadequate Encryption Strength •
CVSS: 7.0EPSS: 0%CPEs: 1EXPL: 1CVE-2019-13233 – kernel: use-after-free in arch/x86/lib/insn-eval.c
https://notcve.org/view.php?id=CVE-2019-13233
In arch/x86/lib/insn-eval.c in the Linux kernel before 5.1.9, there is a use-after-free for access to an LDT entry because of a race condition between modify_ldt() and a #BR exception for an MPX bounds violation. En arch/x86/lib/insn-eval.c en el kernel de Linux en versiones anteriores a la 5.1.9, hay un uso de memoria previamente liberada para acceder a una entrada LDT debido a una condición de carrera entre modify_ldt () y una excepción #BR para una violación de los límites de MPX. A vulnerability was found in the arch/x86/lib/insn-eval.c function in the Linux kernel. An attacker could corrupt the memory due to a flaw in use-after-free access to an LDT entry caused by a race condition between modify_ldt() and a #BR exception for an MPX bounds violation. • http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00025.html http://packetstormsecurity.com/files/154408/Kernel-Live-Patch-Security-Notice-LSN-0055-1.html https://access.redhat.com/errata/RHSA-2019:3309 https://access.redhat.com/errata/RHSA-2019:3517 https://bugs.chromium.org/p/project-zero/issues/detail?id=1879 https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.1.9 https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=de9f869616dd95e95c00bdd • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-416: Use After Free •