CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 2CVE-2023-42753 – Kernel: netfilter: potential slab-out-of-bound access due to integer underflow
https://notcve.org/view.php?id=CVE-2023-42753
An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro could lead to a miscalculation of the `h->nets` array offset, providing attackers with the primitive to arbitrarily increment/decrement a memory buffer out-of-bound. This issue may allow a local user to crash the system or potentially escalate their privileges on the system. Se encontró una vulnerabilidad de indexación de matrices en el subsistema netfilter del kernel de Linux. Una macro faltante podría provocar un error de cálculo del desplazamiento de la matriz `h->nets`, proporcionando a los atacantes la primitiva de incrementar/disminuir arbitrariamente un búfer de memoria fuera de límites. • http://packetstormsecurity.com/files/175963/Kernel-Live-Patch-Security-Notice-LSN-0099-1.html https://access.redhat.com/errata/RHSA-2023:7370 https://access.redhat.com/errata/RHSA-2023:7379 https://access.redhat.com/errata/RHSA-2023:7382 https://access.redhat.com/errata/RHSA-2023:7389 https://access.redhat.com/errata/RHSA-2023:7411 https://access.redhat.com/errata/RHSA-2023:7418 https://access.redhat.com/errata/RHSA-2023:7539 https://access.redhat.com/errata/RHSA-2023:7558 h • CWE-787: Out-of-bounds Write •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-5158 – Possible dos from guest to host invringh_kiov_advance in vhost driver at drivers/vhost/vringh.c
https://notcve.org/view.php?id=CVE-2023-5158
A flaw was found in vringh_kiov_advance in drivers/vhost/vringh.c in the host side of a virtio ring in the Linux Kernel. This issue may result in a denial of service from guest to host via zero length descriptor. Se encontró una falla en vringh_kiov_advance en drivers/vhost/vringh.c en el lado del host de un virtio ring en el kernel de Linux. Este problema puede provocar una denegación de servicio del huésped al anfitrión a través de un descriptor de longitud cero. • https://access.redhat.com/security/cve/CVE-2023-5158 https://bugzilla.redhat.com/show_bug.cgi?id=2240561 • CWE-684: Incorrect Provision of Specified Functionality •
CVSS: 3.3EPSS: 0%CPEs: 1EXPL: 0CVE-2020-36766
https://notcve.org/view.php?id=CVE-2020-36766
An issue was discovered in the Linux kernel before 5.8.6. drivers/media/cec/core/cec-api.c leaks one byte of kernel memory on specific hardware to unprivileged users, because of directly assigning log_addrs with a hole in the struct. Se descubrió un problema en el kernel de Linux anterior a 5.8.6. drivers/media/cec/core/cec-api.c pierde un byte de memoria del kernel en hardware específico a usuarios sin privilegios, debido a la asignación directa de log_addrs con un agujero en la estructura. • https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8.6 https://github.com/torvalds/linux/commit/6c42227c3467549ddc65efe99c869021d2f4a570 •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 2CVE-2023-4921 – Use-after-free in Linux kernel's net/sched: sch_qfq component
https://notcve.org/view.php?id=CVE-2023-4921
A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation. When the plug qdisc is used as a class of the qfq qdisc, sending network packets triggers use-after-free in qfq_dequeue() due to the incorrect .peek handler of sch_plug and lack of error checking in agg_dequeue(). We recommend upgrading past commit 8fc134fee27f2263988ae38920bc03da416b03d8. Una vulnerabilidad de use-after-free en el componente net/sched: sch_qfq del kernel de Linux se puede explotar para lograr una escalada de privilegios local. Cuando el complemento qdisc se utiliza como una clase de qfq qdisc, el envío de paquetes de red activa el uso después de la liberación en qfq_dequeue() debido al controlador .peek incorrecto de sch_plug y la falta de verificación de errores en agg_dequeue(). Recomendamos actualizar al commit anterior 8fc134fee27f2263988ae38920bc03da416b03d8. A use-after-free flaw was found in qfq_dequeue and agg_dequeue in net/sched/sch_qfq.c in the Traffic Control (QoS) subsystem in the Linux kernel. • https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=8fc134fee27f2263988ae38920bc03da416b03d8 https://kernel.dance/8fc134fee27f2263988ae38920bc03da416b03d8 https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html https://access.redhat.com/security/cve/CVE-2023-4921 https://bugzilla.redhat.com/show_bug.cgi?id=2245514 • CWE-416: Use After Free •
CVSS: 7.8EPSS: 0%CPEs: 10EXPL: 0CVE-2023-34319 – Linux: buffer overrun in netback due to unusual packet
https://notcve.org/view.php?id=CVE-2023-34319
The fix for XSA-423 added logic to Linux'es netback driver to deal with a frontend splitting a packet in a way such that not all of the headers would come in one piece. Unfortunately the logic introduced there didn't account for the extreme case of the entire packet being split into as many pieces as permitted by the protocol, yet still being smaller than the area that's specially dealt with to keep all (possible) headers together. Such an unusual packet would therefore trigger a buffer overrun in the driver. La solución para XSA-423 agregó lógica al controlador netback de Linux para lidiar con una interfaz que divide un paquete de tal manera que no todos los encabezados vengan en una sola pieza. Desafortunadamente, la lógica introducida allí no tuvo en cuenta el caso extremo de que todo el paquete se divida en tantas partes como lo permita el protocolo, pero aún así sea más pequeño que el área que se trata especialmente para mantener todos los (posibles) encabezados juntos. • http://packetstormsecurity.com/files/175963/Kernel-Live-Patch-Security-Notice-LSN-0099-1.html https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html https://security.netapp.com/advisory/ntap-20240202-0001 https://xenbits.xenproject.org/xsa/advisory-432.html • CWE-787: Out-of-bounds Write •