CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2023-30456 – kernel: KVM: nVMX: missing consistency checks for CR0 and CR4
https://notcve.org/view.php?id=CVE-2023-30456
An issue was discovered in arch/x86/kvm/vmx/nested.c in the Linux kernel before 6.2.8. nVMX on x86_64 lacks consistency checks for CR0 and CR4. A flaw was found in the KVM's Intel nested virtualization feature (nVMX). The effective values of the guest CR0 and CR4 registers could differ from those included in the VMCS12. In rare circumstances (i.e., kvm_intel module loaded with parameters nested=1 and ept=0) this could allow a malicious guest to crash the host system, causing a denial of service. • http://packetstormsecurity.com/files/173757/Kernel-Live-Patch-Security-Notice-LSN-0096-1.html https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.2.8 https://github.com/torvalds/linux/commit/112e66017bff7f2837030f34c2bc19501e9212d5 https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html https://security.netapp.com/advisory/ntap-20230511-0007 https://access.redhat.com/security/cve/CVE-2023-30456 https://bugzilla&# • CWE-358: Improperly Implemented Security Check for Standard •
CVSS: 6.4EPSS: 0%CPEs: 12EXPL: 0CVE-2023-1855 – kernel: use-after-free bug in remove function xgene_hwmon_remove
https://notcve.org/view.php?id=CVE-2023-1855
A use-after-free flaw was found in xgene_hwmon_remove in drivers/hwmon/xgene-hwmon.c in the Hardware Monitoring Linux Kernel Driver (xgene-hwmon). This flaw could allow a local attacker to crash the system due to a race problem. This vulnerability could even lead to a kernel information leak problem. A use-after-free flaw was found in xgene_hwmon_remove in drivers/hwmon/xgene-hwmon.c in the Hardware Monitoring Linux Kernel driver (xgene-hwmon). This flaw could allow a local attacker to crash the system due to a race problem, possibly leading to a kernel information leak. • https://github.com/torvalds/linux/commit/cb090e64cf25602b9adaf32d5dfc9c8bec493cd1 https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html https://lore.kernel.org/all/20230318122758.2140868-1-linux%40roeck-us.net https://access.redhat.com/security/cve/CVE-2023-1855 https://bugzilla.redhat.com/show_bug.cgi?id=2184578 • CWE-416: Use After Free •
CVSS: 6.3EPSS: 0%CPEs: 17EXPL: 0CVE-2023-1611
https://notcve.org/view.php?id=CVE-2023-1611
A use-after-free flaw was found in btrfs_search_slot in fs/btrfs/ctree.c in btrfs in the Linux Kernel.This flaw allows an attacker to crash the system and possibly cause a kernel information lea • https://bugzilla.redhat.com/show_bug.cgi?id=2181342 https://github.com/torvalds/linux/commit/2f1a6be12ab6c8470d5776e68644726c94257c54 https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5QCM6XO4HSPLGR3DFYWFRIA3GCBIHZR4 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZWECAZ7V7EPSXMINO6Q6KWNKDY2CO6ZW https://lore.kernel.org/linux-btrfs/35b9a70650ea947387cf352914a8774b4f7e8a6f.1679481128.git.fdmanana%40sus • CWE-416: Use After Free •
CVSS: 7.8EPSS: 0%CPEs: 14EXPL: 0CVE-2023-28464 – Kernel: double free in hci_conn_cleanup of the bluetooth subsystem
https://notcve.org/view.php?id=CVE-2023-28464
hci_conn_cleanup in net/bluetooth/hci_conn.c in the Linux kernel through 6.2.9 has a use-after-free (observed in hci_conn_hash_flush) because of calls to hci_dev_put and hci_conn_put. There is a double free that may lead to privilege escalation. A double-free vulnerability was found in the hci_conn_cleanup in net/bluetooth/hci_conn.c in the Linux Kernel. This issue may cause a denial of service or privilege escalation. • https://lore.kernel.org/lkml/20230309074645.74309-1-wzhmmmmm%40gmail.com https://security.netapp.com/advisory/ntap-20230517-0004 https://www.openwall.com/lists/oss-security/2023/03/28/2 https://www.openwall.com/lists/oss-security/2023/03/28/3 https://access.redhat.com/security/cve/CVE-2023-28464 https://bugzilla.redhat.com/show_bug.cgi?id=2177759 • CWE-415: Double Free •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2023-1032
https://notcve.org/view.php?id=CVE-2023-1032
The Linux kernel io_uring IORING_OP_SOCKET operation contained a double free in function __sys_socket_file() in file net/socket.c. This issue was introduced in da214a475f8bd1d3e9e7a19ddfeb4d1617551bab and fixed in 649c15c7691e9b13cbe9bf6c65c365350e056067. La operación io_uring IORING_OP_SOCKET del kernel de Linux contenía una función de double free __sys_socket_file() en el archivo net/socket.c. Este problema se introdujo en da214a475f8bd1d3e9e7a19ddfeb4d1617551bab y se solucionó en 649c15c7691e9b13cbe9bf6c65c365350e056067. • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1032 https://ubuntu.com/security/notices/USN-5977-1 https://ubuntu.com/security/notices/USN-6024-1 https://ubuntu.com/security/notices/USN-6033-1 https://www.openwall.com/lists/oss-security/2023/03/13/2 • CWE-415: Double Free •