CVSS: 5.5EPSS: 0%CPEs: 7EXPL: 0CVE-2021-4135 – Ubuntu Security Notice USN-5337-1
https://notcve.org/view.php?id=CVE-2021-4135
25 Jan 2022 — A memory leak vulnerability was found in the Linux kernel's eBPF for the Simulated networking device driver in the way user uses BPF for the device such that function nsim_map_alloc_elem being called. A local user could use this flaw to get unauthorized access to some data. Se ha encontrado una vulnerabilidad de pérdida de memoria en el eBPF del kernel de Linux para el controlador del dispositivo de red simulado en la forma en que el usuario usa el BPF para el dispositivo, de manera que es llamado a la func... • https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=481221775d53 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-401: Missing Release of Memory after Effective Lifetime •
CVSS: 5.5EPSS: 0%CPEs: 8EXPL: 2CVE-2021-4149 – Ubuntu Security Notice USN-6014-1
https://notcve.org/view.php?id=CVE-2021-4149
25 Jan 2022 — A vulnerability was found in btrfs_alloc_tree_b in fs/btrfs/extent-tree.c in the Linux kernel due to an improper lock operation in btrfs. In this flaw, a user with a local privilege may cause a denial of service (DOS) due to a deadlock problem. Se encontró una vulnerabilidad en la función btrfs_alloc_tree_b en el archivo fs/btrfs/extent-tree.c en el kernel de Linux debido a una operación de bloqueo inapropiada en btrfs. En este fallo, un usuario con privilegio local puede causar una denegación de servicio (... • https://bugzilla.redhat.com/show_bug.cgi?id=2026485 • CWE-667: Improper Locking •
CVSS: 5.5EPSS: 0%CPEs: 11EXPL: 0CVE-2022-0322 – kernel: DoS in sctp_addto_chunk in net/sctp/sm_make_chunk.c
https://notcve.org/view.php?id=CVE-2022-0322
25 Jan 2022 — A flaw was found in the sctp_make_strreset_req function in net/sctp/sm_make_chunk.c in the SCTP network protocol in the Linux kernel with a local user privilege access. In this flaw, an attempt to use more buffer than is allocated triggers a BUG_ON issue, leading to a denial of service (DOS). Se ha encontrado un fallo en la función sctp_make_strreset_req en el archivo net/sctp/sm_make_chunk.c en el protocolo de red SCTP en el kernel de Linux con un acceso de privilegio de usuario local. En este fallo, un in... • https://bugzilla.redhat.com/show_bug.cgi?id=2042822 • CWE-681: Incorrect Conversion between Numeric Types CWE-704: Incorrect Type Conversion or Cast •
CVSS: 4.9EPSS: 0%CPEs: 8EXPL: 2CVE-2021-4032
https://notcve.org/view.php?id=CVE-2021-4032
21 Jan 2022 — A vulnerability was found in the Linux kernel's KVM subsystem in arch/x86/kvm/lapic.c kvm_free_lapic when a failure allocation was detected. In this flaw the KVM subsystem may crash the kernel due to mishandling of memory errors that happens during VCPU construction, which allows an attacker with special user privilege to cause a denial of service. This flaw affects kernel versions prior to 5.15 rc7. Se ha encontrado una vulnerabilidad en el subsistema KVM del kernel de Linux en el archivo arch/x86/kvm/lapi... • https://bugzilla.redhat.com/show_bug.cgi?id=2027403 • CWE-459: Incomplete Cleanup •
CVSS: 8.8EPSS: 0%CPEs: 14EXPL: 2CVE-2021-4154 – kernel: local privilege escalation by exploiting the fsconfig syscall parameter leads to container breakout
https://notcve.org/view.php?id=CVE-2021-4154
20 Jan 2022 — A use-after-free flaw was found in cgroup1_parse_param in kernel/cgroup/cgroup-v1.c in the Linux kernel's cgroup v1 parser. A local attacker with a user privilege could cause a privilege escalation by exploiting the fsconfig syscall parameter leading to a container breakout and a denial of service on the system. Se encontró un defecto de uso de memoria previamente liberada en la función cgroup1_parse_param en el archivo kernel/cgroup/cgroup-v1.c en el analizador cgroup v1 del kernel de Linux. Un atacante lo... • https://github.com/Markakd/CVE-2021-4154 • CWE-416: Use After Free •
CVSS: 8.4EPSS: 0%CPEs: 20EXPL: 10CVE-2022-0185 – Linux Kernel Heap-Based Buffer Overflow Vulnerability
https://notcve.org/view.php?id=CVE-2022-0185
19 Jan 2022 — A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functionality of the Linux kernel verified the supplied parameters length. An unprivileged (in case of unprivileged user namespaces enabled, otherwise needs namespaced CAP_SYS_ADMIN privilege) local user able to open a filesystem that does not support the Filesystem Context API (and thus fallbacks to legacy handling) could use this flaw to escalate their privileges on the system. Se ha encontrado... • https://packetstorm.news/files/id/165731 • CWE-190: Integer Overflow or Wraparound CWE-191: Integer Underflow (Wrap or Wraparound) •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-4155 – kernel: xfs: raw block device data leak in XFS_IOC_ALLOCSP IOCTL
https://notcve.org/view.php?id=CVE-2021-4155
19 Jan 2022 — A data leak flaw was found in the way XFS_IOC_ALLOCSP IOCTL in the XFS filesystem allowed for size increase of files with unaligned size. A local attacker could use this flaw to leak data on the XFS filesystem otherwise not accessible to them. Se encontró un fallo de filtrado de datos en la forma en que XFS_IOC_ALLOCSP IOCTL en el sistema de archivos XFS permitía aumentar el tamaño de los archivos con un tamaño no alineado. Un atacante local podría usar este fallo para filtrar datos en el sistema de archivo... • https://access.redhat.com/security/cve/CVE-2021-4155 • CWE-131: Incorrect Calculation of Buffer Size •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-46283 – openSUSE Security Advisory - openSUSE-SU-2022:0169-1
https://notcve.org/view.php?id=CVE-2021-46283
11 Jan 2022 — nf_tables_newset in net/netfilter/nf_tables_api.c in the Linux kernel before 5.12.13 allows local users to cause a denial of service (NULL pointer dereference and general protection fault) because of the missing initialization for nft_set_elem_expr_alloc. A local user can set a netfilter table expression in their own namespace. La función nf_tables_newset en el archivo net/netfilter/nf_tables_api.c en el kernel de Linux versiones anteriores a 5.12.13, permite a usuarios locales causar una denegación de serv... • https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.12.13 • CWE-665: Improper Initialization •
CVSS: 7.1EPSS: 0%CPEs: 19EXPL: 0CVE-2021-4090 – Ubuntu Security Notice USN-5265-1
https://notcve.org/view.php?id=CVE-2021-4090
11 Jan 2022 — An out-of-bounds (OOB) memory write flaw was found in the NFSD in the Linux kernel. Missing sanity may lead to a write beyond bmval[bmlen-1] in nfsd4_decode_bitmap4 in fs/nfsd/nfs4xdr.c. In this flaw, a local attacker with user privilege may gain access to out-of-bounds memory, leading to a system integrity and confidentiality threat. Se encontró un fallo de escritura en memoria fuera de límites (OOB) en el NFSD del kernel de Linux. Una falta de saneo puede conllevar a una escritura más allá de bmval[bmlen-... • https://bugzilla.redhat.com/show_bug.cgi?id=2025101 • CWE-787: Out-of-bounds Write •
CVSS: 7.4EPSS: 0%CPEs: 33EXPL: 2CVE-2021-4083 – kernel: fget: check that the fd still exists after getting a ref to it
https://notcve.org/view.php?id=CVE-2021-4083
10 Jan 2022 — A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket file handlers in the way users call close() and fget() simultaneously and can potentially trigger a race condition. This flaw allows a local user to crash the system or escalate their privileges on the system. This flaw affects Linux kernel versions prior to 5.16-rc4. Se ha encontrado un fallo de lectura de memoria previamente liberada en la recolección de basura del kernel de Linux para los manejadores d... • https://packetstorm.news/files/id/165504 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-416: Use After Free •