CVSS: 7.8EPSS: 0%CPEs: 10EXPL: 1CVE-2018-18281 – kernel: TLB flush happens too late on mremap
https://notcve.org/view.php?id=CVE-2018-18281
Since Linux kernel version 3.2, the mremap() syscall performs TLB flushes after dropping pagetable locks. If a syscall such as ftruncate() removes entries from the pagetables of a task that is in the middle of mremap(), a stale TLB entry can remain for a short time that permits access to a physical page after it has been released back to the page allocator and reused. This is fixed in the following kernel versions: 4.9.135, 4.14.78, 4.18.16, 4.19. Desde la versión 3.2 del kernel de Linux, la syscall mremap() realiza vaciados TLB tras soltar bloqueos de tabla de página. Si una syscall como ftruncate() elimina las entradas de las tablas de página de una tarea en medio de mremap(), una entrada TLB obsoleta puede permanecer por poco tiempo, lo que permite el acceso a una página física una vez se ha devuelto al asignador de páginas y se reutiliza. • http://packetstormsecurity.com/files/150001/Linux-mremap-TLB-Flush-Too-Late.html http://www.openwall.com/lists/oss-security/2018/10/29/5 http://www.securityfocus.com/bid/105761 http://www.securityfocus.com/bid/106503 https://access.redhat.com/errata/RHSA-2019:0831 https://access.redhat.com/errata/RHSA-2019:2029 https://access.redhat.com/errata/RHSA-2019:2043 https://access.redhat.com/errata/RHSA-2020:0036 https://access.redhat.com/errata/RHSA-2020:0100 https://access&# • CWE-459: Incomplete Cleanup CWE-672: Operation on a Resource after Expiration or Release •
CVSS: 5.5EPSS: 0%CPEs: 7EXPL: 0CVE-2018-18710
https://notcve.org/view.php?id=CVE-2018-18710
An issue was discovered in the Linux kernel through 4.19. An information leak in cdrom_ioctl_select_disc in drivers/cdrom/cdrom.c could be used by local attackers to read kernel memory because a cast from unsigned long to int interferes with bounds checking. This is similar to CVE-2018-10940 and CVE-2018-16658. Se ha descubierto un problema en el kernel de Linux hasta la versión 4.19. Una fuga de información en cdrom_ioctl_select_disc en drivers/cdrom/cdrom.c podría ser empleada por atacantes locales para leer memoria del kernel debido a que una conversión de un long no firmado a int interfiere con la comprobación de límites. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e4f3aa2e1e67bb48dfbaaf1cad59013d5a5bc276 http://www.securityfocus.com/bid/106041 https://github.com/torvalds/linux/commit/e4f3aa2e1e67bb48dfbaaf1cad59013d5a5bc276 https://lists.debian.org/debian-lts-announce/2019/03/msg00017.html https://lists.debian.org/debian-lts-announce/2019/03/msg00034.html https://lists.debian.org/debian-lts-announce/2019/04/msg00004.html https://usn.ubuntu.com/3846-1 https://usn.ubuntu.com/3847-1 ht • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 1CVE-2018-18690 – kernel: filesystem corruption due to an unchecked error condition during an xfs attribute change
https://notcve.org/view.php?id=CVE-2018-18690
In the Linux kernel before 4.17, a local attacker able to set attributes on an xfs filesystem could make this filesystem non-operational until the next mount by triggering an unchecked error condition during an xfs attribute change, because xfs_attr_shortform_addname in fs/xfs/libxfs/xfs_attr.c mishandles ATTR_REPLACE operations with conversion of an attr from short to long form. En el kernel de Linux en versiones anteriores a la 4.17, un atacante local que sea capaz de establecer atributos en un sistema de archivos xfs podría hacer que este sistema de archivos no esté operativo hasta el siguiente montaje desencadenando una condición de error no marcada. Esto se debe a que xfs_attr_shortform_addname en fs/xfs/libxfs/xfs_attr.c gestiona de manera incorrecta las operaciones ATTR_REPLACE con la conversión de un attr de forma corta a forma larga. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=7b38460dc8e4eafba06c78f8e37099d3b34d473c http://www.securityfocus.com/bid/105753 https://bugzilla.kernel.org/show_bug.cgi?id=199119 https://bugzilla.suse.com/show_bug.cgi?id=1105025 https://github.com/torvalds/linux/commit/7b38460dc8e4eafba06c78f8e37099d3b34d473c https://lists.debian.org/debian-lts-announce/2019/03/msg00017.html https://lists.debian.org/debian-lts-announce/2019/03/msg00034.html https://lists.debian.org/debian- • CWE-391: Unchecked Error Condition CWE-754: Improper Check for Unusual or Exceptional Conditions •
CVSS: 8.1EPSS: 0%CPEs: 16EXPL: 1CVE-2018-18559 – kernel: Use-after-free due to race condition in AF_PACKET implementation
https://notcve.org/view.php?id=CVE-2018-18559
In the Linux kernel through 4.19, a use-after-free can occur due to a race condition between fanout_add from setsockopt and bind on an AF_PACKET socket. This issue exists because of the 15fe076edea787807a7cdc168df832544b58eba6 incomplete fix for a race condition. The code mishandles a certain multithreaded case involving a packet_do_bind unregister action followed by a packet_notifier register action. Later, packet_release operates on only one of the two applicable linked lists. The attacker can achieve Program Counter control. • https://access.redhat.com/errata/RHBA-2019:0327 https://access.redhat.com/errata/RHSA-2019:0163 https://access.redhat.com/errata/RHSA-2019:0188 https://access.redhat.com/errata/RHSA-2019:1170 https://access.redhat.com/errata/RHSA-2019:1190 https://access.redhat.com/errata/RHSA-2019:3967 https://access.redhat.com/errata/RHSA-2019:4159 https://access.redhat.com/errata/RHSA-2020:0174 https://blogs.securiteam.com/index.php/archives/3731 https://access.redhat.com/security/ • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-416: Use After Free •
CVSS: 3.3EPSS: 0%CPEs: 3EXPL: 0CVE-2018-18386 – kernel: Type confusion in drivers/tty/n_tty.c allows for a denial of service
https://notcve.org/view.php?id=CVE-2018-18386
drivers/tty/n_tty.c in the Linux kernel before 4.14.11 allows local attackers (who are able to access pseudo terminals) to hang/block further usage of any pseudo terminal devices due to an EXTPROC versus ICANON confusion in TIOCINQ. drivers/tty/n_tty.c en el kernel de Linux en versiones anteriores a la 4.14.11 permite que atacantes locales (que pueden acceder a los pseudoterminales) bloqueen el uso de dispositivos pseudoterminal debido a una confusión EXTPROC versus ICANON en TIOCINQ. A security flaw was found in the Linux kernel in drivers/tty/n_tty.c which allows local attackers (ones who are able to access pseudo terminals) to lock them up and block further usage of any pseudo terminal devices due to an EXTPROC versus ICANON confusion in TIOCINQ handler. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=966031f340185eddd05affcf72b740549f056348 https://access.redhat.com/errata/RHSA-2019:0831 https://bugzilla.suse.com/show_bug.cgi?id=1094825 https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.11 https://github.com/torvalds/linux/commit/966031f340185eddd05affcf72b740549f056348 https://usn.ubuntu.com/3849-1 https://usn.ubuntu.com/3849-2 https://access.redhat.com/security/cve/CVE-2018-18386 https://bugzilla& • CWE-704: Incorrect Type Conversion or Cast CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') •