CVSS: 5.5EPSS: 0%CPEs: 32EXPL: 2CVE-2021-3744 – kernel: crypto: ccp - fix resource leaks in ccp_run_aes_gcm_cmd()
https://notcve.org/view.php?id=CVE-2021-3744
A memory leak flaw was found in the Linux kernel in the ccp_run_aes_gcm_cmd() function in drivers/crypto/ccp/ccp-ops.c, which allows attackers to cause a denial of service (memory consumption). This vulnerability is similar with the older CVE-2019-18808. Se ha encontrado un fallo de pérdida de memoria en el kernel de Linux en la función ccp_run_aes_gcm_cmd() en el archivo drivers/crypto/ccp/ccp-ops.c, que permite a atacantes causar una denegación de servicio (consumo de memoria). Esta vulnerabilidad es similar a la anterior CVE-2019-18808 A flaw was found in the Linux kernel. A memory leak in the ccp-ops crypto driver can allow attackers to cause a denial of service. • http://www.openwall.com/lists/oss-security/2021/09/14/1 https://bugzilla.redhat.com/show_bug.cgi?id=2000627 https://github.com/torvalds/linux/commit/505d9dcb0f7ddf9d075e729523a33d38642ae680 https://kernel.googlesource.com/pub/scm/linux/kernel/git/herbert/crypto-2.6/+/505d9dcb0f7ddf9d075e729523a33d38642ae680%5E%21/#F0 https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM https: • CWE-401: Missing Release of Memory after Effective Lifetime •
CVSS: 7.8EPSS: 0%CPEs: 25EXPL: 0CVE-2021-3760
https://notcve.org/view.php?id=CVE-2021-3760
A flaw was found in the Linux kernel. A use-after-free vulnerability in the NFC stack can lead to a threat to confidentiality, integrity, and system availability. Se ha encontrado un fallo en el kernel de Linux. Una vulnerabilidad de uso de memoria previamente liberada en la pila NFC puede conllevar a una amenaza a la confidencialidad, integridad y disponibilidad del sistema • https://bugzilla.redhat.com/show_bug.cgi?id=2000585 https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html https://security.netapp.com/advisory/ntap-20220318-0007 https://www.debian.org/security/2022/dsa-5096 • CWE-416: Use After Free •
CVSS: 5.5EPSS: 0%CPEs: 7EXPL: 1CVE-2021-43389 – kernel: an array-index-out-bounds in detach_capi_ctr in drivers/isdn/capi/kcapi.c
https://notcve.org/view.php?id=CVE-2021-43389
An issue was discovered in the Linux kernel before 5.14.15. There is an array-index-out-of-bounds flaw in the detach_capi_ctr function in drivers/isdn/capi/kcapi.c. Se ha detectado un problema en el kernel de Linux versiones anteriores a 5.14.15. Se presenta un fallo de índice de matriz fuera de límites en la función detach_capi_ctr en el archivo drivers/isdn/capi/kcapi.c An improper validation of an array index and out of bounds memory read in the Linux kernel's Integrated Services Digital Network (ISDN) functionality was found in the way users call ioctl CMTPCONNADD. A local user could use this flaw to crash the system or starve the resources causing denial of service. • http://www.openwall.com/lists/oss-security/2021/11/05/1 https://bugzilla.redhat.com/show_bug.cgi?id=2013180 https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.15 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1f3e2e97c003f80c4b087092b225c8787ff91e4d https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html https://lore.kernel.org/netdev/CAFcO6XOvGQrRTaTkaJ0p3zR7y7nrAWD79r48 • CWE-125: Out-of-bounds Read •
CVSS: 4.7EPSS: 0%CPEs: 13EXPL: 0CVE-2020-27820 – kernel: use-after-free in nouveau kernel module
https://notcve.org/view.php?id=CVE-2020-27820
A vulnerability was found in Linux kernel, where a use-after-frees in nouveau's postclose() handler could happen if removing device (that is not common to remove video card physically without power-off, but same happens if "unbind" the driver). Se ha encontrado una vulnerabilidad en el kernel de Linux, en la que un uso de memoria previamente liberada en el manejador postclose() de nouveau podría ocurrir si se quita el dispositivo (que no es común quitar la tarjeta de vídeo físicamente sin apagar, pero lo mismo ocurre si se "desvincula" el controlador) • https://bugzilla.redhat.com/show_bug.cgi?id=1901726 https://lore.kernel.org/dri-devel/20201103194912.184413-2-jcline%40redhat.com https://lore.kernel.org/dri-devel/20201103194912.184413-3-jcline%40redhat.com https://lore.kernel.org/dri-devel/20201103194912.184413-4-jcline%40redhat.com https://www.oracle.com/security-alerts/cpujul2022.html https://access.redhat.com/security/cve/CVE-2020-27820 https://lore.kernel.org/dri-devel/20201103194912.184413-2-jcline@redhat.com https://lore.kernel.org • CWE-416: Use After Free •
CVSS: 6.7EPSS: 0%CPEs: 18EXPL: 1CVE-2021-42327
https://notcve.org/view.php?id=CVE-2021-42327
dp_link_settings_write in drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c in the Linux kernel through 5.14.14 allows a heap-based buffer overflow by an attacker who can write a string to the AMD GPU display drivers debug filesystem. There are no checks on size within parse_write_buffer_into_params when it uses the size of copy_from_user to copy a userspace buffer into a 40-byte heap buffer. la función dp_link_settings_write en el archivo drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c en el kernel de Linux versiones hasta 5.14.14, permite un desbordamiento de búfer en la región heap de la memoria por parte de un atacante que puede escribir una cadena en el sistema de archivos de depuración de los controladores de la GPU AMD. No se presentan comprobaciones de tamaño dentro de parse_write_buffer_into_params cuando usa el tamaño de copy_from_user para copiar un buffer de espacio de usuario en un buffer de pila de 40 bytes • https://github.com/docfate111/CVE-2021-42327 https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f23750b5b3d98653b31d4469592935ef6364ad67 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/log/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RDDEW4APTYKJK365HC2JZIVXYUV7ZRN7 https://security.netapp.com/advisory/ntap-20211118-0005 https://www.mail-archive.com/amd-gfx • CWE-787: Out-of-bounds Write •