CVSS: 7.0EPSS: 0%CPEs: 6EXPL: 4CVE-2017-1000112 – Linux Kernel - UDP Fragmentation Offset 'UFO' Privilege Escalation
https://notcve.org/view.php?id=CVE-2017-1000112
Linux kernel: Exploitable memory corruption due to UFO to non-UFO path switch. When building a UFO packet with MSG_MORE __ip_append_data() calls ip_ufo_append_data() to append. However in between two send() calls, the append path can be switched from UFO to non-UFO one, which leads to a memory corruption. In case UFO packet lengths exceeds MTU, copy = maxfraglen - skb->len becomes negative on the non-UFO path and the branch to allocate new skb is taken. This triggers fragmentation and computation of fraggap = skb_prev->len - maxfraglen. • https://www.exploit-db.com/exploits/45147 https://www.exploit-db.com/exploits/47169 https://www.exploit-db.com/exploits/43418 https://github.com/ol0273st-s/CVE-2017-1000112-Adpated http://seclists.org/oss-sec/2017/q3/277 http://www.debian.org/security/2017/dsa-3981 http://www.securityfocus.com/bid/100262 http://www.securitytracker.com/id/1039162 https://access.redhat.com/errata/RHSA-2017:2918 https://access.redhat.com/errata/RHSA-2017:2930 https://access.redh • CWE-122: Heap-based Buffer Overflow CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 7.8EPSS: 0%CPEs: 26EXPL: 0CVE-2017-1000111 – kernel: Heap out-of-bounds read in AF_PACKET sockets
https://notcve.org/view.php?id=CVE-2017-1000111
Linux kernel: heap out-of-bounds in AF_PACKET sockets. This new issue is analogous to previously disclosed CVE-2016-8655. In both cases, a socket option that changes socket state may race with safety checks in packet_set_ring. Previously with PACKET_VERSION. This time with PACKET_RESERVE. • http://www.debian.org/security/2017/dsa-3981 http://www.securityfocus.com/bid/100267 http://www.securitytracker.com/id/1039132 https://access.redhat.com/errata/RHSA-2017:2918 https://access.redhat.com/errata/RHSA-2017:2930 https://access.redhat.com/errata/RHSA-2017:2931 https://access.redhat.com/errata/RHSA-2017:3200 https://access.redhat.com/security/cve/cve-2017-1000111 https://access.redhat.com/security/cve/CVE-2017-1000111 https://bugzilla.redhat.com/show_bug.cgi • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-787: Out-of-bounds Write •
CVSS: 7.0EPSS: 0%CPEs: 7EXPL: 0CVE-2017-11600 – kernel: Out-of-bounds access via an XFRM_MSG_MIGRATE xfrm Netlink message
https://notcve.org/view.php?id=CVE-2017-11600
net/xfrm/xfrm_policy.c in the Linux kernel through 4.12.3, when CONFIG_XFRM_MIGRATE is enabled, does not ensure that the dir value of xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which allows local users to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via an XFRM_MSG_MIGRATE xfrm Netlink message. net/xfrm/xfrm_policy.c en el kernel de Linux hasta la versión 4.12.3, cuando se habilita CONFIG_XFRM_MIGRATE, no asegura que el valor dir de xfrm_userpolicy_id sea XFRM_POLICY_MAX o inferior, lo que permite que los usuarios locales provoquen una denegación de servicio (acceso fuera de límites) o, probablemente, causen otros impactos no especificados mediante un mensaje XFRM_MSG_MIGRATE xfrm Netlink. The xfrm_migrate() function in the net/xfrm/xfrm_policy.c file in the Linux kernel built with CONFIG_XFRM_MIGRATE does not verify if the dir parameter is less than XFRM_POLICY_MAX. This allows a local attacker to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact by sending a XFRM_MSG_MIGRATE netlink message. This flaw is present in the Linux kernel since an introduction of XFRM_MSG_MIGRATE in 2.6.21-rc1, up to 4.13-rc3. • http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00007.html http://seclists.org/bugtraq/2017/Jul/30 http://www.debian.org/security/2017/dsa-3981 http://www.securityfocus.com/bid/99928 https://access.redhat.com/errata/RHSA-2018:1965 https://access.redhat.com/errata/RHSA-2018:2003 https://access.redhat.com/errata/RHSA-2019:1170 https://access.redhat.com/errata/RHSA-2019:1190 https://source.android.com/security/bulletin/pixel/2017-11-01 https://access.redh • CWE-125: Out-of-bounds Read •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2017-7542 – kernel: Integer overflow in ip6_find_1stfragopt() causes infinite loop
https://notcve.org/view.php?id=CVE-2017-7542
The ip6_find_1stfragopt function in net/ipv6/output_core.c in the Linux kernel through 4.12.3 allows local users to cause a denial of service (integer overflow and infinite loop) by leveraging the ability to open a raw socket. La función ip6_find_1stfragopt en el archivo net/ipv6/output_core.c en el kernel de Linux hasta la versión 4.12.3, permite a los usuarios locales causar una denegación de servicio (desbordamiento de enteros y bucle infinito) mediante la explotación de la capacidad de abrir un socket sin procesar. An integer overflow vulnerability in ip6_find_1stfragopt() function was found. A local attacker that has privileges (of CAP_NET_RAW) to open raw socket can cause an infinite loop inside the ip6_find_1stfragopt() function. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6399f1fae4ec29fab5ec76070435555e256ca3a6 http://www.debian.org/security/2017/dsa-3927 http://www.debian.org/security/2017/dsa-3945 http://www.securityfocus.com/bid/99953 https://access.redhat.com/errata/RHSA-2017:2918 https://access.redhat.com/errata/RHSA-2017:2930 https://access.redhat.com/errata/RHSA-2017:2931 https://access.redhat.com/errata/RHSA-2018:0169 https://github.com/torvalds/linux/commit/6399f • CWE-190: Integer Overflow or Wraparound CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2017-11472
https://notcve.org/view.php?id=CVE-2017-11472
The acpi_ns_terminate() function in drivers/acpi/acpica/nsutils.c in the Linux kernel before 4.12 does not flush the operand cache and causes a kernel stack dump, which allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism (in the kernel through 4.9) via a crafted ACPI table. La función acpi_ns_terminate() en el archivo drivers/acpi/acpica/nsutils.c en el kernel de Linux anterior a versión 4.12, no limpia la caché operand y causa un volcado de pila del kernel, que permite a los usuarios locales obtener información confidencial de la memoria del kernel y omitir el mecanismo de protección KASLR (en el kernel hasta versión 4.9) por medio de una tabla ACPI creada. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=3b2d69114fefa474fca542e51119036dceb4aa6f https://github.com/acpica/acpica/commit/a23325b2e583556eae88ed3f764e457786bf4df6 https://github.com/torvalds/linux/commit/3b2d69114fefa474fca542e51119036dceb4aa6f https://usn.ubuntu.com/3619-1 https://usn.ubuntu.com/3619-2 https://usn.ubuntu.com/3754-1 • CWE-755: Improper Handling of Exceptional Conditions •