CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2017-6951 – kernel: NULL pointer dereference in keyring_search_aux function
https://notcve.org/view.php?id=CVE-2017-6951
The keyring_search_aux function in security/keys/keyring.c in the Linux kernel through 3.14.79 allows local users to cause a denial of service (NULL pointer dereference and OOPS) via a request_key system call for the "dead" type. La función keyring_search_aux en security/keys/keyring.c en el kernel de Linux hasta la versión 3.14.79 permite a usuarios locales provocar una denegación de servicio (referencia a puntero NULL y OOPS) a través de una llamada al sistema request_key para el tipo "muerte". The keyring_search_aux function in security/keys/keyring.c in the Linux kernel allows local users to cause a denial of service via a request_key system call for the "dead" key type. • http://www.securityfocus.com/bid/96943 http://www.spinics.net/lists/keyrings/msg01845.html http://www.spinics.net/lists/keyrings/msg01846.html http://www.spinics.net/lists/keyrings/msg01849.html https://access.redhat.com/errata/RHSA-2017:1842 https://access.redhat.com/errata/RHSA-2017:2077 https://access.redhat.com/errata/RHSA-2017:2669 https://access.redhat.com/security/cve/CVE-2017-6951 https://bugzilla.redhat.com/show_bug.cgi?id=1433252 • CWE-476: NULL Pointer Dereference •
CVSS: 7.6EPSS: 0%CPEs: 2EXPL: 0CVE-2017-0523
https://notcve.org/view.php?id=CVE-2017-0523
An elevation of privilege vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: N/A. Android ID: A-32835279. • http://www.securityfocus.com/bid/96735 http://www.securitytracker.com/id/1037968 https://source.android.com/security/bulletin/2017-03-01 https://source.android.com/security/bulletin/2017-03-01.html https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=5bb646471da76d3d5cd02cf3da7a03ce6e3cb582 •
CVSS: 7.8EPSS: 0%CPEs: 10EXPL: 0CVE-2017-2636 – kernel: Race condition access to n_hdlc.tbuf causes double free in n_hdlc_release()
https://notcve.org/view.php?id=CVE-2017-2636
Race condition in drivers/tty/n_hdlc.c in the Linux kernel through 4.10.1 allows local users to gain privileges or cause a denial of service (double free) by setting the HDLC line discipline. Condición de carrera en drivers/tty/n_hdlc.c en el kernel de Linux hasta la versión 4.10.1 permite a usuarios locales obtener privilegios o provocar una denegación de servicio (liberación doble) ajustando la línea de disciplina HDLC. A race condition flaw was found in the N_HLDC Linux kernel driver when accessing n_hdlc.tbuf list that can lead to double free. A local, unprivileged user able to set the HDLC line discipline on the tty device could use this flaw to increase their privileges on the system. • http://www.debian.org/security/2017/dsa-3804 http://www.openwall.com/lists/oss-security/2017/03/07/6 http://www.securityfocus.com/bid/96732 http://www.securitytracker.com/id/1037963 https://a13xp0p0v.github.io/2017/03/24/CVE-2017-2636.html https://access.redhat.com/errata/RHSA-2017:0892 https://access.redhat.com/errata/RHSA-2017:0931 https://access.redhat.com/errata/RHSA-2017:0932 https://access.redhat.com/errata/RHSA-2017:0933 https://access.redhat.com/erra • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-415: Double Free •
CVSS: 7.0EPSS: 0%CPEs: 8EXPL: 0CVE-2016-10200 – kernel: l2tp: Race condition in the L2TPv3 IP encapsulation feature
https://notcve.org/view.php?id=CVE-2016-10200
Race condition in the L2TPv3 IP Encapsulation feature in the Linux kernel before 4.8.14 allows local users to gain privileges or cause a denial of service (use-after-free) by making multiple bind system calls without properly ascertaining whether a socket has the SOCK_ZAPPED status, related to net/l2tp/l2tp_ip.c and net/l2tp/l2tp_ip6.c. Condición de carrera en la característica L2TPv3 IP Encapsulation en el kernel de Linux en versiones anteriores a 4.8.14 permite a usuarios locales obtener privilegios o provocar una denegación de servicio (uso después de liberación) realizando múltiples llamadas al sistema enlazadas sin comprobar adecuadamente si un socket tiene el estatus SOCK_ZAPPED, relacionado con net/l2tp/l2tp_ip.c and net/l2tp/l2tp_ip6.c. A use-after-free flaw was found in the Linux kernel which enables a race condition in the L2TPv3 IP Encapsulation feature. A local user could use this flaw to escalate their privileges or crash the system. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=32c231164b762dddefa13af5a0101032c70b50ef http://source.android.com/security/bulletin/2017-03-01.html http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.8.14 http://www.securityfocus.com/bid/101783 http://www.securitytracker.com/id/1037965 http://www.securitytracker.com/id/1037968 https://access.redhat.com/errata/RHSA-2017:1842 https://access.redhat.com/errata/RHSA-2017:2077 https://access.redhat.com&#x • CWE-264: Permissions, Privileges, and Access Controls CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-416: Use After Free •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2017-6353
https://notcve.org/view.php?id=CVE-2017-6353
net/sctp/socket.c in the Linux kernel through 4.10.1 does not properly restrict association peel-off operations during certain wait states, which allows local users to cause a denial of service (invalid unlock and double free) via a multithreaded application. NOTE: this vulnerability exists because of an incorrect fix for CVE-2017-5986. net/sctp/socket.c en el kernel de Linux en versiones hasta 4.10.1 no restringe adecuadamente las operaciones de despegue de la asociación durante varios estados de espera, lo que permite a usuarios locales provocar una denegación de servicio (desbloqueo no válido y liberación doble) a través de una aplicación multihilo. NOTA: esta vulnerabilidad existe debido a una solución incorrecta de CVE-2017-5986. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=dfcb9f4f99f1e9a49e43398a7bfbf56927544af1 http://www.debian.org/security/2017/dsa-3804 http://www.openwall.com/lists/oss-security/2017/02/27/2 http://www.securityfocus.com/bid/96473 https://github.com/torvalds/linux/commit/dfcb9f4f99f1e9a49e43398a7bfbf56927544af1 • CWE-415: Double Free •