CVSS: 4.9EPSS: 0%CPEs: 11EXPL: 1CVE-2020-25639
https://notcve.org/view.php?id=CVE-2020-25639
A NULL pointer dereference flaw was found in the Linux kernel's GPU Nouveau driver functionality in versions prior to 5.12-rc1 in the way the user calls ioctl DRM_IOCTL_NOUVEAU_CHANNEL_ALLOC. This flaw allows a local user to crash the system. Se encontró un fallo de desreferencia del puntero NULL en la funcionalidad del controlador GPU Nouveau del kernel de Linux en versiones anteriores a 5.12-rc1, en la manera en que el usuario llama a ioctl DRM_IOCTL_NOUVEAU_CHANNEL_ALLOC. Este fallo permite que un usuario local bloquee el sistema • https://bugzilla.redhat.com/show_bug.cgi?id=1876995 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HE4CT3NL6OEBRRBUKHIX63GLNVOWCVRW https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SUCBCKRHWP3UD2AVVYQJE7BIJEMCMXW5 • CWE-476: NULL Pointer Dereference •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2020-27830
https://notcve.org/view.php?id=CVE-2020-27830
A vulnerability was found in Linux Kernel where in the spk_ttyio_receive_buf2() function, it would dereference spk_ttyio_synth without checking whether it is NULL or not, and may lead to a NULL-ptr deref crash. Se encontró una vulnerabilidad en el kernel de Linux donde, en la función spk_ttyio_receive_buf2(), podría desreferenciar spk_ttyio_synth sin comprobar si es NULL o no, y puede conllevar a un bloqueo deref de NULL-ptr • http://www.openwall.com/lists/oss-security/2020/12/08/1 http://www.openwall.com/lists/oss-security/2020/12/08/4 https://bugzilla.redhat.com/show_bug.cgi?id=1919900 https://lists.debian.org/debian-lts-announce/2021/02/msg00018.html https://security.netapp.com/advisory/ntap-20210625-0004 https://www.debian.org/security/2021/dsa-4843 • CWE-476: NULL Pointer Dereference •
CVSS: 4.5EPSS: 0%CPEs: 38EXPL: 0CVE-2020-35508 – kernel: fork: fix copy_process(CLONE_PARENT) race with the exiting ->real_parent
https://notcve.org/view.php?id=CVE-2020-35508
A flaw possibility of race condition and incorrect initialization of the process id was found in the Linux kernel child/parent process identification handling while filtering signal handlers. A local attacker is able to abuse this flaw to bypass checks to send any signal to a privileged process. Se ha encontrado una posibilidad de fallo de condición de carrera y de inicialización incorrecta del id del proceso en el manejo del id del proceso child/parent del kernel de Linux mientras se filtran los manejadores de señales. Un atacante local es capaz de abusar de este fallo para omitir unas comprobaciones y enviar cualquier señal a un proceso privilegiado. A flaw possibility of race condition and incorrect initialization of the process id was found in the Linux kernel child/parent process identification handling while filtering signal handlers. • https://bugzilla.redhat.com/show_bug.cgi?id=1902724 https://github.com/torvalds/linux/commit/b4e00444cab4c3f3fec876dc0cccc8cbb0d1a948 https://security.netapp.com/advisory/ntap-20210513-0006 https://access.redhat.com/security/cve/CVE-2020-35508 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-665: Improper Initialization •
CVSS: 4.4EPSS: 0%CPEs: 1EXPL: 0CVE-2021-20177
https://notcve.org/view.php?id=CVE-2021-20177
A flaw was found in the Linux kernel's implementation of string matching within a packet. A privileged user (with root or CAP_NET_ADMIN) when inserting iptables rules could insert a rule which can panic the system. Kernel before kernel 5.5-rc1 is affected. Se encontró un fallo en la implementación del kernel de Linux de la coincidencia de cadenas dentro de un paquete. Un usuario privilegiado (con root o función CAP_NET_ADMIN) cuando se insertan las reglas de iptables podría insertar una regla que puede causar pánico en el sistema. • https://bugzilla.redhat.com/show_bug.cgi?id=1914719 • CWE-125: Out-of-bounds Read •
CVSS: 7.8EPSS: 0%CPEs: 28EXPL: 2CVE-2020-27815
https://notcve.org/view.php?id=CVE-2020-27815
A flaw was found in the JFS filesystem code in the Linux Kernel which allows a local attacker with the ability to set extended attributes to panic the system, causing memory corruption or escalating privileges. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Se encontró un fallo en el código del sistema de archivos JFS en el Kernel de Linux que permite que un atacante local con la capacidad de establecer atributos extendidos para poner en pánico al sistema, causando corrupción de memoria o una escalada de privilegios. La mayor amenaza de esta vulnerabilidad es la confidencialidad, la integridad y la disponibilidad del sistema • http://www.openwall.com/lists/oss-security/2020/11/30/5 http://www.openwall.com/lists/oss-security/2020/12/28/1 https://bugzilla.redhat.com/show_bug.cgi?id=1897668%2C https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c61b3e4839007668360ed8b87d7da96d2e59fc6c https://lists.debian.org/debian-lts-announce/2021/02/msg00018.html https://lists.debian.org/debian-lts-announce/2021/03/msg00010.html https://security.netapp.com/advisory/ntap-20210702-0004 https: • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-787: Out-of-bounds Write •