CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2015-5156 – kernel: buffer overflow with fraglist larger than MAX_SKB_FRAGS + 2 in virtio-net
https://notcve.org/view.php?id=CVE-2015-5156
The virtnet_probe function in drivers/net/virtio_net.c in the Linux kernel before 4.2 attempts to support a FRAGLIST feature without proper memory allocation, which allows guest OS users to cause a denial of service (buffer overflow and memory corruption) via a crafted sequence of fragmented packets. La función virtnet_probe en drivers/net/virtio_net.c en el kernel de Linux en versiones anteriores a 4.2 intenta dar soporte a la funcionalidad FRAGLIST sin asignación adecuada de memoria, lo que permite a usuarios invitados del SO provocar una denegación de servicio (desbordamiento del buffer y corrupción de memoria) a través de una secuencia manipulada de paquetes fragmentados. A buffer overflow flaw was found in the way the Linux kernel's virtio-net subsystem handled certain fraglists when the GRO (Generic Receive Offload) functionality was enabled in a bridged network configuration. An attacker on the local network could potentially use this flaw to crash the system, or, although unlikely, elevate their privileges on the system. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=48900cb6af4282fa0fb6ff4d72a81aa3dadb5c39 http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171454.html http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169378.html http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00009.html http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00018.html http://rhn.redhat.com/errata/RHSA-2015-1978.html http://rhn.redhat.com/errata/RH • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-122: Heap-based Buffer Overflow •
CVSS: 6.9EPSS: 0%CPEs: 1EXPL: 0CVE-2015-2925 – Kernel: vfs: Do not allow escaping from bind mounts
https://notcve.org/view.php?id=CVE-2015-2925
The prepend_path function in fs/dcache.c in the Linux kernel before 4.2.4 does not properly handle rename actions inside a bind mount, which allows local users to bypass an intended container protection mechanism by renaming a directory, related to a "double-chroot attack." La función prepend_path en fs/dcache.c en el kernel Linux en versiones anteriores a 4.2.4 no maneja adecuadamente el cambio de nombre de las acciones dentro de un enlace de montaje, lo que permite a usuarios locales eludir un mecanismo de protección destinado al contenedor mediante el cambio de nombre de un directorio, relacionado con un 'double-chroot attack'. A flaw was found in the way the Linux kernel's file system implementation handled rename operations in which the source was inside and the destination was outside of a bind mount. A privileged user inside a container could use this flaw to escape the bind mount and, potentially, escalate their privileges on the system. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=397d425dc26da728396e66d392d5dcb8dac30c37 http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=cde93be45a8a90d8c264c776fab63487b5038a65 http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00005.html http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00018.html http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00007.html http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00009 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-254: 7PK - Security Features •
CVSS: 4.9EPSS: 0%CPEs: 1EXPL: 0CVE-2015-6526 – kernel: perf on ppc64 can loop forever getting userlevel stacktraces
https://notcve.org/view.php?id=CVE-2015-6526
The perf_callchain_user_64 function in arch/powerpc/perf/callchain.c in the Linux kernel before 4.0.2 on ppc64 platforms allows local users to cause a denial of service (infinite loop) via a deep 64-bit userspace backtrace. Vulnerabilidad en la función perf_callchain_user_64 en arch/powerpc/perf/callchain.c en el kernel de Linux en versiones anteriores a 4.0.2 sobre plataformas ppc64, permite a usuarios locales causar una denegación de servicio (bucle infinito) a través de una traza inversa profunda en el espacio de usuario de 64-bit. A flaw was found in the way the Linux kernel's perf subsystem retrieved userlevel stack traces on PowerPC systems. A local, unprivileged user could use this flaw to cause a denial of service on the system by creating a special stack layout that would force the perf_callchain_user_64() function into an infinite loop. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=9a5cbce421a283e6aea3c4007f141735bf9da8c3 http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.0.2 http://www.openwall.com/lists/oss-security/2015/08/18/4 http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html http://www.securityfocus.com/bid/76401 http://www.securitytracker.com/id/1033728 http://www.ubuntu.com/usn/USN-2759-1 http://www.ubuntu.com/usn/USN-2760-1 https:& • CWE-399: Resource Management Errors CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 4.9EPSS: 0%CPEs: 1EXPL: 0CVE-2014-9728
https://notcve.org/view.php?id=CVE-2014-9728
The UDF filesystem implementation in the Linux kernel before 3.18.2 does not validate certain lengths, which allows local users to cause a denial of service (buffer over-read and system crash) via a crafted filesystem image, related to fs/udf/inode.c and fs/udf/symlink.c. Vulnerabilidad en la implementación del sistema de archivos UDF en el kernel de Linux en versiones anteriores a 3.18.2, no valida ciertas longitudes, lo cual permite a usuarios locales causar una denegación de servicio (sobre-lectura del buffer y caída del sistema) a través de una imagen de sistema de archivos manipulada, relacionado con fs/udf/inode.c y fs/udf/symlink.c. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=a1d47b262952a45aae62bd49cfaf33dd76c11a2c http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e159332b9af4b04d882dbcfe1bb0117f0a6d4b58 http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e237ec37ec154564f8690c5bd1795339955eeef9 http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00023.html http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00049.html http://lists.opensuse.org/open • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 2.1EPSS: 0%CPEs: 1EXPL: 0CVE-2014-9731
https://notcve.org/view.php?id=CVE-2014-9731
The UDF filesystem implementation in the Linux kernel before 3.18.2 does not ensure that space is available for storing a symlink target's name along with a trailing \0 character, which allows local users to obtain sensitive information via a crafted filesystem image, related to fs/udf/symlink.c and fs/udf/unicode.c. Vulnerabilidad en la implementación del sistema de archivos UDF en el kernel de Linux en versiones anteriores a 3.18.2, no asegura que haya espacio disponible para almacenar el nombre de destino de un link simbólico junto con el carácter \0 al final, lo que permite a usuarios locales obtener información sensible a través de una imagen de sistema de archivos manipulados, relacionado con fs/udf/symlink.c y fs/udf/unicode.c. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=0e5cc9a40ada6046e6bc3bdfcd0c0d7e4b706b14 http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00023.html http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00049.html http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00011.html http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00018.html http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00021.html http://www.kernel.org • CWE-17: DEPRECATED: Code •