CVSS: 6.2EPSS: 0%CPEs: 3EXPL: 3CVE-2014-5207 – Linux Kernel < 3.16.1 - 'Remount FUSE' Local Privilege Escalation
https://notcve.org/view.php?id=CVE-2014-5207
fs/namespace.c in the Linux kernel through 3.16.1 does not properly restrict clearing MNT_NODEV, MNT_NOSUID, and MNT_NOEXEC and changing MNT_ATIME_MASK during a remount of a bind mount, which allows local users to gain privileges, interfere with backups and auditing on systems that had atime enabled, or cause a denial of service (excessive filesystem updating) on systems that had atime disabled via a "mount -o remount" command within a user namespace. fs/namespace.c en el kernel de Linux hasta 3.16.1 no restringe debidamente la limpieza MNT_NODEV, MNT_NOSUID, y MNT_NOEXEC y el cambio MNT_ATIME_MASK durante un remontaje de un montaje bind, lo que permite a usuarios locales ganar privilegios, interferir con copias de seguridad y auditoria en sistemas que tenían atime habilitado, o causar una denegación de servicio (la actualización excesiva de sistemas de ficheros) en sistemas que tenían atime deshabilitado a través de un comando 'mount -o remount' dentro de un espacio para el nombre del usuario. • https://www.exploit-db.com/exploits/34923 http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=9566d6742852c527bf5af38af5cbb878dad75705 http://osvdb.org/show/osvdb/110055 http://packetstormsecurity.com/files/128595/Linux-Kernel-3.16.1-FUSE-Privilege-Escalation.html http://seclists.org/oss-sec/2014/q3/352 http://www.exploit-db.com/exploits/34923 http://www.openwall.com/lists/oss-security/2014/08/13/4 http://www.securityfocus.com/bid/69216 http:/& • CWE-269: Improper Privilege Management •
CVSS: 6.2EPSS: 0%CPEs: 4EXPL: 1CVE-2014-5045 – kernel: vfs: refcount issues during unmount on symlink
https://notcve.org/view.php?id=CVE-2014-5045
The mountpoint_last function in fs/namei.c in the Linux kernel before 3.15.8 does not properly maintain a certain reference count during attempts to use the umount system call in conjunction with a symlink, which allows local users to cause a denial of service (memory consumption or use-after-free) or possibly have unspecified other impact via the umount program. La función mountpoint_last en fs/namei.c en el kernel de Linux anterior a 3.15.8 no mantiene debidamente cierta cuenta de referencias durante intentos de utilizar la llamada al sistema umount en conjunto con un enlace simbólico, lo que permite a usuarios locales causar una denegación de servicio (consumo de memoria o uso después de liberación) o posiblemente tener otro impacto no especificado a través del programa umount. A flaw was found in the way the Linux kernel's VFS subsystem handled reference counting when performing unmount operations on symbolic links. A local, unprivileged user could use this flaw to exhaust all available memory on the system or, potentially, trigger a use-after-free error, resulting in a system crash or privilege escalation. • http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=295dc39d941dc2ae53d5c170365af4c9d5c16212 http://rhn.redhat.com/errata/RHSA-2015-0062.html http://secunia.com/advisories/60353 http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.15.8 http://www.openwall.com/lists/oss-security/2014/07/24/2 http://www.securityfocus.com/bid/68862 https://bugzilla.redhat.com/show_bug.cgi?id=1122472 https://github.com/torvalds/linux/commit/295dc39d941dc2ae53d5c170365af4 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 7.2EPSS: 0%CPEs: 7EXPL: 0CVE-2014-3534 – kernel: s390: ptrace: insufficient sanitization when setting psw mask
https://notcve.org/view.php?id=CVE-2014-3534
arch/s390/kernel/ptrace.c in the Linux kernel before 3.15.8 on the s390 platform does not properly restrict address-space control operations in PTRACE_POKEUSR_AREA requests, which allows local users to obtain read and write access to kernel memory locations, and consequently gain privileges, via a crafted application that makes a ptrace system call. arch/s390/kernel/ptrace.c en el kernel de Linux anterior a 3.15.8 en el plataforma s390 no restringe debidamente las operaciones de control de la restricción del espacio para direcciones en las solicitudes PTRACE_POKEUSR_AREA, lo que permite a usuarios locales obtener el acceso a la lectura y la escritura en las localizaciones de la memoria del kernel, y como consecuencia ganar privilegios, a través de una aplicación que realiza una llamada al sistema ptrace. It was found that Linux kernel's ptrace subsystem did not properly sanitize the address-space-control bits when the program-status word (PSW) was being set. On IBM S/390 systems, a local, unprivileged user could use this flaw to set address-space-control bits to the kernel space, and thus gain read and write access to kernel memory. • http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=dab6cf55f81a6e16b8147aed9a843e1691dcd318 http://secunia.com/advisories/59790 http://secunia.com/advisories/60351 http://www.debian.org/security/2014/dsa-2992 http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.15.8 http://www.osvdb.org/109546 http://www.securityfocus.com/bid/68940 http://www.securitytracker.com/id/1030683 https://bugzilla.redhat.com/show_bug.cgi?id=1114089 https://excha • CWE-266: Incorrect Privilege Assignment CWE-269: Improper Privilege Management •
CVSS: 4.9EPSS: 0%CPEs: 3EXPL: 0CVE-2014-4655 – Kernel: ALSA: control: use-after-free in replacing user controls
https://notcve.org/view.php?id=CVE-2014-4655
The snd_ctl_elem_add function in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 does not properly maintain the user_ctl_count value, which allows local users to cause a denial of service (integer overflow and limit bypass) by leveraging /dev/snd/controlCX access for a large number of SNDRV_CTL_IOCTL_ELEM_REPLACE ioctl calls. La función snd_ctl_elem_add en sound/core/control.c en la implementación del control ALSA en el kernel de Linux anterior a 3.15.2 no gestiona debidamente el valor user_ctl_count, lo que permite a usuarios locales causar una denegación de servicio (desbordamiento de enteros y evadir el limite) mediante el aprovechamiento de acceso /dev/snd/controlCX para un numero largo de llamadas SNDRV_CTL_IOCTL_ELEM_REPLACE ioctl. A use-after-free flaw was found in the way the Linux kernel's Advanced Linux Sound Architecture (ALSA) implementation handled user controls. A local, privileged user could use this flaw to crash the system. • http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=82262a46627bebb0febcc26664746c25cef08563 http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00020.html http://rhn.redhat.com/errata/RHSA-2014-1083.html http://secunia.com/advisories/59434 http://secunia.com/advisories/59777 http://secunia.com/advisories/60545 http://secunia.com/advisories/60564 http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.15.2 http://www.openwall.com/lists/o • CWE-190: Integer Overflow or Wraparound CWE-416: Use After Free •
CVSS: 5.0EPSS: 0%CPEs: 9EXPL: 0CVE-2014-4656 – Kernel: ALSA: control: integer overflow in id.index & id.numid
https://notcve.org/view.php?id=CVE-2014-4656
Multiple integer overflows in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 allow local users to cause a denial of service by leveraging /dev/snd/controlCX access, related to (1) index values in the snd_ctl_add function and (2) numid values in the snd_ctl_remove_numid_conflict function. Múltiples desbordamientos de enteros en sound/core/control.c de la implementación del control de ALSA en el kernel de Linux anterior a 3.15.2 permite a usuarios locales causar una denegación de servicio mediante el aprovechamiento de acceso /dev/snd/controlCX, relacionado con (1) valores de indice en la función snd_ctl_add y valores (2) numid en la función snd_ctl_remove_numid_conflict. An integer overflow flaw was found in the way the Linux kernel's Advanced Linux Sound Architecture (ALSA) implementation handled user controls. A local, privileged user could use this flaw to crash the system. • http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=883a1d49f0d77d30012f114b2e19fc141beb3e8e http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=ac902c112d90a89e59916f751c2745f4dbdbb4bd http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00020.html http://rhn.redhat.com/errata/RHSA-2014-1083.html http://rhn.redhat.com/errata/RHSA-2015-0087.html http://secunia.com/advisories/59434 http://secunia.com/advisories/59777 http://s • CWE-190: Integer Overflow or Wraparound •