CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 0CVE-2017-10662
https://notcve.org/view.php?id=CVE-2017-10662
The sanity_check_raw_super function in fs/f2fs/super.c in the Linux kernel before 4.11.1 does not validate the segment count, which allows local users to gain privileges via unspecified vectors. La función sanity_check_raw_super en fs/f2fs/super.c en el kernel Linux en versiones anteriores a la 4.11.1 no valida el conteo de segmentos, lo que permite que usuarios locales obtengan privilegios mediante vectores sin especificar. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b9dd46188edc2f0d1f37328637860bb65a771124 http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.11.1 http://www.securityfocus.com/bid/100215 https://bugzilla.redhat.com/show_bug.cgi?id=1481146 https://github.com/torvalds/linux/commit/b9dd46188edc2f0d1f37328637860bb65a771124 https://source.android.com/security/bulletin/2017-08-01 •
CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 0CVE-2017-10663
https://notcve.org/view.php?id=CVE-2017-10663
The sanity_check_ckpt function in fs/f2fs/super.c in the Linux kernel before 4.12.4 does not validate the blkoff and segno arrays, which allows local users to gain privileges via unspecified vectors. La función sanity_check_ckpt en fs/f2fs/super.c en el kernel Linux en versiones anteriores a la 4.12.4 no valida los arrays blkoff y segno, lo que permite que usuarios locales obtengan privilegios mediante vectores sin especificar. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=15d3042a937c13f5d9244241c7a9c8416ff6e82a http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.12.4 http://www.securityfocus.com/bid/100215 https://bugzilla.redhat.com/show_bug.cgi?id=1481149 https://github.com/torvalds/linux/commit/15d3042a937c13f5d9244241c7a9c8416ff6e82a https://source.android.com/security/bulletin/2017-08-01 • CWE-129: Improper Validation of Array Index •
CVSS: 7.0EPSS: 0%CPEs: 6EXPL: 4CVE-2017-1000112 – Linux Kernel - UDP Fragmentation Offset 'UFO' Privilege Escalation
https://notcve.org/view.php?id=CVE-2017-1000112
Linux kernel: Exploitable memory corruption due to UFO to non-UFO path switch. When building a UFO packet with MSG_MORE __ip_append_data() calls ip_ufo_append_data() to append. However in between two send() calls, the append path can be switched from UFO to non-UFO one, which leads to a memory corruption. In case UFO packet lengths exceeds MTU, copy = maxfraglen - skb->len becomes negative on the non-UFO path and the branch to allocate new skb is taken. This triggers fragmentation and computation of fraggap = skb_prev->len - maxfraglen. • https://www.exploit-db.com/exploits/45147 https://www.exploit-db.com/exploits/47169 https://www.exploit-db.com/exploits/43418 https://github.com/ol0273st-s/CVE-2017-1000112-Adpated http://seclists.org/oss-sec/2017/q3/277 http://www.debian.org/security/2017/dsa-3981 http://www.securityfocus.com/bid/100262 http://www.securitytracker.com/id/1039162 https://access.redhat.com/errata/RHSA-2017:2918 https://access.redhat.com/errata/RHSA-2017:2930 https://access.redh • CWE-122: Heap-based Buffer Overflow CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 7.8EPSS: 0%CPEs: 26EXPL: 0CVE-2017-1000111 – kernel: Heap out-of-bounds read in AF_PACKET sockets
https://notcve.org/view.php?id=CVE-2017-1000111
Linux kernel: heap out-of-bounds in AF_PACKET sockets. This new issue is analogous to previously disclosed CVE-2016-8655. In both cases, a socket option that changes socket state may race with safety checks in packet_set_ring. Previously with PACKET_VERSION. This time with PACKET_RESERVE. • http://www.debian.org/security/2017/dsa-3981 http://www.securityfocus.com/bid/100267 http://www.securitytracker.com/id/1039132 https://access.redhat.com/errata/RHSA-2017:2918 https://access.redhat.com/errata/RHSA-2017:2930 https://access.redhat.com/errata/RHSA-2017:2931 https://access.redhat.com/errata/RHSA-2017:3200 https://access.redhat.com/security/cve/cve-2017-1000111 https://access.redhat.com/security/cve/CVE-2017-1000111 https://bugzilla.redhat.com/show_bug.cgi • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 0%CPEs: 8EXPL: 0CVE-2017-7541 – kernel: Possible heap buffer overflow in brcmf_cfg80211_mgmt_tx()
https://notcve.org/view.php?id=CVE-2017-7541
The brcmf_cfg80211_mgmt_tx function in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux kernel before 4.12.3 allows local users to cause a denial of service (buffer overflow and system crash) or possibly gain privileges via a crafted NL80211_CMD_FRAME Netlink packet. La función brcmf_cfg80211_mgmt_tx en el archivo drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c en el kernel de Linux anterior a la versión 4.12.3, permite a los usuarios locales causar una denegación de servicio (desbordamiento de búfer y bloqueo del sistema) o posiblemente alcanzar privilegios por medio de un paquete de Netlink NL80211_CMD_FRAME creado. Kernel memory corruption due to a buffer overflow was found in brcmf_cfg80211_mgmt_tx() function in Linux kernels from v3.9-rc1 to v4.13-rc1. The vulnerability can be triggered by sending a crafted NL80211_CMD_FRAME packet via netlink. This flaw is unlikely to be triggered remotely as certain userspace code is needed for this. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8f44c9a41386729fea410e688959ddaa9d51be7c http://openwall.com/lists/oss-security/2017/07/24/2 http://www.debian.org/security/2017/dsa-3927 http://www.debian.org/security/2017/dsa-3945 http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.12.3 http://www.securityfocus.com/bid/99955 http://www.securitytracker.com/id/1038981 https://access.redhat.com/errata/RHSA-2017:2863 https://access.redhat.co • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •