CVSS: 2.1EPSS: 0%CPEs: 12EXPL: 0CVE-2013-2148 – Kernel: fanotify: info leak in copy_event_to_user
https://notcve.org/view.php?id=CVE-2013-2148
The fill_event_metadata function in fs/notify/fanotify/fanotify_user.c in the Linux kernel through 3.9.4 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel memory via a read operation on the fanotify descriptor. La función fill_event_metadata en fs/notify/fanotify/fanotify_user.c en Linux kernel hasta v3.9.4 no inicializa determinadas estructuras, lo que permite a atacantes locales obtener información sensible desde la memoria del kernel a través de una operación de lectura en el descriptor fanotify. • http://lists.opensuse.org/opensuse-security-announce/2013-09/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2013-09/msg00004.html http://lists.opensuse.org/opensuse-updates/2013-12/msg00129.html http://lkml.org/lkml/2013/6/3/128 http://www.openwall.com/lists/oss-security/2013/06/05/26 http://www.ubuntu.com/usn/USN-1929-1 http://www.ubuntu.com/usn/USN-1930-1 https://bugzilla.redhat.com/show_bug.cgi?id=971258 https://access.redhat.com/securit • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-399: Resource Management Errors •
CVSS: 6.8EPSS: 1%CPEs: 55EXPL: 1CVE-2011-4604
https://notcve.org/view.php?id=CVE-2011-4604
The bat_socket_read function in net/batman-adv/icmp_socket.c in the Linux kernel before 3.3 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted batman-adv ICMP packet. La función bat_socket_read en net/batman-adv/icmp_socket.c en el kernel de Linux anterior a v3.3 permite a atacantes remotos causar una denegación de servicio (consumo de memoria) o posiblemente tener otro impacto sin especificar a través de paquetes batman-adv ICMP manipulados • http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=b5a1eeef04cc7859f34dec9b72ea1b28e4aba07c http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00005.html http://www.kernel.org/pub/linux/kernel/v3.x/patch-3.3.bz2 http://www.openwall.com/lists/oss-security/2011/12/12/1 https://bugzilla.redhat.com/show_bug.cgi?id=767495 https://github.com/torvalds/linux/commit/b5a1eeef04cc7859f34dec9b72ea1b28e4aba07c https://lists.open-mesh.org/pipermail/b.a.t.m. • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2013-2128 – Kernel: net: oops from tcp_collapse() when using splice(2)
https://notcve.org/view.php?id=CVE-2013-2128
The tcp_read_sock function in net/ipv4/tcp.c in the Linux kernel before 2.6.34 does not properly manage skb consumption, which allows local users to cause a denial of service (system crash) via a crafted splice system call for a TCP socket. La función tcp_read_sock en net/ipv4/tcp.c del kernel de Linux antes de v2.6.34 no gestiona correctamente el consumo skb, lo que permite a usuarios locales causar una denegación de servicios (caída del sistema) a través de la llamada al sistema manipulada splice para un socket TCP. • http://ftp.osuosl.org/pub/linux/kernel/v2.6/ChangeLog-2.6.34 http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=baff42ab1494528907bf4d5870359e31711746ae http://rhn.redhat.com/errata/RHSA-2013-1051.html http://www.openwall.com/lists/oss-security/2013/05/29/11 https://bugzilla.redhat.com/show_bug.cgi?id=968484 https://github.com/torvalds/linux/commit/baff42ab1494528907bf4d5870359e31711746ae https://access.redhat.com/security/cve/CVE-2013-2128 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 2.1EPSS: 0%CPEs: 9EXPL: 1CVE-2013-2141 – Kernel: signal: information leak in tkill/tgkill
https://notcve.org/view.php?id=CVE-2013-2141
The do_tkill function in kernel/signal.c in the Linux kernel before 3.8.9 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory via a crafted application that makes a (1) tkill or (2) tgkill system call. La función do_tkill en kernel/signal.c en el kernel de Linux anterior a v3.8.9 no inicializa cierta estructura de datos, lo que permite a usuarios locales obtener información sensible de la memoria del kernel a través de aplicaciones manipuladas que realizan llamadas al sistema (1) tkill o (2) tgkill. • http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=b9e146d8eb3b9ecae5086d373b50fa0c1f3e7f0f http://lists.opensuse.org/opensuse-updates/2013-12/msg00129.html http://rhn.redhat.com/errata/RHSA-2013-1801.html http://secunia.com/advisories/55055 http://www.debian.org/security/2013/dsa-2766 http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.8.9 http://www.mandriva.com/security/advisories?name=MDVSA-2013:176 http://www.openwall.com/lists/oss-securi • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-399: Resource Management Errors •
CVSS: 4.7EPSS: 0%CPEs: 9EXPL: 1CVE-2013-2146 – Kernel: perf/x86: offcore_rsp valid mask for SNB/IVB
https://notcve.org/view.php?id=CVE-2013-2146
arch/x86/kernel/cpu/perf_event_intel.c in the Linux kernel before 3.8.9, when the Performance Events Subsystem is enabled, specifies an incorrect bitmask, which allows local users to cause a denial of service (general protection fault and system crash) by attempting to set a reserved bit. arch/x86/kernel/cpu/perf_event_intel.c en Linux kernel hasta v3.8.9 cuando Performance Events Subsystem esta habilitado, especifica una máscara de bits correctos, lo que permite a usuarios locales provocar una denegación de servicio (error de protección general y el bloqueo del sistema) al tratar de establecer un bit reservado. • http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=f1923820c447e986a9da0fc6bf60c1dccdf0408e http://rhn.redhat.com/errata/RHSA-2013-1173.html http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.8.9 http://www.mandriva.com/security/advisories?name=MDVSA-2013:176 http://www.openwall.com/lists/oss-security/2013/06/05/23 https://bugzilla.redhat.com/show_bug.cgi?id=971309 https://github.com/torvalds/linux/commit/f1923820c447e986a9da0fc6bf60c1dccdf0408e https:&#x • CWE-20: Improper Input Validation •