CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 1CVE-2017-7533 – Linux Kernel < 3.16.39 (Debian 8 x64) - 'inotfiy' Local Privilege Escalation
https://notcve.org/view.php?id=CVE-2017-7533
Race condition in the fsnotify implementation in the Linux kernel through 4.12.4 allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted application that leverages simultaneous execution of the inotify_handle_event and vfs_rename functions. Una condición de carrera en la implementación de fsnotify en el kernel de Linux hasta la versión 4.12.4, permite a los usuarios locales alcanzar privilegios o causar una denegación de servicio (corrupción de memoria) por medio de una aplicación creada que aprovecha la ejecución simultánea de las funciones inotify_handle_event y vfs_rename. A race condition was found in the Linux kernel, present since v3.14-rc1 through v4.12. The race happens between threads of inotify_handle_event() and vfs_rename() while running the rename operation against the same file. As a result of the race the next slab data or the slab's free list pointer can be corrupted with attacker-controlled data, which may lead to the privilege escalation. • https://www.exploit-db.com/exploits/44302 http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=49d31c2f389acfe83417083e1208422b4091cd9e http://openwall.com/lists/oss-security/2017/08/03/2 http://www.debian.org/security/2017/dsa-3927 http://www.debian.org/security/2017/dsa-3945 http://www.openwall.com/lists/oss-security/2019/06/27/7 http://www.openwall.com/lists/oss-security/2019/06/28/1 http://www.openwall.com/lists/oss-security/2019/06/28& • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-642: External Control of Critical State Data •
CVSS: 7.8EPSS: 0%CPEs: 8EXPL: 0CVE-2017-7541 – kernel: Possible heap buffer overflow in brcmf_cfg80211_mgmt_tx()
https://notcve.org/view.php?id=CVE-2017-7541
The brcmf_cfg80211_mgmt_tx function in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux kernel before 4.12.3 allows local users to cause a denial of service (buffer overflow and system crash) or possibly gain privileges via a crafted NL80211_CMD_FRAME Netlink packet. La función brcmf_cfg80211_mgmt_tx en el archivo drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c en el kernel de Linux anterior a la versión 4.12.3, permite a los usuarios locales causar una denegación de servicio (desbordamiento de búfer y bloqueo del sistema) o posiblemente alcanzar privilegios por medio de un paquete de Netlink NL80211_CMD_FRAME creado. Kernel memory corruption due to a buffer overflow was found in brcmf_cfg80211_mgmt_tx() function in Linux kernels from v3.9-rc1 to v4.13-rc1. The vulnerability can be triggered by sending a crafted NL80211_CMD_FRAME packet via netlink. This flaw is unlikely to be triggered remotely as certain userspace code is needed for this. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8f44c9a41386729fea410e688959ddaa9d51be7c http://openwall.com/lists/oss-security/2017/07/24/2 http://www.debian.org/security/2017/dsa-3927 http://www.debian.org/security/2017/dsa-3945 http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.12.3 http://www.securityfocus.com/bid/99955 http://www.securitytracker.com/id/1038981 https://access.redhat.com/errata/RHSA-2017:2863 https://access.redhat.co • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 7.0EPSS: 0%CPEs: 7EXPL: 0CVE-2017-11600 – kernel: Out-of-bounds access via an XFRM_MSG_MIGRATE xfrm Netlink message
https://notcve.org/view.php?id=CVE-2017-11600
net/xfrm/xfrm_policy.c in the Linux kernel through 4.12.3, when CONFIG_XFRM_MIGRATE is enabled, does not ensure that the dir value of xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which allows local users to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via an XFRM_MSG_MIGRATE xfrm Netlink message. net/xfrm/xfrm_policy.c en el kernel de Linux hasta la versión 4.12.3, cuando se habilita CONFIG_XFRM_MIGRATE, no asegura que el valor dir de xfrm_userpolicy_id sea XFRM_POLICY_MAX o inferior, lo que permite que los usuarios locales provoquen una denegación de servicio (acceso fuera de límites) o, probablemente, causen otros impactos no especificados mediante un mensaje XFRM_MSG_MIGRATE xfrm Netlink. The xfrm_migrate() function in the net/xfrm/xfrm_policy.c file in the Linux kernel built with CONFIG_XFRM_MIGRATE does not verify if the dir parameter is less than XFRM_POLICY_MAX. This allows a local attacker to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact by sending a XFRM_MSG_MIGRATE netlink message. This flaw is present in the Linux kernel since an introduction of XFRM_MSG_MIGRATE in 2.6.21-rc1, up to 4.13-rc3. • http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00007.html http://seclists.org/bugtraq/2017/Jul/30 http://www.debian.org/security/2017/dsa-3981 http://www.securityfocus.com/bid/99928 https://access.redhat.com/errata/RHSA-2018:1965 https://access.redhat.com/errata/RHSA-2018:2003 https://access.redhat.com/errata/RHSA-2019:1170 https://access.redhat.com/errata/RHSA-2019:1190 https://source.android.com/security/bulletin/pixel/2017-11-01 https://access.redh • CWE-125: Out-of-bounds Read •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2017-7542 – kernel: Integer overflow in ip6_find_1stfragopt() causes infinite loop
https://notcve.org/view.php?id=CVE-2017-7542
The ip6_find_1stfragopt function in net/ipv6/output_core.c in the Linux kernel through 4.12.3 allows local users to cause a denial of service (integer overflow and infinite loop) by leveraging the ability to open a raw socket. La función ip6_find_1stfragopt en el archivo net/ipv6/output_core.c en el kernel de Linux hasta la versión 4.12.3, permite a los usuarios locales causar una denegación de servicio (desbordamiento de enteros y bucle infinito) mediante la explotación de la capacidad de abrir un socket sin procesar. An integer overflow vulnerability in ip6_find_1stfragopt() function was found. A local attacker that has privileges (of CAP_NET_RAW) to open raw socket can cause an infinite loop inside the ip6_find_1stfragopt() function. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6399f1fae4ec29fab5ec76070435555e256ca3a6 http://www.debian.org/security/2017/dsa-3927 http://www.debian.org/security/2017/dsa-3945 http://www.securityfocus.com/bid/99953 https://access.redhat.com/errata/RHSA-2017:2918 https://access.redhat.com/errata/RHSA-2017:2930 https://access.redhat.com/errata/RHSA-2017:2931 https://access.redhat.com/errata/RHSA-2018:0169 https://github.com/torvalds/linux/commit/6399f • CWE-190: Integer Overflow or Wraparound CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 7.8EPSS: 0%CPEs: 8EXPL: 0CVE-2017-11473 – kernel: Buffer overflow in mp_override_legacy_irq()
https://notcve.org/view.php?id=CVE-2017-11473
Buffer overflow in the mp_override_legacy_irq() function in arch/x86/kernel/acpi/boot.c in the Linux kernel through 3.2 allows local users to gain privileges via a crafted ACPI table. Desbordamiento de búfer en la función mp_override_legacy_irq() en arch/x86/kernel/acpi/boot.c en el kernel de Linux hasta la versión 3.2 permite que los usuarios locales obtengan privilegios mediante una tabla ACPI manipulada. Buffer overflow in the mp_override_legacy_irq() function in arch/x86/kernel/acpi/boot.c in the Linux kernel through 4.12.2 allows local users to gain privileges via a crafted ACPI table. • http://www.securityfocus.com/bid/100010 https://access.redhat.com/errata/RHSA-2018:0654 https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=70ac67826602edf8c0ccb413e5ba7eacf597a60c https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=96301209473afd3f2f274b91cb7082d161b9be65 https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=dad5ab0db8deac535d03e3fe3d8f2892173fa6a4 https://source.android.com/security/bulletin/pixel/2018-01-01 https://usn.u • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-787: Out-of-bounds Write •