CVSS: 9.3EPSS: 0%CPEs: 5EXPL: 0CVE-2016-9120
https://notcve.org/view.php?id=CVE-2016-9120
Race condition in the ion_ioctl function in drivers/staging/android/ion/ion.c in the Linux kernel before 4.6 allows local users to gain privileges or cause a denial of service (use-after-free) by calling ION_IOC_FREE on two CPUs at the same time. Condición de carrera en la función ion_ioctl en drivers/staging/android/ion/ion.c en el kernel de Linux en versiones anteriores a 4.6 permite a usuarios locales obtener privilegios o provocar una denegación de servicio (uso después de liberación de memoria) llamando a ION_IOC_FREE en dos CPUs al mismo tiempo. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=9590232bb4f4cc824f3425a6e1349afbe6d6d2b7 http://source.android.com/security/bulletin/2016-12-01.html http://www.securityfocus.com/bid/94669 https://github.com/torvalds/linux/commit/9590232bb4f4cc824f3425a6e1349afbe6d6d2b7 • CWE-264: Permissions, Privileges, and Access Controls CWE-416: Use After Free •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2015-8966
https://notcve.org/view.php?id=CVE-2015-8966
arch/arm/kernel/sys_oabi-compat.c in the Linux kernel before 4.4 allows local users to gain privileges via a crafted (1) F_OFD_GETLK, (2) F_OFD_SETLK, or (3) F_OFD_SETLKW command in an fcntl64 system call. arch/arm/kernel/sys_oabi-compat.c en el kernel de Linux en versiones anteriores a 4.4 permite a usuarios locales obtener privilegios a través de un comando (1) F_OFD_GETLK, (2) F_OFD_SETLK o (3) F_OFD_SETLKW manipulado en una llamada de sistema fcntl64. • http://source.android.com/security/bulletin/2016-12-01.html http://www.securityfocus.com/bid/94673 https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=76cc404bfdc0d419c720de4daaf2584542734f42 https://github.com/torvalds/linux/commit/76cc404bfdc0d419c720de4daaf2584542734f42 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.3EPSS: 0%CPEs: 3EXPL: 0CVE-2015-8967
https://notcve.org/view.php?id=CVE-2015-8967
arch/arm64/kernel/sys.c in the Linux kernel before 4.0 allows local users to bypass the "strict page permissions" protection mechanism and modify the system-call table, and consequently gain privileges, by leveraging write access. arch/arm64/kernel/sys.c en el kernel de Linux en versiones anteriores a 4.0 permiten a usuarios locales eludir el mecanismo de protección de "permisos de página estricta" y modificar la tabla de llamadas del sistema, y consecuentemente obtener privilegios, aprovechando el acceso de escritura. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=c623b33b4e9599c6ac5076f7db7369eb9869aa04 http://source.android.com/security/bulletin/2016-12-01.html http://www.securityfocus.com/bid/94680 https://github.com/torvalds/linux/commit/c623b33b4e9599c6ac5076f7db7369eb9869aa04 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.8EPSS: 0%CPEs: 12EXPL: 5CVE-2016-8655 – Linux 4.4.0 < 4.4.0-53 - 'AF_PACKET chocobo_root' Local Privilege Escalation
https://notcve.org/view.php?id=CVE-2016-8655
Race condition in net/packet/af_packet.c in the Linux kernel through 4.8.12 allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging the CAP_NET_RAW capability to change a socket version, related to the packet_set_ring and packet_setsockopt functions. Condición de carrera en net/packet/af_packet.c en el kernel de Linux hasta la versión 4.8.12 permite a usuarios locales obtener privilegios o provocar una denegación de servicio (uso después de liberación de memoria) aprovechando la capacidad CAP_NET_RAW de cambiar una versión socket, relacionado con las funciones packet_set_ring y packet_setsockopt. A race condition issue leading to a use-after-free flaw was found in the way the raw packet sockets implementation in the Linux kernel networking subsystem handled synchronization while creating the TPACKET_V3 ring buffer. A local user able to open a raw packet socket (requires the CAP_NET_RAW capability) could use this flaw to elevate their privileges on the system. • https://www.exploit-db.com/exploits/44696 https://www.exploit-db.com/exploits/40871 https://www.exploit-db.com/exploits/47170 https://github.com/LakshmiDesai/CVE-2016-8655 https://github.com/KosukeShimofuji/CVE-2016-8655 http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=84ac7260236a49c79eede91617700174c2c19b0c http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00044.html http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00054.html http://l • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-416: Use After Free •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2015-8970 – kernel: crypto: GPF in lrw_crypt caused by null-deref
https://notcve.org/view.php?id=CVE-2015-8970
crypto/algif_skcipher.c in the Linux kernel before 4.4.2 does not verify that a setkey operation has been performed on an AF_ALG socket before an accept system call is processed, which allows local users to cause a denial of service (NULL pointer dereference and system crash) via a crafted application that does not supply a key, related to the lrw_crypt function in crypto/lrw.c. crypto/algif_skcipher.c en el kernel Linux en versiones anteriores a 4.4.2 no verifica que una operación setkey haya sido llevada a cabo en un enchufe AF_ALG antes de que una llamada de sistema aceptada sea procesada, lo que permite a usuarios locales provocar una denegación de servicio (referencia a puntero NULO y caída de sistema) a través de una aplicación manipulada que no aporta una llave, relacionado con la función lrw_crypt en crypto/lrw.c. The lrw_crypt() function in 'crypto/lrw.c' in the Linux kernel before 4.5 allows local users to cause a system crash and a denial of service by the NULL pointer dereference via accept(2) system call for AF_ALG socket without calling setkey() first to set a cipher key. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=dd504589577d8e8e70f51f997ad487a4cb6c026f http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.2 http://www.openwall.com/lists/oss-security/2016/11/04/3 http://www.securityfocus.com/bid/94217 https://access.redhat.com/errata/RHSA-2017:1842 https://access.redhat.com/errata/RHSA-2017:2077 https://access.redhat.com/errata/RHSA-2017:2437 https://access.redhat.com/errata/RHSA-2017:2444 https:// • CWE-476: NULL Pointer Dereference •