CVSS: 9.8EPSS: 0%CPEs: 34EXPL: 0CVE-2019-18805 – kernel: integer overflow in tcp_ack_update_rtt in net/ipv4/tcp_input.c
https://notcve.org/view.php?id=CVE-2019-18805
An issue was discovered in net/ipv4/sysctl_net_ipv4.c in the Linux kernel before 5.0.11. There is a net/ipv4/tcp_input.c signed integer overflow in tcp_ack_update_rtt() when userspace writes a very large integer to /proc/sys/net/ipv4/tcp_min_rtt_wlen, leading to a denial of service or possibly unspecified other impact, aka CID-19fad20d15a6. Se detectó un problema en el archivo net/ipv4/sysctl_net_ipv4.c en el kernel de Linux versiones anteriores a 5.0.11. Se presenta un desbordamiento de enteros firmado del archivo net/ipv4/tcp_input.c en la función tcp_ack_update_rtt() cuando el espacio de usuario escribe un entero muy grande en /proc/sys/net/ipv4/tcp_min_rtt_wlen, lo que conlleva a una denegación de servicio o posiblemente a otro impacto no especificado, también se conoce como CID -19fad20d15a6. A flaw was reported in the Linux kernel's TCP subsystem while calculating a packet round trip time, when a sysctl parameter (/proc/sys/net/ipv4/tcp_min_rtt_wlen) is set incorrectly. • http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00035.html http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00039.html https://access.redhat.com/errata/RHSA-2020:0740 https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.0.11 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=19fad20d15a6494f47f85d869f00b11343ee5c78 https://security.netapp.com/advisory/ntap-20191205-0001 https://access.redhat.com/security/cve/CVE-2019-18805 https: • CWE-190: Integer Overflow or Wraparound •
CVSS: 9.1EPSS: 0%CPEs: 2EXPL: 0CVE-2014-3180
https://notcve.org/view.php?id=CVE-2014-3180
In kernel/compat.c in the Linux kernel before 3.17, as used in Google Chrome OS and other products, there is a possible out-of-bounds read. restart_syscall uses uninitialized data when restarting compat_sys_nanosleep. NOTE: this is disputed because the code path is unreachable ** EN DISPUTA ** En el archivo kernel/compat.c en el kernel de Linux versiones anteriores a la versión 3.17, como es usado en Google Chrome OS y otros productos, se presenta una posible lectura fuera de límites. restart_syscall utiliza datos no inicializados al reiniciar compat_sys_nanosleep. NOTA: esto se disputa porque la ruta del código no es accesible. • https://bugs.chromium.org/p/chromium/issues/detail?id=408827 https://lkml.org/lkml/2014/9/7/29 • CWE-125: Out-of-bounds Read •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2019-18786
https://notcve.org/view.php?id=CVE-2019-18786
In the Linux kernel through 5.3.8, f->fmt.sdr.reserved is uninitialized in rcar_drif_g_fmt_sdr_cap in drivers/media/platform/rcar_drif.c, which could cause a memory disclosure problem. En el kernel de Linux versiones hasta 5.3.8, f->fmt.sdr.reserved no se inicializa en la función rcar_drif_g_fmt_sdr_cap en el archivo drivers/media/platform/rcar_drif.c, lo que podría causar un problema de divulgación de memoria. • https://patchwork.linuxtv.org/patch/59542 https://usn.ubuntu.com/4284-1 https://usn.ubuntu.com/4285-1 https://usn.ubuntu.com/4287-1 https://usn.ubuntu.com/4287-2 • CWE-908: Use of Uninitialized Resource •
CVSS: 7.0EPSS: 0%CPEs: 31EXPL: 3CVE-2019-18683
https://notcve.org/view.php?id=CVE-2019-18683
An issue was discovered in drivers/media/platform/vivid in the Linux kernel through 5.3.8. It is exploitable for privilege escalation on some Linux distributions where local users have /dev/video0 access, but only if the driver happens to be loaded. There are multiple race conditions during streaming stopping in this driver (part of the V4L2 subsystem). These issues are caused by wrong mutex locking in vivid_stop_generating_vid_cap(), vivid_stop_generating_vid_out(), sdr_cap_stop_streaming(), and the corresponding kthreads. At least one of these race conditions leads to a use-after-free. • https://github.com/sanjana123-cloud/CVE-2019-18683 http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00029.html http://packetstormsecurity.com/files/155890/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html http://www.openwall.com/lists/oss-security/2019/11/05/1 https://lists.debian.org/debian-lts-announce/2020/03/msg00001.html https://lore.kernel.org/lkml/20191103221719.27118-1-alex.popov%40linux.com https://seclists.org/bugtraq/2020/Jan/10 https://security.net • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-416: Use After Free •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 2CVE-2019-18680
https://notcve.org/view.php?id=CVE-2019-18680
An issue was discovered in the Linux kernel 4.4.x before 4.4.195. There is a NULL pointer dereference in rds_tcp_kill_sock() in net/rds/tcp.c that will cause denial of service, aka CID-91573ae4aed0. Se detectó un problema en el kernel de Linux versiones 4.4.x anteriores a 4.4.195. Se presenta una desreferencia del puntero NULL en la función rds_tcp_kill_sock() en el archivo net/rds/tcp.c que causará una denegación de servicio, también se conoce como CID-91573ae4aed0. • https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.195 https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=91573ae4aed0a49660abdad4d42f2a0db995ee5e https://github.com/torvalds/linux/commit/91573ae4aed0a49660abdad4d42f2a0db995ee5e https://lkml.org/lkml/2019/9/18/337 https://security.netapp.com/advisory/ntap-20191205-0001 • CWE-476: NULL Pointer Dereference •