CVSS: 7.8EPSS: 0%CPEs: 7EXPL: 0CVE-2018-19824 – kernel: Use-after-free in sound/usb/card.c:usb_audio_probe()
https://notcve.org/view.php?id=CVE-2018-19824
In the Linux kernel through 4.19.6, a local user could exploit a use-after-free in the ALSA driver by supplying a malicious USB Sound device (with zero interfaces) that is mishandled in usb_audio_probe in sound/usb/card.c. En el kernel de Linux hasta la versión 4.19.6, un usuario local podría explotar memoria previamente liberada en el controlador ALSA suministrando un dispositivo de sonido USB malicioso (con cero interfaces) que no se maneja correctamente en usb_audio_probe en sound/usb/card.c. A flaw was found In the Linux kernel, through version 4.19.6, where a local user could exploit a use-after-free in the ALSA driver by supplying a malicious USB Sound device (with zero interfaces) that is mishandled in usb_audio_probe in sound/usb/card.c. An attacker could corrupt memory and possibly escalate privileges if the attacker is able to have physical access to the system. • http://www.securityfocus.com/bid/106109 https://access.redhat.com/errata/RHSA-2019:2703 https://bugzilla.suse.com/show_bug.cgi?id=1118152 https://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound.git/commit/?id=5f8cf712582617d523120df67d392059eaf2fc4b https://github.com/torvalds/linux/commit/5f8cf712582617d523120df67d392059eaf2fc4b https://lists.debian.org/debian-lts-announce/2019/03/msg00034.html https://lists.debian.org/debian-lts-announce/2019/04/msg00004.html https://lists.debian.org/debian- • CWE-416: Use After Free •
CVSS: 5.5EPSS: 0%CPEs: 15EXPL: 0CVE-2018-14646 – kernel: NULL pointer dereference in af_netlink.c:__netlink_ns_capable() allows for denial of service
https://notcve.org/view.php?id=CVE-2018-14646
The Linux kernel before 4.15-rc8 was found to be vulnerable to a NULL pointer dereference bug in the __netlink_ns_capable() function in the net/netlink/af_netlink.c file. A local attacker could exploit this when a net namespace with a netnsid is assigned to cause a kernel panic and a denial of service. El kernel de Linux en versiones anteriores a la 4.15-rc8 era vulnerable a un error de desreferencia de puntero NULL en la función __netlink_ns_capable() en el archivo net/netlink/af_netlink.c. Un atacante local podría explotarlo cuando un espacio de nombres de red con un netnsid se asigne para provocar un kernel de pánico y ataque de denegación de servicio (DoS). The Linux kernel was found to be vulnerable to a NULL pointer dereference bug in the __netlink_ns_capable() function in the net/netlink/af_netlink.c file. • https://access.redhat.com/errata/RHSA-2018:3651 https://access.redhat.com/errata/RHSA-2018:3666 https://access.redhat.com/errata/RHSA-2018:3843 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14646 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f428fe4a04cc339166c8bbd489789760de3a0cee https://marc.info/?l=linux-netdev&m=151500466401174&w=2 https://access.redhat.com/security/cve/CVE-2018-14646 https://bugzilla.redhat.com/show_bug.cgi?id=1630124 • CWE-476: NULL Pointer Dereference •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2018-19407
https://notcve.org/view.php?id=CVE-2018-19407
The vcpu_scan_ioapic function in arch/x86/kvm/x86.c in the Linux kernel through 4.19.2 allows local users to cause a denial of service (NULL pointer dereference and BUG) via crafted system calls that reach a situation where ioapic is uninitialized. La función vcpu_scan_ioapic en arch/x86/kvm/x86.c en el kernel de Linux hasta la versión 4.19.2 permite que usuarios locales provoquen una denegación de servicio (desreferencia de puntero NULLy error) mediante llamadas del sistema manipuladas que alcanzan una situación donde ioapic no está inicializado. • http://www.securityfocus.com/bid/105987 https://lists.debian.org/debian-lts-announce/2019/03/msg00017.html https://lkml.org/lkml/2018/11/20/580 https://usn.ubuntu.com/3871-1 https://usn.ubuntu.com/3871-3 https://usn.ubuntu.com/3871-4 https://usn.ubuntu.com/3871-5 https://usn.ubuntu.com/3872-1 https://usn.ubuntu.com/3878-1 https://usn.ubuntu.com/3878-2 https://usn.ubuntu.com/3879-1 https://usn.ubuntu.com/3879-2 • CWE-476: NULL Pointer Dereference •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-19406
https://notcve.org/view.php?id=CVE-2018-19406
kvm_pv_send_ipi in arch/x86/kvm/lapic.c in the Linux kernel through 4.19.2 allows local users to cause a denial of service (NULL pointer dereference and BUG) via crafted system calls that reach a situation where the apic map is uninitialized. kvm_pv_send_ipi en arch/x86/kvm/lapic.c en el kernel de Linux hasta la versión 4.19.2 permite que usuarios locales provoquen una denegación de servicio (desreferencia de puntero NULL) mediante llamadas del sistema manipuladas que alcanzan una situación donde el mapa apic no está inicializado. • http://www.securityfocus.com/bid/105988 https://lkml.org/lkml/2018/11/20/411 • CWE-476: NULL Pointer Dereference •
CVSS: 7.0EPSS: 0%CPEs: 4EXPL: 7CVE-2018-18955 – Linux - Nested User Namespace idmap Limit Local Privilege Escalation
https://notcve.org/view.php?id=CVE-2018-18955
In the Linux kernel 4.15.x through 4.19.x before 4.19.2, map_write() in kernel/user_namespace.c allows privilege escalation because it mishandles nested user namespaces with more than 5 UID or GID ranges. A user who has CAP_SYS_ADMIN in an affected user namespace can bypass access controls on resources outside the namespace, as demonstrated by reading /etc/shadow. This occurs because an ID transformation takes place properly for the namespaced-to-kernel direction but not for the kernel-to-namespaced direction. En el kernel de Linux, de las versiones 4.15.x hasta las 4.19.x anteriores a la 4.19.2, map_write() en kernel/user_namespace.c permite el escalado de privilegios debido a que gestiona incorrectamente los espacios de nombre de usuario anidados con más de 5 rangos UID o GID. Un usuario que tenga CAP_SYS_ADMIN en un espacio de nombre de usuario afectado puede omitir los controles de acceso en los recursos fuera del espacio de nombre, tal y como queda demostrado con la lectura de /etc/shadow. • https://www.exploit-db.com/exploits/45915 https://www.exploit-db.com/exploits/45886 https://www.exploit-db.com/exploits/47166 https://www.exploit-db.com/exploits/47165 https://www.exploit-db.com/exploits/47167 https://www.exploit-db.com/exploits/47164 https://github.com/scheatkode/CVE-2018-18955 http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=d2f007dbe7e4c9583eea6eb04d60001e85c6f1bd http://www.securityfocus.com/bid/105941 https://bugs.chromium.org/p • CWE-863: Incorrect Authorization •