CVSS: 7.0EPSS: 0%CPEs: 4EXPL: 0CVE-2016-6786
https://notcve.org/view.php?id=CVE-2016-6786
kernel/events/core.c in the performance subsystem in the Linux kernel before 4.0 mismanages locks during certain migrations, which allows local users to gain privileges via a crafted application, aka Android internal bug 30955111. kernel/events/core.c en el subsistema de rendimiento en el kernel de Linux en versiones anteriores a 4.0 no gestiona adecuadamente bloqueos durante ciertas migraciones, lo que permite a usuarios locales obtener privilegios a través de una aplicación manipulada, vulnerabilidad también conocida como error interno 30955111. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f63a8daa5812afef4f06c962351687e1ff9ccb2b http://source.android.com/security/bulletin/2016-12-01.html http://www.debian.org/security/2017/dsa-3791 http://www.securityfocus.com/bid/94679 https://bugzilla.redhat.com/show_bug.cgi?id=1403842 https://github.com/torvalds/linux/commit/f63a8daa5812afef4f06c962351687e1ff9ccb2b • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2016-9755
https://notcve.org/view.php?id=CVE-2016-9755
The netfilter subsystem in the Linux kernel before 4.9 mishandles IPv6 reassembly, which allows local users to cause a denial of service (integer overflow, out-of-bounds write, and GPF) or possibly have unspecified other impact via a crafted application that makes socket, connect, and writev system calls, related to net/ipv6/netfilter/nf_conntrack_reasm.c and net/ipv6/netfilter/nf_defrag_ipv6_hooks.c. El subsistema netfilter en el kernel de Linux en versiones anteriores a 4.9 no maneja adecuadamente reensamblaje IPv6, lo que permite a usuarios locales provocar una denegación de servicio (desbordamiento de entero, escritura fuera de límites y GPF) o posiblemente tener otro impacto no especificado a través de una aplicación manipulada que hace un socket, conecta y escribe llamadas al sistema, relacionado con net/ipv6/netfilter/nf_conntrack_reasm.c y net/ipv6/netfilter/nf_defrag_ipv6_hooks.c. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=9b57da0630c9fd36ed7a20fc0f98dc82cc0777fa http://www.openwall.com/lists/oss-security/2016/12/01/10 http://www.securityfocus.com/bid/94626 https://bugzilla.redhat.com/show_bug.cgi?id=1400904 https://github.com/torvalds/linux/commit/9b57da0630c9fd36ed7a20fc0f98dc82cc0777fa https://groups.google.com/forum/#%21topic/syzkaller/GFbGpX7nTEo https://www.spinics.net/lists/netdev/msg407525.html • CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 1CVE-2016-9793 – Linux Kernel 3.11 < 4.8 0 - 'SO_SNDBUFFORCE' / 'SO_RCVBUFFORCE' Local Privilege Escalation
https://notcve.org/view.php?id=CVE-2016-9793
The sock_setsockopt function in net/core/sock.c in the Linux kernel before 4.8.14 mishandles negative values of sk_sndbuf and sk_rcvbuf, which allows local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact by leveraging the CAP_NET_ADMIN capability for a crafted setsockopt system call with the (1) SO_SNDBUFFORCE or (2) SO_RCVBUFFORCE option. La función sock_setsockopt en net/core/sock.c en el kernel de Linux en versiones anteriores a 4.8.14 no maneja adecuadamente valores negativos de sk_sndbuf y sk_rcvbuf, lo que permite a usuarios locales provocar una denegación de servicio (corrupción de memoria y caída del sistema) o posiblemente tener otros impactos no especificados aprovechando la capacidad CAP_NET_ADMIN para una llamada al sistema setsockopt manipulada con la opción (1) SO_SNDBUFFORCE o (2) SO_RCVBUFFORCE. A flaw was found in the Linux kernel's implementation of setsockopt for the SO_{SND|RCV}BUFFORCE setsockopt() system call. Users with non-namespace CAP_NET_ADMIN are able to trigger this call and create a situation in which the sockets sendbuff data size could be negative. This could adversely affect memory allocations and create situations where the system could crash or cause memory corruption. • https://www.exploit-db.com/exploits/41995 http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b98b0bc8c431e3ceb4b26b0dfc8db509518fb290 http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.8.14 http://www.openwall.com/lists/oss-security/2016/12/03/1 http://www.securityfocus.com/bid/94655 http://www.securitytracker.com/id/1037968 https://access.redhat.com/errata/RHSA-2017:0931 https://access.redhat.com/errata/RHSA-2017:0932 https://access.redhat. • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-190: Integer Overflow or Wraparound •
CVSS: 4.7EPSS: 0%CPEs: 1EXPL: 0CVE-2016-6213 – kernel: Overflowing kernel mount table using shared bind mount
https://notcve.org/view.php?id=CVE-2016-6213
fs/namespace.c in the Linux kernel before 4.9 does not restrict how many mounts may exist in a mount namespace, which allows local users to cause a denial of service (memory consumption and deadlock) via MS_BIND mount system calls, as demonstrated by a loop that triggers exponential growth in the number of mounts. fs/namespace.c en el kernel de Linux en versiones anteriores a 4.9 no restringe la cantidad de montajes que pueden existir en un espacio de nombre del montaje, lo que permite a usuarios locales provocar una denegación de servicio (consumo de memoria y punto muerto) a través de llamadas al sistema de montaje MS_BIND, según lo demostrado por un bucle que desencadena un crecimiento exponencial en el número de montajes. It was found that in Linux kernel the mount table expands by a power-of-two with each bind mount command. If a system is configured to allow non-privileged user to do bind mounts, or allows to do so in a container or unprivileged mount namespace, then non-privileged user is able to cause a local DoS by overflowing the mount table, which causes a deadlock for the whole system. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=d29216842a85c7970c536108e093963f02714498 http://www.openwall.com/lists/oss-security/2016/07/13/8 http://www.securityfocus.com/bid/91754 https://access.redhat.com/errata/RHSA-2017:1842 https://access.redhat.com/errata/RHSA-2017:2077 https://bugzilla.redhat.com/show_bug.cgi?id=1356471 https://github.com/torvalds/linux/commit/d29216842a85c7970c536108e093963f02714498 https://access.redhat.com/security/cve/CVE-2016-6213 • CWE-400: Uncontrolled Resource Consumption CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 9.3EPSS: 0%CPEs: 3EXPL: 0CVE-2015-8967
https://notcve.org/view.php?id=CVE-2015-8967
arch/arm64/kernel/sys.c in the Linux kernel before 4.0 allows local users to bypass the "strict page permissions" protection mechanism and modify the system-call table, and consequently gain privileges, by leveraging write access. arch/arm64/kernel/sys.c en el kernel de Linux en versiones anteriores a 4.0 permiten a usuarios locales eludir el mecanismo de protección de "permisos de página estricta" y modificar la tabla de llamadas del sistema, y consecuentemente obtener privilegios, aprovechando el acceso de escritura. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=c623b33b4e9599c6ac5076f7db7369eb9869aa04 http://source.android.com/security/bulletin/2016-12-01.html http://www.securityfocus.com/bid/94680 https://github.com/torvalds/linux/commit/c623b33b4e9599c6ac5076f7db7369eb9869aa04 • CWE-264: Permissions, Privileges, and Access Controls •