CVSS: 6.6EPSS: 0%CPEs: 110EXPL: 0CVE-2017-7273
https://notcve.org/view.php?id=CVE-2017-7273
The cp_report_fixup function in drivers/hid/hid-cypress.c in the Linux kernel 3.2 and 4.x before 4.9.4 allows physically proximate attackers to cause a denial of service (integer underflow) or possibly have unspecified other impact via a crafted HID report. La función cp_report_fixup en drivers/hid/hid-cypress.c en el kernel de Linux 3.2 y 4.x en versiones anteriores a 4.9.4 permite a atacantes físicamente próximos provocar una denegación de servicio (desbordamiento inferior de entero) o posiblemente tener otro impacto no especificado a través de un reporte HID manipulado • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=1ebb71143758f45dc0fa76e2f48429e13b16d110 http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4faec4a2ef5dd481682cc155cb9ea14ba2534b76 http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.4 http://www.securityfocus.com/bid/97190 https://github.com/torvalds/linux/commit/1ebb71143758f45dc0fa76e2f48429e13b16d110 •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2017-7261
https://notcve.org/view.php?id=CVE-2017-7261
The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel through 4.10.5 does not check for a zero value of certain levels data, which allows local users to cause a denial of service (ZERO_SIZE_PTR dereference, and GPF and possibly panic) via a crafted ioctl call for a /dev/dri/renderD* device. La función vmw_surface_define_ioctl en drivers/gpu/drm/vmwgfx/vmwgfx_surface.c en el kernel de Linux hasta la versión 4.10.5 no verifica el valor cero de ciertos niveles de datos, lo que permite a los usuarios locales provocar una denegación de servicio (referencia ZERO_SIZE_PTR y GPF y posiblemente pánico) a través de una llamada ioctl manipulada para un dispositivo /dev/dri/renderD*. • http://marc.info/?t=149037004200005&r=1&w=2 http://www.securityfocus.com/bid/97096 https://bugzilla.redhat.com/show_bug.cgi?id=1435719 https://lists.freedesktop.org/archives/dri-devel/2017-March/136814.html • CWE-20: Improper Input Validation •
CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 0CVE-2017-7187 – kernel: scsi: Stack-based buffer overflow in sg_ioctl function
https://notcve.org/view.php?id=CVE-2017-7187
The sg_ioctl function in drivers/scsi/sg.c in the Linux kernel through 4.10.4 allows local users to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a large command size in an SG_NEXT_CMD_LEN ioctl call, leading to out-of-bounds write access in the sg_write function. La función sg_ioctl en drivers/scsi/sg.c en el kernel de Linux hasta la versión 4.10.4 permite a usuarios locales provocar una denegación de servicio (desbordamiento de búfer basado en pila) o posiblemente tener otro impacto no especificado a través de un gran tamaño de comando en una llamada SG_NEXT_CMD_LEN ioctl, conduciendo a acceso de escritura fuera de límites en la función sg_write. The sg_ioctl function in drivers/scsi/sg.c in the Linux kernel allows local users to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impacts via a large command size in an SG_NEXT_CMD_LEN ioctl call, leading to out-of-bounds write access in the sg_write function. • http://www.securityfocus.com/bid/96989 http://www.securitytracker.com/id/1038086 https://access.redhat.com/errata/RHSA-2017:1842 https://access.redhat.com/errata/RHSA-2017:2077 https://access.redhat.com/errata/RHSA-2017:2669 https://gist.github.com/dvyukov/48ad14e84de45b0be92b7f0eda20ff1b https://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git/commit/?h=4.11/scsi-fixes&id=bf33f87dd04c371ea33feb821b60d63d754e3124 https://source.android.com/security/bulletin/pixel/2017-10-01 https:/&#x • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-121: Stack-based Buffer Overflow •
CVSS: 7.8EPSS: 0%CPEs: 11EXPL: 0CVE-2017-7184 – Linux Kernel XFRM Out-Of-Bounds Access Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2017-7184
The xfrm_replay_verify_len function in net/xfrm/xfrm_user.c in the Linux kernel through 4.10.6 does not validate certain size data after an XFRM_MSG_NEWAE update, which allows local users to obtain root privileges or cause a denial of service (heap-based out-of-bounds access) by leveraging the CAP_NET_ADMIN capability, as demonstrated during a Pwn2Own competition at CanSecWest 2017 for the Ubuntu 16.10 linux-image-* package 4.8.0.41.52. La función xfrm_replay_verify_len en net/xfrm/xfrm_user.c en el kernel de Linux hasta la versión 4.10.6 no valida ciertos datos de tamaño después de una actualización XFRM_MSG_NEWAE, lo que permite a usuarios locales obtener privilegios de root o provocar una denegación de servicio (acceso fuera de límites basado en memoria dinámica) aprovechando la capacidad CAP_NET_ADMIN, como se demostró durante una competición Pwn2Own en CanSecWest 2017 para el paquete Ubuntu 16.10 linux-image-* 4.8.0.41.52. Out-of-bounds kernel heap access vulnerability was found in xfrm, kernel's IP framework for transforming packets. An error dealing with netlink messages from an unprivileged user leads to arbitrary read/write and privilege escalation. This vulnerability allows local attackers to execute arbitrary code on vulnerable installations of the Linux Kernel. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=677e806da4d916052585301785d847c3b3e6186a http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f843ee6dd019bcece3e74e76ad9df0155655d0df http://openwall.com/lists/oss-security/2017/03/29/2 http://www.eweek.com/security/ubuntu-linux-falls-on-day-1-of-pwn2own-hacking-competition http://www.securityfocus.com/bid/97018 http://www.securitytracker.com/id/1038166 https://access.redhat.com/errata/RHSA-2017:2918 • CWE-122: Heap-based Buffer Overflow •
CVSS: 7.8EPSS: 0%CPEs: 10EXPL: 0CVE-2017-2636 – kernel: Race condition access to n_hdlc.tbuf causes double free in n_hdlc_release()
https://notcve.org/view.php?id=CVE-2017-2636
Race condition in drivers/tty/n_hdlc.c in the Linux kernel through 4.10.1 allows local users to gain privileges or cause a denial of service (double free) by setting the HDLC line discipline. Condición de carrera en drivers/tty/n_hdlc.c en el kernel de Linux hasta la versión 4.10.1 permite a usuarios locales obtener privilegios o provocar una denegación de servicio (liberación doble) ajustando la línea de disciplina HDLC. A race condition flaw was found in the N_HLDC Linux kernel driver when accessing n_hdlc.tbuf list that can lead to double free. A local, unprivileged user able to set the HDLC line discipline on the tty device could use this flaw to increase their privileges on the system. • http://www.debian.org/security/2017/dsa-3804 http://www.openwall.com/lists/oss-security/2017/03/07/6 http://www.securityfocus.com/bid/96732 http://www.securitytracker.com/id/1037963 https://a13xp0p0v.github.io/2017/03/24/CVE-2017-2636.html https://access.redhat.com/errata/RHSA-2017:0892 https://access.redhat.com/errata/RHSA-2017:0931 https://access.redhat.com/errata/RHSA-2017:0932 https://access.redhat.com/errata/RHSA-2017:0933 https://access.redhat.com/erra • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-415: Double Free •