CVSS: 5.5EPSS: 0%CPEs: 7EXPL: 0CVE-2022-0264
https://notcve.org/view.php?id=CVE-2022-0264
A vulnerability was found in the Linux kernel's eBPF verifier when handling internal data structures. Internal memory locations could be returned to userspace. A local attacker with the permissions to insert eBPF code to the kernel can use this to leak internal kernel memory details defeating some of the exploit mitigations in place for the kernel. This flaws affects kernel versions < v5.16-rc6 Se encontró una vulnerabilidad en el verificador eBPF del kernel de Linux cuando son manejados estructuras de datos internas. Las ubicaciones de memoria interna podían ser devueltas al espacio de usuario. • https://bugzilla.redhat.com/show_bug.cgi?id=2041547 • CWE-755: Improper Handling of Exceptional Conditions •
CVSS: 7.8EPSS: 0%CPEs: 20EXPL: 2CVE-2022-24122
https://notcve.org/view.php?id=CVE-2022-24122
kernel/ucount.c in the Linux kernel 5.14 through 5.16.4, when unprivileged user namespaces are enabled, allows a use-after-free and privilege escalation because a ucounts object can outlive its namespace. El archivo kernel/ucount.c en el kernel de Linux versiones 5.14 hasta 5.16.4, cuando los espacios de nombres de los usuarios no privilegiados están habilitados, permite un uso de memoria previamente liberada y una escalada de privilegios porque un objeto ucounts puede sobrevivir a su espacio de nombres • https://github.com/meowmeowxw/CVE-2022-24122 https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f9d87929d451d3e649699d0f1d74f71f77ad38f5 https://github.com/torvalds/linux/commit/f9d87929d451d3e649699d0f1d74f71f77ad38f5 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSR3AI2IQGRKZCHNKF6S25JGDKUEAWWL https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VVSZKUJAZ2VN6LJ35J2B6YD6BOPQTU3B https://security.netapp.com/advisory/ntap-20220221-0001 htt • CWE-416: Use After Free •
CVSS: 8.4EPSS: 0%CPEs: 20EXPL: 7CVE-2022-0185 – Linux Kernel Heap-Based Buffer Overflow Vulnerability
https://notcve.org/view.php?id=CVE-2022-0185
A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functionality of the Linux kernel verified the supplied parameters length. An unprivileged (in case of unprivileged user namespaces enabled, otherwise needs namespaced CAP_SYS_ADMIN privilege) local user able to open a filesystem that does not support the Filesystem Context API (and thus fallbacks to legacy handling) could use this flaw to escalate their privileges on the system. Se ha encontrado un fallo de desbordamiento de búfer en la región heap de la memoria en la forma en que la función legacy_parse_param de la funcionalidad Filesystem Context del kernel de Linux verifica la longitud de los parámetros suministrados. Un usuario local no privilegiado (en caso de tener habilitados los espacios de nombres de usuario no privilegiado, de lo contrario necesita el privilegio CAP_SYS_ADMIN) capaz de abrir un sistema de archivos que no soporta la API Filesystem Context (y por lo tanto los fallbacks a la administración de legado) podría usar este fallo para escalar sus privilegios en el sistema Linux kernel contains a heap-based buffer overflow vulnerability in the legacy_parse_param function in the Filesystem Context functionality. This allows an attacker to open a filesystem that does not support the Filesystem Context API and ultimately escalate privileges. • https://github.com/Crusaders-of-Rust/CVE-2022-0185 https://github.com/chenaotian/CVE-2022-0185 https://github.com/veritas501/CVE-2022-0185-PipeVersion https://github.com/featherL/CVE-2022-0185-exploit https://github.com/dcheng69/CVE-2022-0185-Case-Study https://github.com/khaclep007/CVE-2022-0185 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=722d94847de2 https://security.netapp.com/advisory/ntap-20220225-0003 https://www.openwall.com/lists/o • CWE-190: Integer Overflow or Wraparound CWE-191: Integer Underflow (Wrap or Wraparound) •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-4155 – kernel: xfs: raw block device data leak in XFS_IOC_ALLOCSP IOCTL
https://notcve.org/view.php?id=CVE-2021-4155
A data leak flaw was found in the way XFS_IOC_ALLOCSP IOCTL in the XFS filesystem allowed for size increase of files with unaligned size. A local attacker could use this flaw to leak data on the XFS filesystem otherwise not accessible to them. Se encontró un fallo de filtrado de datos en la forma en que XFS_IOC_ALLOCSP IOCTL en el sistema de archivos XFS permitía aumentar el tamaño de los archivos con un tamaño no alineado. Un atacante local podría usar este fallo para filtrar datos en el sistema de archivos XFS que de otro modo no serían accesibles. • https://access.redhat.com/security/cve/CVE-2021-4155 https://bugzilla.redhat.com/show_bug.cgi?id=2034813 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=983d8e60f50806f90534cc5373d0ce867e5aaf79 https://security-tracker.debian.org/tracker/CVE-2021-4155 https://www.openwall.com/lists/oss-security/2022/01/10/1 • CWE-131: Incorrect Calculation of Buffer Size •
CVSS: 7.8EPSS: 0%CPEs: 21EXPL: 4CVE-2022-23222 – kernel: local privileges escalation in kernel/bpf/verifier.c
https://notcve.org/view.php?id=CVE-2022-23222
kernel/bpf/verifier.c in the Linux kernel through 5.15.14 allows local users to gain privileges because of the availability of pointer arithmetic via certain *_OR_NULL pointer types. El archivo kernel/bpf/verifier.c en el kernel de Linux versiones hasta 5.15.14, permite a usuarios locales alcanzar privilegios debido a una disponibilidad de la aritmética de punteros por medio de determinados tipos de punteros *_OR_NULL A flaw was found in the Linux kernel's adjust_ptr_min_max_vals in the kernel/bpf/verifier.c function. In this flaw, a missing sanity check for *_OR_NULL pointer types that perform pointer arithmetic may cause a kernel information leak issue. • https://github.com/tr3ee/CVE-2022-23222 https://github.com/PenteraIO/CVE-2022-23222-POC https://github.com/FridayOrtiz/CVE-2022-23222 http://www.openwall.com/lists/oss-security/2022/01/14/1 http://www.openwall.com/lists/oss-security/2022/01/18/2 http://www.openwall.com/lists/oss-security/2022/06/01/1 http://www.openwall.com/lists/oss-security/2022/06/04/3 http://www.openwall.com/lists/oss-security/2022/06/07/3 https://bugzilla.suse.com/show_ • CWE-476: NULL Pointer Dereference CWE-763: Release of Invalid Pointer or Reference •