CVSS: 4.4EPSS: 0%CPEs: 1EXPL: 0CVE-2016-7097 – kernel: Setting a POSIX ACL via setxattr doesn't clear the setgid bit
https://notcve.org/view.php?id=CVE-2016-7097
The filesystem implementation in the Linux kernel through 4.8.2 preserves the setgid bit during a setxattr call, which allows local users to gain group privileges by leveraging the existence of a setgid program with restrictions on execute permissions. La implementación del sistema de archivos en el kernel de Linux hasta la versión 4.8.2 preserva el bit setgid durante una llamada setxattr, lo que permite a usuarios locales obtener privilegios de grupo aprovechando la existencia de un programa setgid con restricciones en permisos de ejecución. It was found that when file permissions were modified via chmod and the user modifying them was not in the owning group or capable of CAP_FSETID, the setgid bit would be cleared. Setting a POSIX ACL via setxattr sets the file permissions as well as the new ACL, but doesn't clear the setgid bit in a similar way. This could allow a local user to gain group privileges via certain setgid applications. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=073931017b49d9458aa351605b43a7e34598caef http://marc.info/?l=linux-fsdevel&m=147162313630259&w=2 http://rhn.redhat.com/errata/RHSA-2017-0817.html http://www.openwall.com/lists/oss-security/2016/08/26/3 http://www.securityfocus.com/bid/92659 http://www.securitytracker.com/id/1038201 http://www.spinics.net/lists/linux-fsdevel/msg98328.html http://www.ubuntu.com/usn/USN-3146-1 http://www.ubuntu.com • CWE-285: Improper Authorization CWE-287: Improper Authentication •
CVSS: 7.8EPSS: 0%CPEs: 13EXPL: 0CVE-2016-7425
https://notcve.org/view.php?id=CVE-2016-7425
The arcmsr_iop_message_xfer function in drivers/scsi/arcmsr/arcmsr_hba.c in the Linux kernel through 4.8.2 does not restrict a certain length field, which allows local users to gain privileges or cause a denial of service (heap-based buffer overflow) via an ARCMSR_MESSAGE_WRITE_WQBUFFER control code. La función arcmsr_iop_message_xfer en drivers/scsi/arcmsr/arcmsr_hba.c en el kernel de Linux hasta la versión 4.8.2 no restringe una cierta longitud de campo, lo que permite a usuarios locales obtener privilegios o provocar una denegación de servicio (desbordamiento de búfer basado en memoria dinámica) a través de un código de control ARCMSR_MESSAGE_WRITE_WQBUFFER. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=7bc2b55a5c030685b399bb65b6baa9ccc3d1f167 http://marc.info/?l=linux-scsi&m=147394713328707&w=2 http://marc.info/?l=linux-scsi&m=147394796228991&w=2 http://www.openwall.com/lists/oss-security/2016/09/17/2 http://www.securityfocus.com/bid/93037 http://www.ubuntu.com/usn/USN-3144-1 http://www.ubuntu.com/usn/USN-3144-2 http://www.ubuntu.com/usn/USN-3145-1 http://www.ubuntu.com/usn/ • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2016-6327 – kernel: infiniband: Kernel crash by sending ABORT_TASK command
https://notcve.org/view.php?id=CVE-2016-6327
drivers/infiniband/ulp/srpt/ib_srpt.c in the Linux kernel before 4.5.1 allows local users to cause a denial of service (NULL pointer dereference and system crash) by using an ABORT_TASK command to abort a device write operation. drivers/infiniband/ulp/srpt/ib_srpt.c en el kernel de Linux en versiones anteriores a 4.5.1 permite a usuarios locales provocar una denegación de servicio (referencia a puntero NULL y caída de sistema) usando un comando ABORT_TASK para abortar una operación de escritura de dispositivo. System using the infiniband support module ib_srpt were vulnerable to a denial of service by system crash by a local attacker who is able to abort writes to a device using this initiator. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=51093254bf879bc9ce96590400a87897c7498463 http://rhn.redhat.com/errata/RHSA-2016-2574.html http://rhn.redhat.com/errata/RHSA-2016-2584.html http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.5.1 http://www.openwall.com/lists/oss-security/2016/08/19/5 http://www.securityfocus.com/bid/92549 https://bugzilla.redhat.com/show_bug.cgi?id=1354525 https://github.com/torvalds/linux/commit/51093254bf879bc9c • CWE-476: NULL Pointer Dereference •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2016-5343
https://notcve.org/view.php?id=CVE-2016-5343
drivers/soc/qcom/qdsp6v2/voice_svc.c in the QDSP6v2 Voice Service driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a write request, as demonstrated by a voice_svc_send_req buffer overflow. drivers/soc/qcom/qdsp6v2/voice_svc.c en el controlador Voice Service QDSP6v2 para el kernel de Linux 3.x, como se usa en contribuciones Qualcomm Innovation Center (QuIC) Android para dispositivos MSM y otros productos, permite a atacantes provocar una denegación de servicio (corrupción de memoria) o tener otro posible impacto no especificado a través de una petición de escritura, como se demuestra por un desbordamiento de búfer voice_svc_send_req. • http://source.android.com/security/bulletin/2016-10-01.html http://www.securityfocus.com/bid/93330 https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=6927e2e0af4dcac357be86ba563c9ae12354bb08 https://www.codeaurora.org/multiple-memory-corruption-issues-write-operation-qdsp6v2-voice-service-driver-cve-2016-5343 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2015-8956 – kernel: NULL dereference in RFCOMM bind callback
https://notcve.org/view.php?id=CVE-2015-8956
The rfcomm_sock_bind function in net/bluetooth/rfcomm/sock.c in the Linux kernel before 4.2 allows local users to obtain sensitive information or cause a denial of service (NULL pointer dereference) via vectors involving a bind system call on a Bluetooth RFCOMM socket. La función rfcomm_sock_bind en net/bluetooth/rfcomm/sock.c en el kernel de Linux en versiones anteriores a 4.2 permite a usuarios locales obtener información sensible o provocar una denegación de servicio (referencia a puntero NULL) a través de vectores relacionados con una llamada de sistema enlazada en un enchufe Bluetooth RFCOMM. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=951b6a0717db97ce420547222647bcc40bf1eacd http://rhn.redhat.com/errata/RHSA-2016-2574.html http://rhn.redhat.com/errata/RHSA-2016-2584.html http://source.android.com/security/bulletin/2016-10-01.html http://www.securityfocus.com/bid/93326 https://github.com/torvalds/linux/commit/951b6a0717db97ce420547222647bcc40bf1eacd https://access.redhat.com/security/cve/CVE-2015-8956 https://bugzilla.redhat.com/show_bug.cgi?id=1383395 • CWE-476: NULL Pointer Dereference •