CVSS: 7.8EPSS: 0%CPEs: 7EXPL: 1CVE-2023-5717 – Out-of-bounds write in Linux kernel's Linux Kernel Performance Events (perf) component
https://notcve.org/view.php?id=CVE-2023-5717
A heap out-of-bounds write vulnerability in the Linux kernel's Linux Kernel Performance Events (perf) component can be exploited to achieve local privilege escalation. If perf_read_group() is called while an event's sibling_list is smaller than its child's sibling_list, it can increment or write to memory locations outside of the allocated buffer. We recommend upgrading past commit 32671e3799ca2e4590773fd0e63aaa4229e50c06. Se puede aprovechar una vulnerabilidad de escritura fuera de límites del montón en el componente Linux Kernel Performance Events (perf) del kernel de Linux para lograr una escalada de privilegios local. Si se llama a perf_read_group() mientras la lista de hermanos de un evento es más pequeña que la lista de hermanos de su hijo, puede incrementar o escribir en ubicaciones de memoria fuera del búfer asignado. Recomendamos actualizar después del commit 32671e3799ca2e4590773fd0e63aaa4229e50c06. A flaw was found in the Linux kernel's Performance Events system component. • https://github.com/uthrasri/CVE-2023-5717 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/kernel/events?id=32671e3799ca2e4590773fd0e63aaa4229e50c06 https://kernel.dance/32671e3799ca2e4590773fd0e63aaa4229e50c06 https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html https://lists.debian.org/debian-lts-announce/2024/01/msg00005.html https://access.redhat.com/security/cve/CVE-2023-5717 https://bugzilla.redhat.com/show_bug.cgi?id=2246945 • CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 0%CPEs: 8EXPL: 0CVE-2023-5633 – Kernel: vmwgfx: reference count issue leads to use-after-free in surface handling
https://notcve.org/view.php?id=CVE-2023-5633
The reference count changes made as part of the CVE-2023-33951 and CVE-2023-33952 fixes exposed a use-after-free flaw in the way memory objects were handled when they were being used to store a surface. When running inside a VMware guest with 3D acceleration enabled, a local, unprivileged user could potentially use this flaw to escalate their privileges. Los cambios en el recuento de referencias realizados como parte de las correcciones CVE-2023-33951 y CVE-2023-33952 expusieron una falla de use-after-free en la forma en que se manejaban los objetos de memoria cuando se usaban para almacenar una superficie. Cuando se ejecuta dentro de un invitado de VMware con la aceleración 3D habilitada, un usuario local sin privilegios podría utilizar esta falla para aumentar sus privilegios. • https://access.redhat.com/errata/RHSA-2024:0113 https://access.redhat.com/errata/RHSA-2024:0134 https://access.redhat.com/errata/RHSA-2024:0461 https://access.redhat.com/errata/RHSA-2024:1404 https://access.redhat.com/errata/RHSA-2024:4823 https://access.redhat.com/errata/RHSA-2024:4831 https://access.redhat.com/security/cve/CVE-2023-5633 https://bugzilla.redhat.com/show_bug.cgi?id=2245663 • CWE-416: Use After Free •
CVSS: 6.3EPSS: 0%CPEs: 9EXPL: 1CVE-2023-40791
https://notcve.org/view.php?id=CVE-2023-40791
extract_user_to_sg in lib/scatterlist.c in the Linux kernel before 6.4.12 fails to unpin pages in a certain situation, as demonstrated by a WARNING for try_grab_page. extract_user_to_sg en lib/scatterlist.c en el kernel de Linux anterior a 6.4.12 no logra desanclar páginas en una situación determinada, como lo demuestra una ADVERTENCIA para try_grab_page. • https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.4.12 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f443fd5af5dbd531f880d3645d5dd36976cf087f https://lkml.org/lkml/2023/8/3/323 https://lore.kernel.org/linux-crypto/20571.1690369076%40warthog.procyon.org.uk https://security.netapp.com/advisory/ntap-20231110-0009 •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-45898
https://notcve.org/view.php?id=CVE-2023-45898
The Linux kernel before 6.5.4 has an es1 use-after-free in fs/ext4/extents_status.c, related to ext4_es_insert_extent. El kernel de Linux anterior a 6.5.4 tiene un es1 use-after-free en fs/ext4/extents_status.c, relacionado con ext4_es_insert_extent. • https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.5.4 https://github.com/torvalds/linux/commit/768d612f79822d30a1e7d132a4d4b05337ce42ec https://lkml.org/lkml/2023/8/13/477 https://lore.kernel.org/lkml/aa03f191-445c-0d2e-d6d7-0a3208d7df7a%40huawei.com/T https://www.spinics.net/lists/stable-commits/msg317086.html • CWE-416: Use After Free •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-45871 – kernel: IGB driver inadequate buffer size for frames larger than MTU
https://notcve.org/view.php?id=CVE-2023-45871
An issue was discovered in drivers/net/ethernet/intel/igb/igb_main.c in the IGB driver in the Linux kernel before 6.5.3. A buffer size may not be adequate for frames larger than the MTU. Se descubrió un problema en drivers/net/ethernet/intel/igb/igb_main.c en el controlador IGB en el kernel de Linux anterior a 6.5.3. Es posible que un tamaño de búfer no sea adecuado para tramas más grandes que la MTU. A flaw was found in igb_configure_rx_ring in drivers/net/ethernet/intel/igb/igb_main.c in the IGB driver in the Linux kernel. • https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.5.3 https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=bb5ed01cd2428cd25b1c88a3a9cba87055eb289f https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html https://security.netapp.com/advisory/ntap-20231110-0001 https://access.redhat.com/security/cve/CVE-2023-45871 https://bugzilla.redhat.com/show_bug.cgi?id=2244723 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-131: Incorrect Calculation of Buffer Size •