CVSS: 6.3EPSS: 0%CPEs: 5EXPL: 0CVE-2022-40133 – There is an UAF vulnerability in vmwgfx driver
https://notcve.org/view.php?id=CVE-2022-40133
A use-after-free(UAF) vulnerability was found in function 'vmw_execbuf_tie_context' in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in Linux kernel's vmwgfx driver with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing a denial of service(DoS). Se ha encontrado una vulnerabilidad de uso de memoria previamente liberada (UAF) en la función "vmw_execbuf_tie_context" en el archivo drivers/gpu/vmxgfx/vmxgfx_execbuf.c en el controlador vmwgfx del kernel de Linux con el archivo de dispositivo "/dev/dri/renderD128 (o Dxxx)". Este fallo permite a un atacante local con una cuenta de usuario en el sistema conseguir privilegios, causando una denegación de servicio (DoS) A use-after-free vulnerability was found in the Linux kernel's vmwgfx driver in vmw_execbuf_tie_context. This flaw allows a local, unprivileged attacker with access to either /dev/dri/card0 or /dev/dri/rendererD128, who can issue an ioctl() on the resulting file descriptor, to crash the system, causing a denial of service. • https://bugzilla.openanolis.cn/show_bug.cgi?id=2075 https://access.redhat.com/security/cve/CVE-2022-40133 https://bugzilla.redhat.com/show_bug.cgi?id=2133453 • CWE-416: Use After Free •
CVSS: 6.3EPSS: 0%CPEs: 5EXPL: 0CVE-2022-38457 – There is an UAF vulnerability in vmwgfx driver
https://notcve.org/view.php?id=CVE-2022-38457
A use-after-free(UAF) vulnerability was found in function 'vmw_cmd_res_check' in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in Linux kernel's vmwgfx driver with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing a denial of service(DoS). Se ha encontrado una vulnerabilidad de uso de memoria previamente liberada (UAF) en la función "vmw_cmd_res_check" en el archivo drivers/gpu/vmxgfx/vmxgfx_execbuf.c en el controlador vmwgfx del kernel de Linux con el archivo de dispositivo "/dev/dri/renderD128 (o Dxxx)". Este fallo permite a un atacante local con una cuenta de usuario en el sistema conseguir privilegios, causando una denegación de servicio (DoS) A use-after-free vulnerability was found in the Linux kernel's vmwgfx driver in vmw_cmd_res_check. This flaw allows a local, unprivileged attacker with access to either /dev/dri/card0 or /dev/dri/rendererD128, who can issue an ioctl() on the resulting file descriptor, to crash the system, causing a denial of service. • https://bugzilla.openanolis.cn/show_bug.cgi?id=2074 https://access.redhat.com/security/cve/CVE-2022-38457 https://bugzilla.redhat.com/show_bug.cgi?id=2133455 • CWE-416: Use After Free •
CVSS: 4.7EPSS: 0%CPEs: 4EXPL: 0CVE-2022-40307
https://notcve.org/view.php?id=CVE-2022-40307
An issue was discovered in the Linux kernel through 5.19.8. drivers/firmware/efi/capsule-loader.c has a race condition with a resultant use-after-free. Se ha detectado un problema en el kernel de Linux versiones hasta 5.19.8. El archivo drivers/firmware/efi/capsule-loader.c presenta una condición de carrera con un uso de memoria previamente liberada resultante • https://github.com/torvalds/linux/commit/9cb636b5f6a8cc6d1b50809ec8f8d33ae0c84c95 https://lists.debian.org/debian-lts-announce/2022/10/msg00000.html https://lists.debian.org/debian-lts-announce/2022/11/msg00001.html https://www.debian.org/security/2022/dsa-5257 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 1CVE-2022-2905
https://notcve.org/view.php?id=CVE-2022-2905
An out-of-bounds memory read flaw was found in the Linux kernel's BPF subsystem in how a user calls the bpf_tail_call function with a key larger than the max_entries of the map. This flaw allows a local user to gain unauthorized access to data. Se ha encontrado un fallo de lectura de memoria fuera de límites en el subsistema BPF del kernel de Linux en la forma en que un usuario llama a la función bpf_tail_call con una clave mayor que el max_entries del mapa. Este fallo permite a un usuario local conseguir acceso no autorizado a los datos • https://bugzilla.redhat.com/show_bug.cgi?id=2121800 https://lists.debian.org/debian-lts-announce/2022/11/msg00001.html https://lore.kernel.org/bpf/984b37f9fdf7ac36831d2137415a4a915744c1b6.1661462653.git.daniel%40iogearbox.net • CWE-125: Out-of-bounds Read •
CVSS: 6.1EPSS: 0%CPEs: 7EXPL: 0CVE-2022-39842
https://notcve.org/view.php?id=CVE-2022-39842
An issue was discovered in the Linux kernel before 5.19. In pxa3xx_gcu_write in drivers/video/fbdev/pxa3xx-gcu.c, the count parameter has a type conflict of size_t versus int, causing an integer overflow and bypassing the size check. After that, because it is used as the third argument to copy_from_user(), a heap overflow may occur. NOTE: the original discoverer disputes that the overflow can actually happen. Se ha detectado un problema en el kernel de Linux versiones anteriores a 5.19. • https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.19 https://github.com/torvalds/linux/commit/a09d2d00af53b43c6f11e6ab3cb58443c2cac8a7 https://lists.debian.org/debian-lts-announce/2022/10/msg00000.html https://lists.debian.org/debian-lts-announce/2022/11/msg00001.html https://lore.kernel.org/all/YylaC1wHHyLw22D3%40kadam/T https://www.debian.org/security/2022/dsa-5257 • CWE-190: Integer Overflow or Wraparound •