CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 1CVE-2019-15791 – Reference count underflow in shiftfs
https://notcve.org/view.php?id=CVE-2019-15791
In shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, shiftfs_btrfs_ioctl_fd_replace() installs an fd referencing a file from the lower filesystem without taking an additional reference to that file. After the btrfs ioctl completes this fd is closed, which then puts a reference to that file, leading to a refcount underflow. En shiftfs, un parche no upstream para el Kernel de Linux incluido en las series kernel de Ubuntu versiones 5.0 y 5.3, shiftfs_btrfs_ioctl_fd_replace() instala un fd que hace referencia a un archivo del sistema de archivos inferior sin tomar una referencia adicional a ese archivo. Después de que el btrfs ioctl completa este fd se cierra, lo que entonces pone una referencia a ese archivo, lo que lleva a un subflujo de recuento. • https://www.exploit-db.com/exploits/47693 https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan/commit/?id=601a64857b3d7040ca15c39c929e6b9db3373ec1 https://usn.ubuntu.com/usn/usn-4183-1 https://usn.ubuntu.com/usn/usn-4184-1 • CWE-191: Integer Underflow (Wrap or Wraparound) CWE-672: Operation on a Resource after Expiration or Release •
CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 1CVE-2019-15793 – Mishandling of file-system uid/gid with namespaces in shiftfs
https://notcve.org/view.php?id=CVE-2019-15793
In shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, several locations which shift ids translate user/group ids before performing operations in the lower filesystem were translating them into init_user_ns, whereas they should have been translated into the s_user_ns for the lower filesystem. This resulted in using ids other than the intended ones in the lower fs, which likely did not map into the shifts s_user_ns. A local attacker could use this to possibly bypass discretionary access control permissions. En shiftfs, un parche no upstream para el Kernel de Linux incluido en las series kernel de Ubuntu versiones 5.0 y 5.3, varias ubicaciones que desplazan los ids traducen los ids de usuario/grupo antes de realizar operaciones en el sistema de archivos inferior los estaban traduciendo a init_user_ns, mientras que deberían haber sido traducidos a s_user_ns para el sistema de archivos inferior. Esto dio lugar a que se utilizaran ids distintos de los previstos en los fs inferiores, que probablemente no se mapearon en los shifts s_user_ns. • https://www.exploit-db.com/exploits/47693 https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan/commit/?id=3644b9d5688da86f18e017c9c580b75cf52927bb https://usn.ubuntu.com/usn/usn-4183-1 https://usn.ubuntu.com/usn/usn-4184-1 • CWE-276: Incorrect Default Permissions CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory •
CVSS: 7.2EPSS: 0%CPEs: 4EXPL: 1CVE-2019-15794 – Reference counting error in overlayfs/shiftfs error path when used in conjuction with aufs
https://notcve.org/view.php?id=CVE-2019-15794
Overlayfs in the Linux kernel and shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, both replace vma->vm_file in their mmap handlers. On error the original value is not restored, and the reference is put for the file to which vm_file points. On upstream kernels this is not an issue, as no callers dereference vm_file following after call_mmap() returns an error. However, the aufs patchs change mmap_region() to replace the fput() using a local variable with vma_fput(), which will fput() vm_file, leading to a refcount underflow. Overlayfs en el kernel de Linux y shiftfs, un parche no upstream para el kernel de Linux incluido en las series de kernel Ubuntu versiones 5.0 y 5.3, ambos reemplazan vma->vm_file en sus manejadores de mmap. • https://www.exploit-db.com/exploits/47692 https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan/commit/?id=270d16ae48a4dbf1c7e25e94cc3e38b4bea37635 https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan/commit/?id=ef81780548d20a786cc77ed4203fca146fd81ce3 https://usn.ubuntu.com/usn/usn-4208-1 https://usn.ubuntu.com/usn/usn-4209-1 • CWE-672: Operation on a Resource after Expiration or Release •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2007-3732
https://notcve.org/view.php?id=CVE-2007-3732
In Linux 2.6 before 2.6.23, the TRACE_IRQS_ON function in iret_exc calls a C function without ensuring that the segments are set properly. The kernel's %fs needs to be restored before the call in TRACE_IRQS_ON and before enabling interrupts, so that "current" references work. Without this, "current" used in the window between iret_exc and the middle of error_code where %fs is reset, would crash. En Linux versiones 2.6 anteriores a 2.6.23, la función TRACE_IRQS_ON en iret_exc llama a una función C sin asegurar de que los segmentos estén configurados apropiadamente. El %fs del kernel debe ser restaurado antes de la llamada en TRACE_IRQS_ON y antes de habilitar las interrupciones, para que operen las referencias "current". • https://access.redhat.com/security/cve/cve-2007-3732 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2007-3732 https://security-tracker.debian.org/tracker/CVE-2007-3732 •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2010-2243
https://notcve.org/view.php?id=CVE-2010-2243
A vulnerability exists in kernel/time/clocksource.c in the Linux kernel before 2.6.34 where on non-GENERIC_TIME systems (GENERIC_TIME=n), accessing /sys/devices/system/clocksource/clocksource0/current_clocksource results in an OOPS. Se presenta una vulnerabilidad en el archivo kernel/time/clocksource.c en el kernel de Linux versiones anteriores a 2.6.34, donde en sistemas non-GENERIC_TIME (GENERIC_TIME=n), acceder a /sys/devices/system/clocksource/clocksource0/current_clocksource resulta en un OOPS. • https://access.redhat.com/security/cve/cve-2010-2243 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ad6759fbf35d104dbf573cd6f4c6784ad6823f7e https://security-tracker.debian.org/tracker/CVE-2010-2243 https://www.openwall.com/lists/oss-security/2010/06/25/1 • CWE-20: Improper Input Validation •