CVSS: 6.9EPSS: 0%CPEs: 6EXPL: 0CVE-2011-1044 – kernel: IB/uverbs: Handle large number of entries in poll CQ
https://notcve.org/view.php?id=CVE-2011-1044
The ib_uverbs_poll_cq function in drivers/infiniband/core/uverbs_cmd.c in the Linux kernel before 2.6.37 does not initialize a certain response buffer, which allows local users to obtain potentially sensitive information from kernel memory via vectors that cause this buffer to be only partially filled, a different vulnerability than CVE-2010-4649. La función ib_uverbs_poll_cq en drivers/InfiniBand/core/uverbs_cmd.c en el kernel de Linux antes de v2.6.37 no inicializa determinado buffer de respuesta, lo que permite obtener información sensible de la memoria del kernel a usuarios locales a través de vectores que causan que este búfer este sólo parcialmente lleno. Se trata de una vulnerabilidad diferente a CVE-2010-4.649. • http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=7182afea8d1afd432a17c18162cc3fd441d0da93 http://rhn.redhat.com/errata/RHSA-2011-0927.html http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.37 http://www.securityfocus.com/bid/46488 https://bugzilla.redhat.com/show_bug.cgi?id=667916 https://exchange.xforce.ibmcloud.com/vulnerabilities/65563 https://access.redhat.com/security/cve/CVE-2011-1044 • CWE-909: Missing Initialization of Resource •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2010-4656 – kernel: iowarrior usb device heap overflow
https://notcve.org/view.php?id=CVE-2010-4656
The iowarrior_write function in drivers/usb/misc/iowarrior.c in the Linux kernel before 2.6.37 does not properly allocate memory, which might allow local users to trigger a heap-based buffer overflow, and consequently cause a denial of service or gain privileges, via a long report. La función iowarrior_write en drivers/usb/misc/iowarrior.c en el kernel Linux anterior a v2.6.37 no asigna memoria adecuadamente, lo que permite a usuarios locales desencadenar un desbordamiento de búfer basado en memoria dinámica, y en consecuencia provocar una denegación de servicio o obtener privilegios a través de un informe largo. • http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=3ed780117dbe5acb64280d218f0347f238dafed0 http://openwall.com/lists/oss-security/2011/01/24/9 http://openwall.com/lists/oss-security/2011/01/25/3 http://openwall.com/lists/oss-security/2011/01/25/4 http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.37 http://www.securityfocus.com/bid/46069 http://www.ubuntu.com/usn/USN-1146-1 https://bugzilla.redhat.com/show_bug.cgi?id&# • CWE-787: Out-of-bounds Write •
CVSS: 7.2EPSS: 0%CPEs: 3EXPL: 0CVE-2011-0521 – kernel: av7110 negative array offset
https://notcve.org/view.php?id=CVE-2011-0521
The dvb_ca_ioctl function in drivers/media/dvb/ttpci/av7110_ca.c in the Linux kernel before 2.6.38-rc2 does not check the sign of a certain integer field, which allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact via a negative value. La función dvb_ca_ioctl function en drivers/media/dvb/ttpci/av7110_ca.c para el kernel Linux anterior a v2.6.38-rc2 no comprueba el signo de un campo entero determinado, lo que permite a usuarios locales causar una denegación de servicio (corrupción de memoria) o posiblemente tener un impacto no especificado a través de un valor negativo. • http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=cb26a24ee9706473f31d34cc259f4dcf45cd0644 http://openwall.com/lists/oss-security/2011/01/24/2 http://openwall.com/lists/oss-security/2011/01/25/2 http://secunia.com/advisories/43009 http://secunia.com/advisories/46397 http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.38-rc2 http://www.securityfocus.com/archive/1/520102/100/0/threaded http://www.securityfocus.com/bid/45986 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.9EPSS: 0%CPEs: 6EXPL: 0CVE-2010-4649 – kernel: IB/uverbs: Handle large number of entries in poll CQ
https://notcve.org/view.php?id=CVE-2010-4649
Integer overflow in the ib_uverbs_poll_cq function in drivers/infiniband/core/uverbs_cmd.c in the Linux kernel before 2.6.37 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact via a large value of a certain structure member. Desbordamiento de enteros en la función ib_uverbs_poll_cq en drivers/InfiniBand/core/uverbs_cmd.c en el kernel de Linux antes de v2.6.37 permite a usuarios locales causar una denegación de servicio (corrupción de memoria) o posiblemente tener un impacto no especificado a través de un valor grande de un determinado miembro de una estructura. • http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=7182afea8d1afd432a17c18162cc3fd441d0da93 http://rhn.redhat.com/errata/RHSA-2011-0927.html http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.37 http://www.securityfocus.com/bid/46073 https://bugzilla.redhat.com/show_bug.cgi?id=667916 https://access.redhat.com/security/cve/CVE-2010-4649 • CWE-190: Integer Overflow or Wraparound •
CVSS: 2.1EPSS: 0%CPEs: 1EXPL: 0CVE-2010-4256
https://notcve.org/view.php?id=CVE-2010-4256
The pipe_fcntl function in fs/pipe.c in the Linux kernel before 2.6.37 does not properly determine whether a file is a named pipe, which allows local users to cause a denial of service via an F_SETPIPE_SZ fcntl call. La función pipe_fcntl en fs/pipe.c en el kernel de Linux anteriores a v2.6.37 no determinar correctamente si un archivo es una tubería (pipe) con nombre, que permite a usuarios locales causar una denegación de servicio a través de una llamada F_SETPIPE_SZ fcntl. • http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=c66fb347946ebdd5b10908866ecc9fa05ee2cf3d http://openwall.com/lists/oss-security/2010/11/30/6 http://openwall.com/lists/oss-security/2010/11/30/9 http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.37 • CWE-20: Improper Input Validation •