CVSS: 8.4EPSS: 0%CPEs: 8EXPL: 0CVE-2016-3841 – kernel: use-after-free via crafted IPV6 sendmsg for raw / tcp / udp / l2tp sockets.
https://notcve.org/view.php?id=CVE-2016-3841
The IPv6 stack in the Linux kernel before 4.3.3 mishandles options data, which allows local users to gain privileges or cause a denial of service (use-after-free and system crash) via a crafted sendmsg system call. La pila IPv6 en el kernel de Linux en versiones anteriores a 4.3.3 no maneja adecuadamente datos de las opciones, lo que permite a usuarios locales obtener privilegios o provocar una denegación de servicio (uso después de liberación y caída de sistema) a través de una llamada al sistema sendmsg manipulada. It was found that the Linux kernel's IPv6 implementation mishandled socket options. A local attacker could abuse concurrent access to the socket options to escalate their privileges, or cause a denial of service (use-after-free and system crash) via a crafted sendmsg system call. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=45f6fad84cc305103b28d73482b344d7f5b76f39 http://rhn.redhat.com/errata/RHSA-2016-0855.html http://rhn.redhat.com/errata/RHSA-2016-2574.html http://rhn.redhat.com/errata/RHSA-2016-2584.html http://rhn.redhat.com/errata/RHSA-2016-2695.html http://source.android.com/security/bulletin/2016-08-01.html http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.3.3 http://www.securityfocus.com/bid/92227 http • CWE-264: Permissions, Privileges, and Access Controls CWE-416: Use After Free CWE-667: Improper Locking •
CVSS: 4.9EPSS: 0%CPEs: 1EXPL: 0CVE-2016-5400
https://notcve.org/view.php?id=CVE-2016-5400
Memory leak in the airspy_probe function in drivers/media/usb/airspy/airspy.c in the airspy USB driver in the Linux kernel before 4.7 allows local users to cause a denial of service (memory consumption) via a crafted USB device that emulates many VFL_TYPE_SDR or VFL_TYPE_SUBDEV devices and performs many connect and disconnect operations. Pérdida de memoria en la función airspy_probe en drivers/media/usb/airspy/airspy.c en el controlador USB airspy en el kernel de Linux en versiones anteriores a 4.7 permite a usuarios locales provocar una denegación de servicio (consumo de memoria) a través de un dispositivo USB manipulado que emula muchos dispositivos VFL_TYPE_SDR o VFL_TYPE_SUBDEV y realiza muchas operaciones de conexión y desconexión. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=aa93d1fee85c890a34f2510a310e55ee76a27848 http://www.openwall.com/lists/oss-security/2016/07/25/1 http://www.securityfocus.com/bid/92104 http://www.securitytracker.com/id/1036432 http://www.ubuntu.com/usn/USN-3070-1 http://www.ubuntu.com/usn/USN-3070-2 http://www.ubuntu.com/usn/USN-3070-3 http://www.ubuntu.com/usn/USN-3070-4 https://bugzilla.redhat.com/show_bug.cgi?id=1358184 https:/ • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2016-5412 – Kernel: powerpc: kvm: Infinite loop via H_CEDE hypercall when running under hypervisor-mode
https://notcve.org/view.php?id=CVE-2016-5412
arch/powerpc/kvm/book3s_hv_rmhandlers.S in the Linux kernel through 4.7 on PowerPC platforms, when CONFIG_KVM_BOOK3S_64_HV is enabled, allows guest OS users to cause a denial of service (host OS infinite loop) by making a H_CEDE hypercall during the existence of a suspended transaction. arch/powerpc/kvm/book3s_hv_rmhandlers.S en el kernel de Linux hasta la versión 4.7 en plataformas PowerPC, cuando se encuentra habilitada CONFIG_KVM_BOOK3S_64_HV, permite a usuarios invitados del SO provocar una denegación de servicio (bucle infinito del SO anfitrión) haciendo una hiperllamada H_CEDE durante la existencia de una transacción suspendida. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=93d17397e4e2182fdaad503e2f9da46202c0f1c3 http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f024ee098476a3e620232e4a78cfac505f121245 http://rhn.redhat.com/errata/RHSA-2016-2574.html http://www.openwall.com/lists/oss-security/2016/07/28/2 https://bugzilla.redhat.com/show_bug.cgi?id=1349916 https://github.com/torvalds/linux/commit/93d17397e4e2182fdaad503e2f9da46202c0f1c3 https://github.com/torvalds/linux/commit/ • CWE-399: Resource Management Errors CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 7.4EPSS: 0%CPEs: 1EXPL: 1CVE-2016-6516
https://notcve.org/view.php?id=CVE-2016-6516
Race condition in the ioctl_file_dedupe_range function in fs/ioctl.c in the Linux kernel through 4.7 allows local users to cause a denial of service (heap-based buffer overflow) or possibly gain privileges by changing a certain count value, aka a "double fetch" vulnerability. Condición de carrera en la función ioctl_file_dedupe_range en fs/ioctl.c en el kernel de Linux hasta la versión 4.7 permite a usuarios locales provocar una denegación de servicio (desbordamiento de búfer basado en memoria dinámica) o posiblemente obtener privilegios cambiando un cierto valor de recuento, también conocido como una vulnerabilidad de "doble recuperación". • https://github.com/wpengfei/CVE-2016-6516-exploit http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=10eec60ce79187686e052092e5383c99b4420a20 http://www.openwall.com/lists/oss-security/2016/07/31/6 http://www.securityfocus.com/bid/92259 https://bugzilla.redhat.com/show_bug.cgi?id=1362457 https://github.com/torvalds/linux/commit/10eec60ce79187686e052092e5383c99b4420a20 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 5.8EPSS: 0%CPEs: 4EXPL: 1CVE-2016-5696 – kernel: challenge ACK counter information disclosure.
https://notcve.org/view.php?id=CVE-2016-5696
net/ipv4/tcp_input.c in the Linux kernel before 4.7 does not properly determine the rate of challenge ACK segments, which makes it easier for remote attackers to hijack TCP sessions via a blind in-window attack. net/ipv4/tcp_input.c en el kernel de Linux en versiones anteriores a 4.7 no determina adecuadamente la tasa de segmentos de desafío ACK, lo que facilita a atacantes remotos secuestrar sesiones TCP a través de un ataque ciego en ventana. It was found that the RFC 5961 challenge ACK rate limiting as implemented in the Linux kernel's networking subsystem allowed an off-path attacker to leak certain information about a given connection by creating congestion on the global challenge ACK rate limit counter and then measuring the changes by probing packets. An off-path attacker could use this flaw to either terminate TCP connection and/or inject payload into non-secured TCP connection between two endpoints on the network. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=75ff39ccc1bd5d3c455b6822ab09e533c551f758 http://rhn.redhat.com/errata/RHSA-2016-1631.html http://rhn.redhat.com/errata/RHSA-2016-1632.html http://rhn.redhat.com/errata/RHSA-2016-1633.html http://rhn.redhat.com/errata/RHSA-2016-1657.html http://rhn.redhat.com/errata/RHSA-2016-1664.html http://rhn.redhat.com/errata/RHSA-2016-1814.html http://rhn.redhat.com/errata/RHSA-2016-1815.html http://rhn. • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-203: Observable Discrepancy •