CVSS: 7.0EPSS: 0%CPEs: 17EXPL: 0CVE-2022-45919 – kernel: use-after-free due to race condition occurring in dvb_ca_en50221.c
https://notcve.org/view.php?id=CVE-2022-45919
An issue was discovered in the Linux kernel through 6.0.10. In drivers/media/dvb-core/dvb_ca_en50221.c, a use-after-free can occur is there is a disconnect after an open, because of the lack of a wait_event. Se descubrió un problema en el kernel de Linux hasta la versión 6.0.10. En drivers/media/dvb-core/dvb_ca_en50221.c, puede ocurrir un use-after-free si hay una desconexión después de una apertura, debido a la falta de un wait_event. A race condition flaw leading to a use-after-free issue was found in the Linux kernel media subsystem in the DVB CA EN50221 interface of the DVB core device driver. • https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=280a8ab81733da8bc442253c700a52c4c0886ffd https://lore.kernel.org/linux-media/20221121063308.GA33821%40ubuntu/T/#u https://security.netapp.com/advisory/ntap-20230113-0008 https://access.redhat.com/security/cve/CVE-2022-45919 https://bugzilla.redhat.com/show_bug.cgi?id=2151956 • CWE-416: Use After Free •
CVSS: 7.0EPSS: 0%CPEs: 16EXPL: 0CVE-2022-45886 – kernel: use-after-free due to race condition occurring in dvb_net.c
https://notcve.org/view.php?id=CVE-2022-45886
An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvb_net.c has a .disconnect versus dvb_device_open race condition that leads to a use-after-free. Se descubrió un problema en el kernel de Linux hasta la versión 6.0.9. drivers/media/dvb-core/dvb_net.c tiene una condición de carrera .disconnect versus dvb_device_open que conduce a un use-after-free. A race condition flaw leading to a use-after-free issue was found in the Linux kernel media subsystem in the dvb_net component of the DVB core device driver. It could occur between the time the device is disconnected (.disconnect function) and the time the device node is opened (dvb_device_open function). A local user could use this flaw to crash the system or potentially escalate their privileges on the system. • https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4172385b0c9ac366dcab78eda48c26814b87ed1a https://lore.kernel.org/linux-media/20221115131822.6640-1-imv4bel%40gmail.com https://lore.kernel.org/linux-media/20221115131822.6640-3-imv4bel%40gmail.com https://security.netapp.com/advisory/ntap-20230113-0006 https://access.redhat.com/security/cve/CVE-2022-45886 https://bugzilla.redhat.com/show_bug.cgi?id=2148517 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-416: Use After Free •
CVSS: 6.7EPSS: 0%CPEs: 1EXPL: 0CVE-2022-2785 – Arbitrary Memory read in BPF Linux Kernel
https://notcve.org/view.php?id=CVE-2022-2785
There exists an arbitrary memory read within the Linux Kernel BPF - Constants provided to fill pointers in structs passed in to bpf_sys_bpf are not verified and can point anywhere, including memory not owned by BPF. An attacker with CAP_BPF can arbitrarily read memory from anywhere on the system. We recommend upgrading past commit 86f44fcec22c Se presenta una lectura de memoria arbitraria dentro del BPF del Kernel de Linux - Las constantes proporcionadas para rellenar los punteros en los structs pasados a bpf_sys_bpf no son verificados y pueden apuntar a cualquier lugar, incluyendo la memoria que no es propiedad de BPF. Un atacante con CAP_BPF puede leer arbitrariamente la memoria de cualquier parte del sistema. Recomendamos actualizar el commit pasado 86f44fcec22c • https://git.kernel.org/bpf/bpf/c/86f44fcec22c https://lore.kernel.org/bpf/20220816205517.682470-1-zhuyifei%40google.com/T/#t • CWE-125: Out-of-bounds Read •
CVSS: 7.2EPSS: 0%CPEs: 15EXPL: 0CVE-2014-0069 – kernel: cifs: incorrect handling of bogus user pointers during uncached writes
https://notcve.org/view.php?id=CVE-2014-0069
The cifs_iovec_write function in fs/cifs/file.c in the Linux kernel through 3.13.5 does not properly handle uncached write operations that copy fewer than the requested number of bytes, which allows local users to obtain sensitive information from kernel memory, cause a denial of service (memory corruption and system crash), or possibly gain privileges via a writev system call with a crafted pointer. La función cifs_iovec_write en fs/cifs/file.c en el kernel de Linux hasta 3.13.5 no maneja debidamente operaciones de escritura no en caché que copian menos bytes de los solicitados, lo que permite a usuarios locales obtener información sensible de la memoria del kernel, causar una denegación de servicio (corrupción de memoria y caída del sistema) o posiblemente ganar privilegios a través de una llamada al sistema writev con un puntero manipulado. • http://article.gmane.org/gmane.linux.kernel.cifs/9401 http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=5d81de8e8667da7135d3a32a964087c0faf5483f http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00026.html http://rhn.redhat.com/errata/RHSA-2014-0328.html http://www.openwall.com/lists/oss-security/2014/02/17/4 http://www.securityfocus.com/bid/65588 https://bugzilla.redhat.com/show_bug.cgi?id=1064253 https://github.com/torvalds/linux/comm • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 4.6EPSS: 0%CPEs: 5EXPL: 0CVE-2001-0886
https://notcve.org/view.php?id=CVE-2001-0886
Buffer overflow in glob function of glibc allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via a glob pattern that ends in a brace "{" character. Desbordamiento de buffer en la función glob de glibc para Red Hat Linux 6.2 a 7.2, y otros sistemas operativos, permite a atacantes causar una denegación de servicio (caída) y posiblemente ejecutar código arbitrarios mediante un patrón de glob que acaba en una llave "{" • http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000447 http://download.immunix.org/ImmunixOS/7.0/updates/IMNX-2001-70-037-01 http://sources.redhat.com/ml/bug-glibc/2001-11/msg00109.html http://www.ciac.org/ciac/bulletins/m-029.shtml http://www.debian.org/security/2002/dsa-103 http://www.linux-mandrake.com/en/security/2001/MDKSA-2001-095.php3 http://www.linuxsecurity.com/advisories/other_advisory-1752.html http://www.redhat.com/support/errata/RHSA-2001-160&# •