CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2015-5156 – kernel: buffer overflow with fraglist larger than MAX_SKB_FRAGS + 2 in virtio-net
https://notcve.org/view.php?id=CVE-2015-5156
The virtnet_probe function in drivers/net/virtio_net.c in the Linux kernel before 4.2 attempts to support a FRAGLIST feature without proper memory allocation, which allows guest OS users to cause a denial of service (buffer overflow and memory corruption) via a crafted sequence of fragmented packets. La función virtnet_probe en drivers/net/virtio_net.c en el kernel de Linux en versiones anteriores a 4.2 intenta dar soporte a la funcionalidad FRAGLIST sin asignación adecuada de memoria, lo que permite a usuarios invitados del SO provocar una denegación de servicio (desbordamiento del buffer y corrupción de memoria) a través de una secuencia manipulada de paquetes fragmentados. A buffer overflow flaw was found in the way the Linux kernel's virtio-net subsystem handled certain fraglists when the GRO (Generic Receive Offload) functionality was enabled in a bridged network configuration. An attacker on the local network could potentially use this flaw to crash the system, or, although unlikely, elevate their privileges on the system. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=48900cb6af4282fa0fb6ff4d72a81aa3dadb5c39 http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171454.html http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169378.html http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00009.html http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00018.html http://rhn.redhat.com/errata/RHSA-2015-1978.html http://rhn.redhat.com/errata/RH • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-122: Heap-based Buffer Overflow •
CVSS: 6.9EPSS: 0%CPEs: 1EXPL: 0CVE-2015-2925 – Kernel: vfs: Do not allow escaping from bind mounts
https://notcve.org/view.php?id=CVE-2015-2925
The prepend_path function in fs/dcache.c in the Linux kernel before 4.2.4 does not properly handle rename actions inside a bind mount, which allows local users to bypass an intended container protection mechanism by renaming a directory, related to a "double-chroot attack." La función prepend_path en fs/dcache.c en el kernel Linux en versiones anteriores a 4.2.4 no maneja adecuadamente el cambio de nombre de las acciones dentro de un enlace de montaje, lo que permite a usuarios locales eludir un mecanismo de protección destinado al contenedor mediante el cambio de nombre de un directorio, relacionado con un 'double-chroot attack'. A flaw was found in the way the Linux kernel's file system implementation handled rename operations in which the source was inside and the destination was outside of a bind mount. A privileged user inside a container could use this flaw to escape the bind mount and, potentially, escalate their privileges on the system. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=397d425dc26da728396e66d392d5dcb8dac30c37 http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=cde93be45a8a90d8c264c776fab63487b5038a65 http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00005.html http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00018.html http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00007.html http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00009 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-254: 7PK - Security Features •
CVSS: 4.9EPSS: 0%CPEs: 5EXPL: 0CVE-2015-6937
https://notcve.org/view.php?id=CVE-2015-6937
The __rds_conn_create function in net/rds/connection.c in the Linux kernel through 4.2.3 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by using a socket that was not properly bound. La función __rds_conn_create en net/rds/connection.c en el kernel de Linux hasta la versión 4.2.3 permite a usuarios locales provocar una denegación de servicio (referencia a puntero NULL y caída del sistema) o posiblemente tener otro impacto no especificado mediante el uso de un socket que no estaba vinculado adecuadamente. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=74e98eb085889b0d2d4908f59f6e00026063014f http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168447.html http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168539.html http://lists.fedoraproject.org/pipermail/package-announce/2015-September/167358.html http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00009.html http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00035.html http:/&#x •
CVSS: 2.1EPSS: 0%CPEs: 1EXPL: 0CVE-2015-6252
https://notcve.org/view.php?id=CVE-2015-6252
The vhost_dev_ioctl function in drivers/vhost/vhost.c in the Linux kernel before 4.1.5 allows local users to cause a denial of service (memory consumption) via a VHOST_SET_LOG_FD ioctl call that triggers permanent file-descriptor allocation. La función vhost_dev_ioctl en drivers/vhost/vhost.c en el kernel de Linux en versiones anteriores a 4.1.5 permite a usuarios locales provocar una denegación de servicio (consumo de memoria) a través de una llamada VHOST_SET_LOG_FD ioctl que desencadena la asignación de un descriptor de fichero permanente. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=7932c0bd7740f4cd2aa168d3ce0199e7af7d72d5 http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00009.html http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00035.html http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00013.html http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00038.html http://www.debian.org/security/2015/dsa-3364 http://www.kernel.org/pub/linux/kernel/v4.x • CWE-399: Resource Management Errors •
CVSS: 4.6EPSS: 0%CPEs: 10EXPL: 0CVE-2015-5707
https://notcve.org/view.php?id=CVE-2015-5707
Integer overflow in the sg_start_req function in drivers/scsi/sg.c in the Linux kernel 2.6.x through 4.x before 4.1 allows local users to cause a denial of service or possibly have unspecified other impact via a large iov_count value in a write request. Desbordamiento de entero en la función sg_start_req en drivers/scsi/sg.c en el kernel de Linux 2.6.x hasta la versión 4.x en versiones anteriores a 4.1 permite a usuarios locales provocar una denegación de servicio o posiblemente tener otro impacto no especificado a través de un valor iov_count grande en una petición de escritura. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=451a2886b6bf90e2fb378f7c46c655450fb96e81 http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=fdc81f45e9f57858da6351836507fbcf1b7583ee http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00004.html http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00018.html http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00021.html http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00026 • CWE-190: Integer Overflow or Wraparound •