CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2018-12931 – kernel: stack-based out-of-bounds write in ntfs_attr_find in the ntfs.ko
https://notcve.org/view.php?id=CVE-2018-12931
ntfs_attr_find in the ntfs.ko filesystem driver in the Linux kernel 4.15.0 allows attackers to trigger a stack-based out-of-bounds write and cause a denial of service (kernel oops or panic) or possibly have unspecified other impact via a crafted ntfs filesystem. ntfs_attr_find en el controlador en el sistema de archivos ntfs.ko en el kernel de Linux 4.15.0 permite que los atacantes desencadenen una escritura fuera de límites basada en la pila de memoria y provoquen una denegación de servicio (OOPS o pánico del kernel) o, posiblemente, provoquen otro impacto no especificado mediante un sistema de archivos ntfs manipulado. A flaw was found in ntfs_attr_find in the ntfs.ko filesystem driver in the Linux kernel. This allows attackers to trigger a stack-based out-of-bounds write and cause a denial of service or possibly have unspecified other impact via a crafted ntfs filesystem image. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is unlikely. • http://www.securityfocus.com/bid/104588 https://access.redhat.com/errata/RHSA-2019:0641 https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1763403 https://marc.info/?l=linux-ntfs-dev&m=152413769810234&w=2 https://access.redhat.com/security/cve/CVE-2018-12931 https://bugzilla.redhat.com/show_bug.cgi?id=1597843 • CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2018-12930 – kernel: stack-based out-of-bounds write in ntfs_end_buffer_async_read in the ntfs.ko
https://notcve.org/view.php?id=CVE-2018-12930
ntfs_end_buffer_async_read in the ntfs.ko filesystem driver in the Linux kernel 4.15.0 allows attackers to trigger a stack-based out-of-bounds write and cause a denial of service (kernel oops or panic) or possibly have unspecified other impact via a crafted ntfs filesystem. ntfs_end_buffer_async_read en el controlador en el sistema de archivos ntfs.ko en el kernel de Linux 4.15.0 permite que los atacantes desencadenen una escritura fuera de límites basada en la pila de memoria y provoquen una denegación de servicio (OOPS o pánico del kernel) o, posiblemente, provoquen otro impacto no especificado mediante un sistema de archivos ntfs manipulado. A flaw was found in ntfs_end_buffer_async_read in the ntfs.ko filesystem driver in the Linux kernel. This allows attackers to trigger a stack-based out-of-bounds write and cause a denial of service or possibly have unspecified other impact via a crafted ntfs filesystem. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is unlikely. • http://www.securityfocus.com/bid/104588 https://access.redhat.com/errata/RHSA-2019:0641 https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1763403 https://marc.info/?l=linux-ntfs-dev&m=152413769810234&w=2 https://access.redhat.com/security/cve/CVE-2018-12930 https://bugzilla.redhat.com/show_bug.cgi?id=1597837 • CWE-787: Out-of-bounds Write •
CVSS: 4.9EPSS: 0%CPEs: 3EXPL: 2CVE-2018-12904 – KVM (Nested Virtualization) - L1 Guest Privilege Escalation
https://notcve.org/view.php?id=CVE-2018-12904
In arch/x86/kvm/vmx.c in the Linux kernel before 4.17.2, when nested virtualization is used, local attackers could cause L1 KVM guests to VMEXIT, potentially allowing privilege escalations and denial of service attacks due to lack of checking of CPL. En arch/x86/kvm/vmx.c en el kernel de Linux en versiones anteriores a la 4.17.2, cuando se emplea la virtualización anidada, los atacantes locales podrían hacer que los invitados L1 KVM realizasen un VMEXIT, permitiendo escalados de privilegios y ataques de denegación de servicio (DoS) debido a la falta de comprobación de CPL. • https://www.exploit-db.com/exploits/44944 http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=727ba748e110b4de50d142edca9d6a9b7e6111d8 https://bugs.chromium.org/p/project-zero/issues/detail?id=1589 https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.17.2 https://github.com/torvalds/linux/commit/727ba748e110b4de50d142edca9d6a9b7e6111d8 https://usn.ubuntu.com/3752-1 https://usn.ubuntu.com/3752-2 https://usn.ubuntu.com/3752-3 •
CVSS: 6.3EPSS: 0%CPEs: 5EXPL: 0CVE-2018-1000204 – kernel: Infoleak caused by incorrect handling of the SG_IO ioctl
https://notcve.org/view.php?id=CVE-2018-1000204
Linux Kernel version 3.18 to 4.16 incorrectly handles an SG_IO ioctl on /dev/sg0 with dxfer_direction=SG_DXFER_FROM_DEV and an empty 6-byte cmdp. This may lead to copying up to 1000 kernel heap pages to the userspace. This has been fixed upstream in https://github.com/torvalds/linux/commit/a45b599ad808c3c982fdcdc12b0b8611c2f92824 already. The problem has limited scope, as users don't usually have permissions to access SCSI devices. On the other hand, e.g. the Nero user manual suggests doing `chmod o+r+w /dev/sg*` to make the devices accessible. • http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00043.html http://www.openwall.com/lists/oss-security/2018/06/26/3 https://access.redhat.com/errata/RHSA-2018:2948 https://github.com/torvalds/linux/commit/a45b599ad808c3c982fdcdc12b0b8611c2f92824 https://lists.debian.org/debian-lts-announce/2018/07/msg00015.html https://lists.debian.org/debian-lts-announce/2018/07/msg00016.html https://lists.debian.org/debian-lts-announce/2018/07/msg00020.html https://usn.ubuntu.com/3696-1& • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 1CVE-2018-12714
https://notcve.org/view.php?id=CVE-2018-12714
An issue was discovered in the Linux kernel through 4.17.2. The filter parsing in kernel/trace/trace_events_filter.c could be called with no filter, which is an N=0 case when it expected at least one line to have been read, thus making the N-1 index invalid. This allows attackers to cause a denial of service (slab out-of-bounds write) or possibly have unspecified other impact via crafted perf_event_open and mmap system calls. Se ha descubierto un problema en el kernel de Linux hasta la versión 4.17.2. El análisis del filtros en kernel/trace/trace_events_filter.c podría ser llamado sin un filtro, que es un caso N=0 cuando espera que, por lo menos, se haya leído una línea, lo que hace que el índice N-1 no sea válido. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=81f9c4e4177d31ced6f52a89bb70e93bfb77ca03 http://www.securityfocus.com/bid/104544 https://bugzilla.kernel.org/show_bug.cgi?id=200019 https://github.com/lcytxw/bug_repro/tree/master/bug_200019 https://github.com/torvalds/linux/commit/81f9c4e4177d31ced6f52a89bb70e93bfb77ca03 • CWE-787: Out-of-bounds Write •