CVSS: 4.6EPSS: 0%CPEs: 1EXPL: 1CVE-2010-2071
https://notcve.org/view.php?id=CVE-2010-2071
The btrfs_xattr_set_acl function in fs/btrfs/acl.c in btrfs in the Linux kernel 2.6.34 and earlier does not check file ownership before setting an ACL, which allows local users to bypass file permissions by setting arbitrary ACLs, as demonstrated using setfacl. La función btrfs_xattr_set_acl en fs/btrfs/acl.c en btrfs en el kernel de linux v2.6.34 y anteriores no valida quien es el propietario de un archivo antes de establecer una ACL, lo que permite a usuarios locales evitar los permisos de fichero estableciendo ACLs de su elección como se ha demostrado usando setfacl. • http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff%3Bh=2f26afba http://lkml.org/lkml/2010/5/17/544 http://www.openwall.com/lists/oss-security/2010/06/11/3 http://www.openwall.com/lists/oss-security/2010/06/14/2 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.6EPSS: 0%CPEs: 160EXPL: 0CVE-2010-1641 – kernel: GFS2: The setflags ioctl() doesn't check file ownership
https://notcve.org/view.php?id=CVE-2010-1641
The do_gfs2_set_flags function in fs/gfs2/file.c in the Linux kernel before 2.6.34-git10 does not verify the ownership of a file, which allows local users to bypass intended access restrictions via a SETFLAGS ioctl request. La función "do_gfs2_set_flags" en "fs/gfs2/file.c" del kernel de Linux anterior a v2.6.34-git10 no comprueba el propietario del archivo, lo que permite a usuarios locales evitar restricciones de acceso intencionadas a través de peticiones SETFLAGS ioctl. • http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=7df0e0397b9a18358573274db9fdab991941062f http://lists.opensuse.org/opensuse-security-announce/2010-07/msg00006.html http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00000.html http://secunia.com/advisories/40645 http://secunia.com/advisories/43315 http://www.kernel.org/pub/linux/kernel/v2.6/snapshots/incr/patch-2.6.34-git9-git10.bz2 http://www.openwall.com/lists/oss-security/2010/05/25/1 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 1.9EPSS: 0%CPEs: 39EXPL: 0CVE-2010-1446
https://notcve.org/view.php?id=CVE-2010-1446
arch/powerpc/mm/fsl_booke_mmu.c in KGDB in the Linux kernel 2.6.30 and other versions before 2.6.33, when running on PowerPC, does not properly perform a security check for access to a kernel page, which allows local users to overwrite arbitrary kernel memory, related to Fsl booke. arch/powerpc/mm/fsl_booke_mmu.c en KGDB del kernel de Linux v2.6.30 y otras versiones anteriores a la v2.6.33, cuando se ejecuta en PowerPC, no realiza apropiadamente una comprobación de seguridad para acceder a la página del kernel, lo que permite a usuarios locales sobreescribir arbitrariamente la memoria del kernel, relacionado con Fsl booke. • http://lists.opensuse.org/opensuse-security-announce/2010-07/msg00006.html http://lkml.org/lkml/2010/5/10/458 http://secunia.com/advisories/39830 http://secunia.com/advisories/40645 http://www.debian.org/security/2010/dsa-2053 http://www.openwall.com/lists/oss-security/2010/04/29/3 http://www.openwall.com/lists/oss-security/2010/04/29/9 http://www.openwall.com/lists/oss-security/2010/04/30/1 http://www.vupen.com/english/advisories/2010/1857 https:/ • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.2EPSS: 0%CPEs: 11EXPL: 4CVE-2010-1437 – Linux Kernel 2.6.34 - 'find_keyring_by_name()' Local Memory Corruption
https://notcve.org/view.php?id=CVE-2010-1437
Race condition in the find_keyring_by_name function in security/keys/keyring.c in the Linux kernel 2.6.34-rc5 and earlier allows local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact via keyctl session commands that trigger access to a dead keyring that is undergoing deletion by the key_cleanup function. Condición de carrera en la función find_keyring_by_name en security/keys/keyring.c el el kernel de Linux v2.6.34-rc5 y anteriores, permite usuarios locales provocar una denegación de servicio (corrupción de memoria y caída del sistema) o posiblemente tener otros impactos, mediante comandos de sesión "keyctl" que provocan el acceso a una secuencia de pulsaciones en desuso que está bajo un borrado en la función key_cleanup. • https://www.exploit-db.com/exploits/33886 http://lists.opensuse.org/opensuse-security-announce/2010-07/msg00006.html http://marc.info/?l=linux-kernel&m=127192182917857&w=2 http://marc.info/?l=linux-kernel&m=127274294622730&w=2 http://marc.info/?l=linux-kernel&m=127292492727029&w=2 http://secunia.com/advisories/39830 http://secunia.com/advisories/40218 http://secunia.com/advisories/40645 http://secunia.com/advisories/43315 http://www.debian.org/security/2010/dsa-205 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-416: Use After Free •
CVSS: 2.1EPSS: 0%CPEs: 2EXPL: 3CVE-2010-1451
https://notcve.org/view.php?id=CVE-2010-1451
The TSB I-TLB load implementation in arch/sparc/kernel/tsb.S in the Linux kernel before 2.6.33 on the SPARC platform does not properly obtain the value of a certain _PAGE_EXEC_4U bit and consequently does not properly implement a non-executable stack, which makes it easier for context-dependent attackers to exploit stack-based buffer overflows via a crafted application. La implementación TSB I-TLB en arch/sparc/kernel/tsb.S en el kernel de Linux anterior a v2.6.33 en plataformas SPARC, no obtiene de forma adecuada ciertos bits _PAGE_EXEC_4U y consecuentemente no implementa de forma adecuada una pila no-ejecutable, lo que facilita a atacantes dependiendo del contexto explotar desbordamientos de búfer basados en pila a través de aplicaciones manipuladas. • http://marc.info/?l=linux-sparc&m=126662159602378&w=2 http://marc.info/?l=linux-sparc&m=126662196902830&w=2 http://secunia.com/advisories/39830 http://www.debian.org/security/2010/dsa-2053 http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.33 http://www.openwall.com/lists/oss-security/2010/02/24/1 http://www.openwall.com/lists/oss-security/2010/05/05/2 • CWE-787: Out-of-bounds Write •