CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2017-17855
https://notcve.org/view.php?id=CVE-2017-17855
kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging improper use of pointers in place of scalars. kernel/bpf/verifier.c en el kernel de Linux, en versiones anteriores a la 4.14.8, permite que los usuarios locales provoquen una denegación de servicio (corrupción de memoria) o, posiblemente, causen otros impactos no especificados aprovechando un uso incorrecto de punteros en lugar de escalares. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=179d1c5602997fef5a940c6ddcf31212cbfebd14 http://www.openwall.com/lists/oss-security/2017/12/21/2 https://github.com/torvalds/linux/commit/179d1c5602997fef5a940c6ddcf31212cbfebd14 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2017-16996
https://notcve.org/view.php?id=CVE-2017-16996
kernel/bpf/verifier.c in the Linux kernel through 4.14.8 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging register truncation mishandling. kernel/bpf/verifier.c en el kernel de Linux, en versiones anteriores a la 4.14.8, permite que los usuarios locales provoquen una denegación de servicio (corrupción de memoria) o, posiblemente, causen otros impactos no especificados aprovechando una mala gestión del truncamiento de registros. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=0c17d1d2c61936401f4702e1846e2c19b200f958 http://openwall.com/lists/oss-security/2017/12/21/2 http://www.securityfocus.com/bid/102267 https://bugs.chromium.org/p/project-zero/issues/detail?id=1454 https://github.com/torvalds/linux/commit/0c17d1d2c61936401f4702e1846e2c19b200f958 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 12CVE-2017-16995 – Linux - BPF Sign Extension Local Privilege Escalation
https://notcve.org/view.php?id=CVE-2017-16995
The check_alu_op function in kernel/bpf/verifier.c in the Linux kernel through 4.4 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging incorrect sign extension. La función check_alu_op en kernel/bpf/verifier.c en el kernel de Linux, hasta la versión 4.4, permite que los usuarios locales provoquen una denegación de servicio (corrupción de memoria) o, posiblemente, causen otros impactos no especificados aprovechando una extensión de señal incorrecta • https://www.exploit-db.com/exploits/45058 https://www.exploit-db.com/exploits/45010 https://www.exploit-db.com/exploits/44298 https://github.com/Al1ex/CVE-2017-16995 https://github.com/C0dak/CVE-2017-16995 https://github.com/gugronnier/CVE-2017-16995 https://github.com/ph4ntonn/CVE-2017-16995 https://github.com/anldori/CVE-2017-16995 https://github.com/vnik5287/CVE-2017-16995 https://github.com/fei9747/CVE-2017-16995 https://github.com/littlebin404/CVE-2017-16 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2017-17712 – kernel: Race condition in raw_sendmsg function allows denial-of-service or kernel addresses leak
https://notcve.org/view.php?id=CVE-2017-17712
The raw_sendmsg() function in net/ipv4/raw.c in the Linux kernel through 4.14.6 has a race condition in inet->hdrincl that leads to uninitialized stack pointer usage; this allows a local user to execute code and gain privileges. La función raw_sendmsg() en net/ipv4/raw.c en el kernel de Linux hasta la versión 4.14.6 tiene una condición de carrera en inet->hdrincl que conduce al uso de un puntero de pila no inicializado. Esto permite que un usuario local ejecute código y obtenga privilegios. A flaw was found in the Linux kernel's implementation of raw_sendmsg allowing a local attacker to panic the kernel or possibly leak kernel addresses. A local attacker, with the privilege of creating raw sockets, can abuse a possible race condition when setting the socket option to allow the kernel to automatically create ip header values and thus potentially escalate their privileges. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8f659a03a0ba9289b9aeb9b4470e6fb263d6f483 https://access.redhat.com/errata/RHSA-2018:0502 https://github.com/torvalds/linux/commit/8f659a03a0ba9289b9aeb9b4470e6fb263d6f483 https://source.android.com/security/bulletin/pixel/2018-04-01 https://usn.ubuntu.com/3581-1 https://usn.ubuntu.com/3581-2 https://usn.ubuntu.com/3581-3 https://usn.ubuntu.com/3582-1 https://usn.ubuntu.com/3582-2 https://www.debian.org/ • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 7.2EPSS: 0%CPEs: 3EXPL: 0CVE-2017-17558 – kernel: Unallocated memory access by malicious USB device via bNumInterfaces overflow
https://notcve.org/view.php?id=CVE-2017-17558
The usb_destroy_configuration function in drivers/usb/core/config.c in the USB core subsystem in the Linux kernel through 4.14.5 does not consider the maximum number of configurations and interfaces before attempting to release resources, which allows local users to cause a denial of service (out-of-bounds write access) or possibly have unspecified other impact via a crafted USB device. La función usb_destroy_configuration en drivers/usb/core/config.c en el subsistema del núcleo USB en el kernel de Linux hasta la versión 4.14.5 no considera el máximo número de configuraciones e interfaces antes de intentar liberar recursos. Esto permite que usuarios locales provoquen una denegación de servicio (acceso de escritura fuera de límites) o, posiblemente, tengan otro tipo de impacto sin especificar mediante un dispositivo USB manipulado. The usb_destroy_configuration() function, in 'drivers/usb/core/config.c' in the USB core subsystem, in the Linux kernel through 4.14.5 does not consider the maximum number of configurations and interfaces before attempting to release resources. This allows local users to cause a denial of service, due to out-of-bounds write access, or possibly have unspecified other impact via a crafted USB device. • http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00007.html http://openwall.com/lists/oss-security/2017/12/12/7 https://access.redhat.com/errata/RHSA-2018:0676 https://access.redhat.com/errata/RHSA-2018:1062 https://access.redhat.com/errata/RHSA-2019:1170 https://access.redhat.com/errata/RHSA-2019:1190 https://lists.debian.org/debian-lts-announce/2018/01/msg00004.html https://usn.ubuntu.com/3619-1 https://usn.ubuntu.com/3619-2 https://usn.ubuntu& • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-787: Out-of-bounds Write •