CVSS: 5.6EPSS: 0%CPEs: 11EXPL: 0CVE-2019-3901 – kernel: perf_event_open() and execve() race in setuid programs allows a data leak
https://notcve.org/view.php?id=CVE-2019-3901
A race condition in perf_event_open() allows local attackers to leak sensitive data from setuid programs. As no relevant locks (in particular the cred_guard_mutex) are held during the ptrace_may_access() call, it is possible for the specified target task to perform an execve() syscall with setuid execution before perf_event_alloc() actually attaches to it, allowing an attacker to bypass the ptrace_may_access() check and the perf_event_exit_task(current) call that is performed in install_exec_creds() during privileged execve() calls. This issue affects kernel versions before 4.8. Una condición de carrera en la función perf_event_open() permite a los atacantes locales filtrar datos confidenciales desde los programas setuid. Como no se mantienen bloqueos relevantes (en particular, la función cred_guard_mutex) durante la llamada ptrace_may_access(), es posible que la tarea de destino especificada realice un syscall execve() con la ejecución setuid anterior a que perf_event_alloc() realmente se conecte, permitiendo que un atacante omita la comprobación ptrace_may_access() y la llamada perf_event_exit_task(current) que se realiza en install_exec_creds() durante las llamadas privilegiadas execve(). • http://www.securityfocus.com/bid/89937 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3901 https://lists.debian.org/debian-lts-announce/2019/05/msg00041.html https://lists.debian.org/debian-lts-announce/2019/05/msg00042.html https://security.netapp.com/advisory/ntap-20190517-0005 https://access.redhat.com/security/cve/CVE-2019-3901 https://bugzilla.redhat.com/show_bug.cgi?id=1701245 • CWE-667: Improper Locking •
CVSS: 2.5EPSS: 0%CPEs: 1EXPL: 2CVE-2019-11191
https://notcve.org/view.php?id=CVE-2019-11191
The Linux kernel through 5.0.7, when CONFIG_IA32_AOUT is enabled and ia32_aout is loaded, allows local users to bypass ASLR on setuid a.out programs (if any exist) because install_exec_creds() is called too late in load_aout_binary() in fs/binfmt_aout.c, and thus the ptrace_may_access() check has a race condition when reading /proc/pid/stat. NOTE: the software maintainer disputes that this is a vulnerability because ASLR for a.out format executables has never been supported ** EN DISPUTA ** En el kernel de Linux hasta de la versión 5.0.7, cuando CONFIG_IA32_AOUT está habilitado y ia32_aout está cargado, permite a los usuarios locales omitir ASLR en programas setuid a.out (si existe) porque install_exec_creds() es llamado demasiado tarde en load_aout_binary() en fs/binfmt_aout .c, y por lo tanto la comprobación ptrace_may_access() tiene una condición de carrera cuando se lee /proc/pid/stat. NOTA: el mantenedor de software discute que se trate de una vulnerabilidad porque ASLR para un archivo ejecutable de formato nunca fue compatible. • http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00039.html http://www.openwall.com/lists/oss-security/2019/04/18/5 http://www.openwall.com/lists/oss-security/2019/05/22/7 http://www.securityfocus.com/bid/107887 https://usn.ubuntu.com/4006-1 https://usn.ubuntu.com/4006-2 https://usn.ubuntu.com/4007-1 https://usn.ubuntu.com/4007-2 https://usn.ubuntu.com/4008-1 https://usn.ubuntu.com/4008-3 https://www.openwall.com/lists/oss- • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 4.7EPSS: 0%CPEs: 1EXPL: 2CVE-2019-11190 – kernel: ASLR bypass for setuid binaries due to late install_exec_creds()
https://notcve.org/view.php?id=CVE-2019-11190
The Linux kernel before 4.8 allows local users to bypass ASLR on setuid programs (such as /bin/su) because install_exec_creds() is called too late in load_elf_binary() in fs/binfmt_elf.c, and thus the ptrace_may_access() check has a race condition when reading /proc/pid/stat. El kernel de Linux anterior a la versión 4.8 permite a los usuarios locales eludir ASLR en programas setuid (como /bin/su) porque install_exec_creds() es llamado demasiado tarde en load_elf_binary() en fs/binfmt_elf.c, y por lo tanto la comprobación ptrace_may_access() tiene una condición de carrera al leer /proc/pid/stat. A flaw in the load_elf_binary() function in the Linux kernel allows a local attacker to leak the base address of .text and stack sections for setuid binaries and bypass ASLR because install_exec_creds() is called too late in this function. • http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00039.html http://www.openwall.com/lists/oss-security/2019/04/15/1 http://www.securityfocus.com/bid/107890 https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/commit/?id=a5b5352558f6808db0589644ea5401b3e3148a0d https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/commit/?id=e1676b55d874a43646e8b2c46d87f2f3e45516ff https://lists.debian.org/debian-lts-announce/2019/05/msg00041.html https://lists&# • CWE-250: Execution with Unnecessary Privileges CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2019-3837
https://notcve.org/view.php?id=CVE-2019-3837
It was found that the net_dma code in tcp_recvmsg() in the 2.6.32 kernel as shipped in RHEL6 is thread-unsafe. So an unprivileged multi-threaded userspace application calling recvmsg() for the same network socket in parallel executed on ioatdma-enabled hardware with net_dma enabled can leak the memory, crash the host leading to a denial-of-service or cause a random memory corruption. Se encontró que el código net_dma en la función tcp_recvmsg() en el kernel versión 2.6.32 tal como fue enviado en RHEL6 es no seguro para subprocesos. En consecuencia, una aplicación de espacio de usuario multihebra sin privilegios que llama a recvmsg() para el mismo socket de red en paralelo ejecutado en hardware habilitado para ioatdma con net_dma habilitado puede perder la memoria, bloquear el host y causar una denegación de servicio o causar un daño aleatorio en la memoria . • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3837 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-401: Missing Release of Memory after Effective Lifetime •
CVSS: 6.7EPSS: 0%CPEs: 19EXPL: 0CVE-2019-3887 – Kernel: KVM: nVMX: guest accesses L0 MSR causes potential DoS
https://notcve.org/view.php?id=CVE-2019-3887
A flaw was found in the way KVM hypervisor handled x2APIC Machine Specific Rregister (MSR) access with nested(=1) virtualization enabled. In that, L1 guest could access L0's APIC register values via L2 guest, when 'virtualize x2APIC mode' is enabled. A guest could use this flaw to potentially crash the host kernel resulting in DoS issue. Kernel versions from 4.16 and newer are vulnerable to this issue. Se encontró un error en la forma en que el hipervisor KVM manejaba el acceso a x2APIC Machine Specific Rregister (MSR) con la virtualización anidada (=1) habilitada. • http://www.securityfocus.com/bid/107850 https://access.redhat.com/errata/RHSA-2019:2703 https://access.redhat.com/errata/RHSA-2019:2741 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3887 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IWPOIII2L73HV5PGXSGMRMKQIK47UIYE https://usn.ubuntu.com/3979-1 https://usn.ubuntu.com/3980-1 https://usn.ubuntu.com/3980-2 https://access.redhat.com/security/cve/CVE-2019-3887 https://bugzilla • CWE-863: Incorrect Authorization •