CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2016-9576 – kernel: Use after free in SCSI generic device interface
https://notcve.org/view.php?id=CVE-2016-9576
The blk_rq_map_user_iov function in block/blk-map.c in the Linux kernel before 4.8.14 does not properly restrict the type of iterator, which allows local users to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging access to a /dev/sg device. La función blk_rq_map_user_iov en block/blk-map.c en el kernel de Linux en versiones anteriores a 4.8.14 no restringe adecuadamente el tipo de iterador, lo que permite a usuarios locales leer o escribir a ubicaciones de memoria del kernel arbitrarias o provocar una denegación de servicio (uso después de liberación de memoria) aprovechando acceso a un dispositivo /dev/sg. It was found that the blk_rq_map_user_iov() function in the Linux kernel's block device implementation did not properly restrict the type of iterator, which could allow a local attacker to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging write access to a /dev/sg device. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=a0ac402cfcdc904f9772e1762b3fda112dcc56a0 http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00040.html http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00041.html http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00057.html http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00062.html http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00072.html http://lists.opensuse.org • CWE-416: Use After Free •
CVSS: 4.7EPSS: 0%CPEs: 1EXPL: 0CVE-2016-6213 – kernel: Overflowing kernel mount table using shared bind mount
https://notcve.org/view.php?id=CVE-2016-6213
fs/namespace.c in the Linux kernel before 4.9 does not restrict how many mounts may exist in a mount namespace, which allows local users to cause a denial of service (memory consumption and deadlock) via MS_BIND mount system calls, as demonstrated by a loop that triggers exponential growth in the number of mounts. fs/namespace.c en el kernel de Linux en versiones anteriores a 4.9 no restringe la cantidad de montajes que pueden existir en un espacio de nombre del montaje, lo que permite a usuarios locales provocar una denegación de servicio (consumo de memoria y punto muerto) a través de llamadas al sistema de montaje MS_BIND, según lo demostrado por un bucle que desencadena un crecimiento exponencial en el número de montajes. It was found that in Linux kernel the mount table expands by a power-of-two with each bind mount command. If a system is configured to allow non-privileged user to do bind mounts, or allows to do so in a container or unprivileged mount namespace, then non-privileged user is able to cause a local DoS by overflowing the mount table, which causes a deadlock for the whole system. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=d29216842a85c7970c536108e093963f02714498 http://www.openwall.com/lists/oss-security/2016/07/13/8 http://www.securityfocus.com/bid/91754 https://access.redhat.com/errata/RHSA-2017:1842 https://access.redhat.com/errata/RHSA-2017:2077 https://bugzilla.redhat.com/show_bug.cgi?id=1356471 https://github.com/torvalds/linux/commit/d29216842a85c7970c536108e093963f02714498 https://access.redhat.com/security/cve/CVE-2016-6213 • CWE-400: Uncontrolled Resource Consumption CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2016-9919
https://notcve.org/view.php?id=CVE-2016-9919
The icmp6_send function in net/ipv6/icmp.c in the Linux kernel through 4.8.12 omits a certain check of the dst data structure, which allows remote attackers to cause a denial of service (panic) via a fragmented IPv6 packet. La función icmp6_send en net/ipv6/icmp.c en el kernel de Linux hasta la versión 4.8.12 omite una cierta comprobación de la estructura de datos dst, lo que permite a atacantes remotos provocar una denegación de servicio (pánico) a través de un paquete IPv6 fragmentado. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=79dc7e3f1cd323be4c81aa1a94faa1b3ed987fb2 http://www.openwall.com/lists/oss-security/2016/12/08/15 http://www.securityfocus.com/bid/94824 https://github.com/torvalds/linux/commit/79dc7e3f1cd323be4c81aa1a94faa1b3ed987fb2 • CWE-20: Improper Input Validation •
CVSS: 7.8EPSS: 0%CPEs: 12EXPL: 5CVE-2016-8655 – Linux 4.4.0 < 4.4.0-53 - 'AF_PACKET chocobo_root' Local Privilege Escalation
https://notcve.org/view.php?id=CVE-2016-8655
Race condition in net/packet/af_packet.c in the Linux kernel through 4.8.12 allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging the CAP_NET_RAW capability to change a socket version, related to the packet_set_ring and packet_setsockopt functions. Condición de carrera en net/packet/af_packet.c en el kernel de Linux hasta la versión 4.8.12 permite a usuarios locales obtener privilegios o provocar una denegación de servicio (uso después de liberación de memoria) aprovechando la capacidad CAP_NET_RAW de cambiar una versión socket, relacionado con las funciones packet_set_ring y packet_setsockopt. A race condition issue leading to a use-after-free flaw was found in the way the raw packet sockets implementation in the Linux kernel networking subsystem handled synchronization while creating the TPACKET_V3 ring buffer. A local user able to open a raw packet socket (requires the CAP_NET_RAW capability) could use this flaw to elevate their privileges on the system. • https://www.exploit-db.com/exploits/44696 https://www.exploit-db.com/exploits/40871 https://www.exploit-db.com/exploits/47170 https://github.com/LakshmiDesai/CVE-2016-8655 https://github.com/KosukeShimofuji/CVE-2016-8655 http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=84ac7260236a49c79eede91617700174c2c19b0c http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00044.html http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00054.html http://l • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-416: Use After Free •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2016-8650 – kernel: Null pointer dereference via keyctl
https://notcve.org/view.php?id=CVE-2016-8650
The mpi_powm function in lib/mpi/mpi-pow.c in the Linux kernel through 4.8.11 does not ensure that memory is allocated for limb data, which allows local users to cause a denial of service (stack memory corruption and panic) via an add_key system call for an RSA key with a zero exponent. La función mpi_powm en lib/mpi/mpi-pow.c en el kernel Linux hasta la versión 4.8.11 no se asegura que la memoria esté alojada para datos limb, lo que permite a usuarios locales provocar una denegación de servicio (corrupción de memoria de pila y pánico) a través de una llamada de sistema add_key para una llave RSA con un componente cero. A flaw was found in the Linux kernel key management subsystem in which a local attacker could crash the kernel or corrupt the stack and additional memory (denial of service) by supplying a specially crafted RSA key. This flaw panics the machine during the verification of the RSA key. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f5527fffff3f002b0a6b376163613b82f69de073 http://seclists.org/fulldisclosure/2016/Nov/76 http://www.openwall.com/lists/oss-security/2016/11/24/8 http://www.securityfocus.com/bid/94532 http://www.securitytracker.com/id/1037968 https://access.redhat.com/errata/RHSA-2017:0931 https://access.redhat.com/errata/RHSA-2017:0932 https://access.redhat.com/errata/RHSA-2017:0933 https://access.redhat.com/errata/RHSA- • CWE-20: Improper Input Validation CWE-399: Resource Management Errors CWE-476: NULL Pointer Dereference •