CVSS: 7.8EPSS: 0%CPEs: 12EXPL: 9CVE-2024-1086 – Linux Kernel Use-After-Free Vulnerability
https://notcve.org/view.php?id=CVE-2024-1086
A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error which resembles NF_ACCEPT. We recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660. Una vulnerabilidad de use after free en el componente netfilter: nf_tables del kernel de Linux puede explotarse para lograr una escalada de privilegios local. La función nft_verdict_init() permite valores positivos como error de eliminación dentro del veredicto del gancho y, por lo tanto, la función nf_hook_slow() puede causar una vulnerabilidad double free cuando NF_DROP se emite con un error de eliminación similar a NF_ACCEPT. Recomendamos actualizar después del compromiso f342de4e2f33e0e39165d8639387aa6c19dff660. A flaw was found in the Netfilter subsystem in the Linux kernel. • https://github.com/Notselwyn/CVE-2024-1086 https://github.com/feely666/CVE-2024-1086 https://github.com/CCIEVoice2009/CVE-2024-1086 https://github.com/pl0xe/CVE-2024-1086 https://github.com/xzx482/CVE-2024-1086 https://github.com/kevcooper/CVE-2024-1086-checker http://www.openwall.com/lists/oss-security/2024/04/10/22 http://www.openwall.com/lists/oss-security/2024/04/10/23 http://www.openwall.com/lists/oss-security/2024/04/14/1 http://www.openwall.co • CWE-416: Use After Free •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2024-1085 – Use-after-free in Linux kernel's netfilter: nf_tables component
https://notcve.org/view.php?id=CVE-2024-1085
A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_setelem_catchall_deactivate() function checks whether the catch-all set element is active in the current generation instead of the next generation before freeing it, but only flags it inactive in the next generation, making it possible to free the element multiple times, leading to a double free vulnerability. We recommend upgrading past commit b1db244ffd041a49ecc9618e8feb6b5c1afcdaa7. Una vulnerabilidad de use after free en el componente netfilter: nf_tables del kernel de Linux puede explotarse para lograr una escalada de privilegios local. La función nft_setelem_catchall_deactivate() comprueba si el elemento del conjunto general está activo en la generación actual en lugar de en la siguiente generación antes de liberarlo, pero solo lo marca como inactivo en la siguiente generación, lo que permite liberar el elemento varias veces, lo que lleva a una vulnerabilidad double free. Recomendamos actualizar la confirmación anterior b1db244ffd041a49ecc9618e8feb6b5c1afcdaa7. A double-free flaw was found in how the Linux kernel's NetFilter system marks whether a catch-all element is enabled. • https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b1db244ffd041a49ecc9618e8feb6b5c1afcdaa7 https://kernel.dance/b1db244ffd041a49ecc9618e8feb6b5c1afcdaa7 https://access.redhat.com/security/cve/CVE-2024-1085 https://bugzilla.redhat.com/show_bug.cgi?id=2262127 • CWE-416: Use After Free •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 1CVE-2024-0564 – Kernel: max page sharing of kernel samepage merging (ksm) may cause memory deduplication
https://notcve.org/view.php?id=CVE-2024-0564
A flaw was found in the Linux kernel's memory deduplication mechanism. The max page sharing of Kernel Samepage Merging (KSM), added in Linux kernel version 4.4.0-96.119, can create a side channel. When the attacker and the victim share the same host and the default setting of KSM is "max page sharing=256", it is possible for the attacker to time the unmap to merge with the victim's page. The unmapping time depends on whether it merges with the victim's page and additional physical pages are created beyond the KSM's "max page share". Through these operations, the attacker can leak the victim's page. • https://access.redhat.com/security/cve/CVE-2024-0564 https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1680513 https://bugzilla.redhat.com/show_bug.cgi?id=2258514 https://link.springer.com/conference/wisa https://wisa.or.kr/accepted • CWE-99: Improper Control of Resource Identifiers ('Resource Injection') CWE-203: Observable Discrepancy •
CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 0CVE-2024-21803 – Possible UAF in bt_accept_poll in Linux kernel
https://notcve.org/view.php?id=CVE-2024-21803
Use After Free vulnerability in Linux Linux kernel kernel on Linux, x86, ARM (bluetooth modules) allows Local Execution of Code. This vulnerability is associated with program files https://gitee.Com/anolis/cloud-kernel/blob/devel-5.10/net/bluetooth/af_bluetooth.C. This issue affects Linux kernel: from v2.6.12-rc2 before v6.8-rc1. Vulnerabilidad de Use After Free en El kernel de Linux en Linux, x86, ARM (módulos bluetooth) permite la ejecución local de código. Esta vulnerabilidad está asociada con archivos de programa https://gitee.Com/anolis/cloud-kernel/blob/devel-5.10/net/bluetooth/af_bluetooth.C. Este problema afecta al kernel de Linux: desde v2.6.12-rc2 antes de v6.8-rc1. • https://bugzilla.openanolis.cn/show_bug.cgi?id=8081 • CWE-416: Use After Free •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2023-46838 – Linux: netback processing of zero-length transmit fragment
https://notcve.org/view.php?id=CVE-2023-46838
Transmit requests in Xen's virtual network protocol can consist of multiple parts. While not really useful, except for the initial part any of them may be of zero length, i.e. carry no data at all. Besides a certain initial portion of the to be transferred data, these parts are directly translated into what Linux calls SKB fragments. Such converted request parts can, when for a particular SKB they are all of length zero, lead to a de-reference of NULL in core networking code. Las solicitudes de transmisión en el protocolo de red virtual de Xen pueden constar de varias partes. • https://lists.debian.org/debian-lts-announce/2024/06/msg00016.html https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RGEKT4DKSDXDS34EL7M4UVJMMPH7Z3ZZ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZFYW6R64GPLUOXSQBJI3JBUX3HGLAYPP https://xenbits.xenproject.org/xsa/advisory-448.html • CWE-476: NULL Pointer Dereference •