CVSS: 8.7EPSS: 0%CPEs: 22EXPL: 1CVE-2021-22543 – Improper memory handling in Linux KVM
https://notcve.org/view.php?id=CVE-2021-22543
An issue was discovered in Linux: KVM through Improper handling of VM_IO|VM_PFNMAP vmas in KVM can bypass RO checks and can lead to pages being freed while still accessible by the VMM and guest. This allows users with the ability to start and control a VM to read/write random pages of memory and can result in local privilege escalation. Se detectó un problema en Linux: KVM mediante del manejo inapropiado de Los vmas VM_IO|VM_PFNMAP en KVM pueden omitir unas comprobaciones RO y puede conllevar a que las páginas sean liberadas mientras el VMM y el invitado aún pueden acceder a ellas. Esto permite a usuarios con la capacidad de iniciar y controlar una máquina virtual leer y escribir páginas aleatorias de memoria y puede resultar en una escalada de privilegios local A flaw was found in the Linux kernel’s KVM implementation, where improper handing of the VM_IO|VM_PFNMAP VMAs in KVM bypasses RO checks and leads to pages being freed while still accessible by the VMM and guest. This flaw allows users who can start and control a VM to read/write random pages of memory, resulting in local privilege escalation. • http://www.openwall.com/lists/oss-security/2021/06/26/1 https://github.com/google/security-research/security/advisories/GHSA-7wq5-phmq-m584 https://lists.debian.org/debian-lts-announce/2021/10/msg00010.html https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4G5YBUVEPHZYXMKNGBZ3S6INFCTEEL4E https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ROQIXQB7ZAWI3KSGSHR6H5RDUWZI77 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-863: Incorrect Authorization •
CVSS: 7.2EPSS: 0%CPEs: 15EXPL: 0CVE-2014-0069 – kernel: cifs: incorrect handling of bogus user pointers during uncached writes
https://notcve.org/view.php?id=CVE-2014-0069
The cifs_iovec_write function in fs/cifs/file.c in the Linux kernel through 3.13.5 does not properly handle uncached write operations that copy fewer than the requested number of bytes, which allows local users to obtain sensitive information from kernel memory, cause a denial of service (memory corruption and system crash), or possibly gain privileges via a writev system call with a crafted pointer. La función cifs_iovec_write en fs/cifs/file.c en el kernel de Linux hasta 3.13.5 no maneja debidamente operaciones de escritura no en caché que copian menos bytes de los solicitados, lo que permite a usuarios locales obtener información sensible de la memoria del kernel, causar una denegación de servicio (corrupción de memoria y caída del sistema) o posiblemente ganar privilegios a través de una llamada al sistema writev con un puntero manipulado. • http://article.gmane.org/gmane.linux.kernel.cifs/9401 http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=5d81de8e8667da7135d3a32a964087c0faf5483f http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00026.html http://rhn.redhat.com/errata/RHSA-2014-0328.html http://www.openwall.com/lists/oss-security/2014/02/17/4 http://www.securityfocus.com/bid/65588 https://bugzilla.redhat.com/show_bug.cgi?id=1064253 https://github.com/torvalds/linux/comm • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.2EPSS: 0%CPEs: 12EXPL: 2CVE-2009-0342
https://notcve.org/view.php?id=CVE-2009-0342
Niels Provos Systrace before 1.6f on the x86_64 Linux platform allows local users to bypass intended access restrictions by making a 64-bit syscall with a syscall number that corresponds to a policy-compliant 32-bit syscall. Niels Provos Systrace anteriores a v1.6f en las plataformas Linux x86_64 permite a usuarios locales evitar las restricciones de acceso previstas mediante una syscal de 64 bit con un número de llamada correspondiente a una llamada de 32 bit. • http://scary.beasts.org/security/CESA-2009-001.html http://scarybeastsecurity.blogspot.com/2009/01/bypassing-syscall-filtering.html http://www.citi.umich.edu/u/provos/systrace http://www.securityfocus.com/archive/1/500377/100/0/threaded http://www.securityfocus.com/bid/33417 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.2EPSS: 0%CPEs: 12EXPL: 3CVE-2009-0343 – Systrace 1.x (Linux Kernel x64) - Aware Local Privilege Escalation
https://notcve.org/view.php?id=CVE-2009-0343
Niels Provos Systrace 1.6f and earlier on the x86_64 Linux platform allows local users to bypass intended access restrictions by making a 32-bit syscall with a syscall number that corresponds to a policy-compliant 64-bit syscall, related to race conditions that occur in monitoring 64-bit processes. Niels Provos Systrace v1.6f y anteriores en las plataformas Linux x86_64 permite a usuarios locales evitar las restricciones de acceso previstas, mediante una syscal de 32 bit, con un número correspondiente a una llamada de 64 bit. Relacionada con las condiciones de carrera en la monitorización de procesos de 64 bit. • https://www.exploit-db.com/exploits/32751 http://scary.beasts.org/security/CESA-2009-001.html http://scarybeastsecurity.blogspot.com/2009/01/bypassing-syscall-filtering.html http://www.citi.umich.edu/u/provos/systrace http://www.securityfocus.com/archive/1/500377/100/0/threaded http://www.securityfocus.com/bid/33417 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.6EPSS: 0%CPEs: 5EXPL: 0CVE-2001-0886
https://notcve.org/view.php?id=CVE-2001-0886
Buffer overflow in glob function of glibc allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via a glob pattern that ends in a brace "{" character. Desbordamiento de buffer en la función glob de glibc para Red Hat Linux 6.2 a 7.2, y otros sistemas operativos, permite a atacantes causar una denegación de servicio (caída) y posiblemente ejecutar código arbitrarios mediante un patrón de glob que acaba en una llave "{" • http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000447 http://download.immunix.org/ImmunixOS/7.0/updates/IMNX-2001-70-037-01 http://sources.redhat.com/ml/bug-glibc/2001-11/msg00109.html http://www.ciac.org/ciac/bulletins/m-029.shtml http://www.debian.org/security/2002/dsa-103 http://www.linux-mandrake.com/en/security/2001/MDKSA-2001-095.php3 http://www.linuxsecurity.com/advisories/other_advisory-1752.html http://www.redhat.com/support/errata/RHSA-2001-160&# •