CVSS: 6.9EPSS: 0%CPEs: 1EXPL: 1CVE-2010-4527 – kernel: buffer overflow in OSS load_mixer_volumes
https://notcve.org/view.php?id=CVE-2010-4527
The load_mixer_volumes function in sound/oss/soundcard.c in the OSS sound subsystem in the Linux kernel before 2.6.37 incorrectly expects that a certain name field ends with a '\0' character, which allows local users to conduct buffer overflow attacks and gain privileges, or possibly obtain sensitive information from kernel memory, via a SOUND_MIXER_SETLEVELS ioctl call. La función load_mixer_volumes en sound/oss/soundcard.c en el subsistema de sonido OSS del núcleo Linux anterior a v2.6.37 espera incorrectamente a que determinado nombre de campo termine con un carácter '\0', lo que permite a usuarios locales llevar a cabo ataques de desbordamiento de búfer y obtener privilegios o, posiblemente, obtener información sensible de la memoria del núcleo, a través de una llamada SOUND_MIXER_SETLEVELS ioctl. • http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=d81a12bc29ae4038770e05dce4ab7f26fd5880fb http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00002.html http://openwall.com/lists/oss-security/2010/12/31/1 http://openwall.com/lists/oss-security/2010/12/31/4 http://secunia.com/advisories/42765 http://secunia.com/advisories/43291 http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.37 http://www.securityfocus.com/bid/45629 http& • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 4.0EPSS: 0%CPEs: 1EXPL: 1CVE-2010-4242 – kernel: missing tty ops write function presence check in hci_uart_tty_open()
https://notcve.org/view.php?id=CVE-2010-4242
The hci_uart_tty_open function in the HCI UART driver (drivers/bluetooth/hci_ldisc.c) in the Linux kernel 2.6.36, and possibly other versions, does not verify whether the tty has a write operation, which allows local users to cause a denial of service (NULL pointer dereference) via vectors related to the Bluetooth driver. La función hci_uart_tty_open del controlador HCI UART (drivers/bluetooth/hci_ldisc.c) del kernel de Linux 2.6.36, y posiblemente otras versiones, no verifica si el tty tiene una operación de escritura, lo que permite a usuarios locales provocar una denegación de servicio (desreferenciación de puntero a NULL) a través de vectores relacionados con el controlador de Bluetooth. • http://git.kernel.org/linus/c19483cc5e56ac5e22dd19cf25ba210ab1537773 http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00002.html http://secunia.com/advisories/42789 http://secunia.com/advisories/42890 http://secunia.com/advisories/42963 http://secunia.com/advisories/43291 http://secunia.com/advisories/46397 http://www.redhat.com/support/errata/RHSA-2011-0004.html http://www.redhat.com/support/errata/RHSA-2011-0007.html http://www.redhat.com/support/errata/RHSA-2011-0162.ht •
CVSS: 7.1EPSS: 6%CPEs: 8EXPL: 0CVE-2010-4526 – kernel: sctp: a race between ICMP protocol unreachable and connect()
https://notcve.org/view.php?id=CVE-2010-4526
Race condition in the sctp_icmp_proto_unreachable function in net/sctp/input.c in Linux kernel 2.6.11-rc2 through 2.6.33 allows remote attackers to cause a denial of service (panic) via an ICMP unreachable message to a socket that is already locked by a user, which causes the socket to be freed and triggers list corruption, related to the sctp_wait_for_connect function. Condición de carrera en el kernel de Linux 2.6.11-rc2 hasta 2.6.33. Permite a atacantes remotos provocar una denegación de servicio (kernel panic) a través de un mensaje no enrutable ICMP a un socket que ya se encuentra bloqueado por un usuario, lo que provoca que el socket sea liberado y una corrupción de lista. Relacionado con la función sctp_wait_for_connect. • http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff%3Bh=50b5d6ad63821cea324a5a7a19854d4de1a0a819 http://secunia.com/advisories/42964 http://secunia.com/advisories/46397 http://www.openwall.com/lists/oss-security/2011/01/04/13 http://www.openwall.com/lists/oss-security/2011/01/04/3 http://www.redhat.com/support/errata/RHSA-2011-0163.html http://www.securityfocus.com/archive/1/520102/100/0/threaded http://www.securityfocus.com/bid/45661 http:/&# • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 4.9EPSS: 0%CPEs: 1EXPL: 0CVE-2010-4175
https://notcve.org/view.php?id=CVE-2010-4175
Integer overflow in the rds_cmsg_rdma_args function (net/rds/rdma.c) in Linux kernel 2.6.35 allows local users to cause a denial of service (crash) and possibly trigger memory corruption via a crafted Reliable Datagram Sockets (RDS) request, a different vulnerability than CVE-2010-3865. Desbordamiento de entero en la función rds_cmsg_rdma_args (net/rds/rdma.c) del kernel de Linux 2.6.35. Permite a usuarios locales provocar una denegación de servicio (caída) y posiblemente una corrupción de memoria a través de una petición RDS ("Reliable Datagram Sockets"). Una vulnerabilidad distinta a la CVE-2010-3865. • http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00000.html http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00004.html http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.html http://marc.info/?l=linux-netdev&m=129001184803080&w=2 http://secunia.com/advisories/42778 http://secunia.com/advisories/42801 http://secunia.com/advisories/42932 http://www.openwall.com/lists&# • CWE-189: Numeric Errors •
CVSS: 7.2EPSS: 0%CPEs: 5EXPL: 0CVE-2010-3865 – kernel: iovec integer overflow in net/rds/rdma.c
https://notcve.org/view.php?id=CVE-2010-3865
Integer overflow in the rds_rdma_pages function in net/rds/rdma.c in the Linux kernel allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a crafted iovec struct in a Reliable Datagram Sockets (RDS) request, which triggers a buffer overflow. Desbordamiento de enteros en la función rds_rdma_pages en net/rds/rdma.c en el núcleo de Linux permite a usuarios locales causar una denegación de servicio (caída) y posiblemente ejecutar código de su elección a través de una estructura iovec manipulada en una petición Reliable Datagram Sockets (RDS), que provoca un desbordamiento de búfer. • http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00004.html http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00000.html http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.html http://secunia.com/advisories/42778 http://secunia.com/advisories/42789 http://secunia.com/advisories/42801 http://secunia.com/advisories/42890 http://secunia.com/advisories/46397 http://www.ope • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-190: Integer Overflow or Wraparound •