CVSS: 7.8EPSS: 0%CPEs: 7EXPL: 0CVE-2018-10901 – kernel: kvm: vmx: host GDT limit corruption
https://notcve.org/view.php?id=CVE-2018-10901
A flaw was found in Linux kernel's KVM virtualization subsystem. The VMX code does not restore the GDT.LIMIT to the previous host value, but instead sets it to 64KB. With a corrupted GDT limit a host's userspace code has an ability to place malicious entries in the GDT, particularly to the per-cpu variables. An attacker can use this to escalate their privileges. Se encontró un fallo en el subsistema de virtualización KVM del kernel de Linux. • http://www.securityfocus.com/bid/104905 https://access.redhat.com/errata/RHSA-2018:2390 https://access.redhat.com/errata/RHSA-2018:2391 https://access.redhat.com/errata/RHSA-2018:2392 https://access.redhat.com/errata/RHSA-2018:2393 https://access.redhat.com/errata/RHSA-2018:2394 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10901 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3444d7da1839b851eefedd372978d8a982316c36 https://help.ecostruxureit. • CWE-665: Improper Initialization •
CVSS: 7.1EPSS: 0%CPEs: 6EXPL: 2CVE-2018-10880 – kernel: stack-out-of-bounds write in ext4_update_inline_data function
https://notcve.org/view.php?id=CVE-2018-10880
Linux kernel is vulnerable to a stack-out-of-bounds write in the ext4 filesystem code when mounting and writing to a crafted ext4 image in ext4_update_inline_data(). An attacker could use this to cause a system crash and a denial of service. El kernel de Linux es vulnerable a una escritura de pila fuera de límites en el código del sistema de archivos al montar y escribir en una imagen ext4 manipulada en ext4_update_inline_data(). Un atacante podría utilizar esto para provocar un cierre inesperado del sistema y una denegación de servicio (DoS). A flaw was found in the Linux kernel's ext4 filesystem code. • http://patchwork.ozlabs.org/patch/930639 http://www.securityfocus.com/bid/104907 http://www.securityfocus.com/bid/106503 https://access.redhat.com/errata/RHSA-2018:2948 https://bugzilla.kernel.org/show_bug.cgi?id=200005 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10880 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=8cdb5240ec5928b20490a2bb34cb87e9a5f40226 https://lists.debian.org/debian-lts-announce/2018/07/msg00020.html https://usn.ubuntu. • CWE-787: Out-of-bounds Write •
CVSS: 7.3EPSS: 0%CPEs: 7EXPL: 0CVE-2018-10877 – kernel: out-of-bound access in ext4_ext_drop_refs function with a crafted ext4 image
https://notcve.org/view.php?id=CVE-2018-10877
Linux kernel ext4 filesystem is vulnerable to an out-of-bound access in the ext4_ext_drop_refs() function when operating on a crafted ext4 filesystem image. El sistema de archivos ext4 del kernel de Linux es vulnerable a un acceso fuera de límites en la función ext4_ext_drop_refs() al operar en una imagen manipulada del sistema de archivos ext4. A flaw was found in the Linux kernel ext4 filesystem. An out-of-bound access is possible in the ext4_ext_drop_refs() function when operating on a crafted ext4 filesystem image. • http://www.securityfocus.com/bid/104878 http://www.securityfocus.com/bid/106503 https://access.redhat.com/errata/RHSA-2018:2948 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10877 https://lists.debian.org/debian-lts-announce/2018/07/msg00020.html https://usn.ubuntu.com/3753-1 https://usn.ubuntu.com/3753-2 https://usn.ubuntu.com/3754-1 https://usn.ubuntu.com/3871-1 https://usn.ubuntu.com/3871-3 https://usn.ubuntu.com/3871-4 https://usn&# • CWE-125: Out-of-bounds Read •
CVSS: 7.0EPSS: 0%CPEs: 5EXPL: 0CVE-2018-5873
https://notcve.org/view.php?id=CVE-2018-5873
An issue was discovered in the __ns_get_path function in fs/nsfs.c in the Linux kernel before 4.11. Due to a race condition when accessing files, a Use After Free condition can occur. This also affects all Android releases from CAF using the Linux kernel (Android for MSM, Firefox OS for MSM, QRD Android) before security patch level 2018-07-05. Debido a una condición de carrera al acceder a los archivos en todas las distribuciones de Android de CAF (Android for MSM, Firefox OS for MSM y QRD Android) que utilizan el kernel de Linux antes del parche de seguridad de nivel del 05/07/2018, puede ocurrir una condición de uso de memoria previamente liberada en el kernel. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=073c516ff73557a8f7315066856c04b50383ac34 https://github.com/torvalds/linux/commit/073c516ff73557a8f7315066856c04b50383ac34 https://source.android.com/security/bulletin/2018-07-01 https://source.codeaurora.org/quic/la/kernel/msm-4.9/commit/?id=34742aaf7cb16c95edba4a7afed6d2c4fa7e434b https://www.codeaurora.org/security-bulletin/2018/07/02/july-2018-code-aurora-security-bulletin • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-416: Use After Free •
CVSS: 7.8EPSS: 0%CPEs: 92EXPL: 1CVE-2018-13405 – Linux (Ubuntu) - Other Users coredumps Can Be Read via setgid Directory and killpriv Bypass
https://notcve.org/view.php?id=CVE-2018-13405
The inode_init_owner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of that group. Here, the non-member can trigger creation of a plain file whose group ownership is that group. The intended behavior was that the non-member can trigger creation of a directory (but not a plain file) whose group ownership is that group. The non-member can escalate privileges by making the plain file executable and SGID. La función inode_init_owner en fs/inode.c en el kernel de Linux hasta la versión 3.16 permite a los usuarios locales crear archivos con una propiedad de grupo no deseada, en un escenario donde un directorio es SGID a un cierto grupo y es escribible por un usuario que no es miembro de ese grupo. • https://www.exploit-db.com/exploits/45033 http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=0fa3ecd87848c9c93c2c828ef4c3a8ca36ce46c7 http://openwall.com/lists/oss-security/2018/07/13/2 http://www.securityfocus.com/bid/106503 https://access.redhat.com/errata/RHSA-2018:2948 https://access.redhat.com/errata/RHSA-2018:3083 https://access.redhat.com/errata/RHSA-2018:3096 https://access.redhat.com/errata/RHSA-2019:0717 https://access.redhat.com/errata/RHSA- • CWE-269: Improper Privilege Management CWE-284: Improper Access Control •