CVSS: 6.3EPSS: 0%CPEs: 5EXPL: 0CVE-2018-1000204 – kernel: Infoleak caused by incorrect handling of the SG_IO ioctl
https://notcve.org/view.php?id=CVE-2018-1000204
Linux Kernel version 3.18 to 4.16 incorrectly handles an SG_IO ioctl on /dev/sg0 with dxfer_direction=SG_DXFER_FROM_DEV and an empty 6-byte cmdp. This may lead to copying up to 1000 kernel heap pages to the userspace. This has been fixed upstream in https://github.com/torvalds/linux/commit/a45b599ad808c3c982fdcdc12b0b8611c2f92824 already. The problem has limited scope, as users don't usually have permissions to access SCSI devices. On the other hand, e.g. the Nero user manual suggests doing `chmod o+r+w /dev/sg*` to make the devices accessible. • http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00043.html http://www.openwall.com/lists/oss-security/2018/06/26/3 https://access.redhat.com/errata/RHSA-2018:2948 https://github.com/torvalds/linux/commit/a45b599ad808c3c982fdcdc12b0b8611c2f92824 https://lists.debian.org/debian-lts-announce/2018/07/msg00015.html https://lists.debian.org/debian-lts-announce/2018/07/msg00016.html https://lists.debian.org/debian-lts-announce/2018/07/msg00020.html https://usn.ubuntu.com/3696-1& • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 1CVE-2018-12714
https://notcve.org/view.php?id=CVE-2018-12714
An issue was discovered in the Linux kernel through 4.17.2. The filter parsing in kernel/trace/trace_events_filter.c could be called with no filter, which is an N=0 case when it expected at least one line to have been read, thus making the N-1 index invalid. This allows attackers to cause a denial of service (slab out-of-bounds write) or possibly have unspecified other impact via crafted perf_event_open and mmap system calls. Se ha descubierto un problema en el kernel de Linux hasta la versión 4.17.2. El análisis del filtros en kernel/trace/trace_events_filter.c podría ser llamado sin un filtro, que es un caso N=0 cuando espera que, por lo menos, se haya leído una línea, lo que hace que el índice N-1 no sea válido. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=81f9c4e4177d31ced6f52a89bb70e93bfb77ca03 http://www.securityfocus.com/bid/104544 https://bugzilla.kernel.org/show_bug.cgi?id=200019 https://github.com/lcytxw/bug_repro/tree/master/bug_200019 https://github.com/torvalds/linux/commit/81f9c4e4177d31ced6f52a89bb70e93bfb77ca03 • CWE-787: Out-of-bounds Write •
CVSS: 6.3EPSS: 0%CPEs: 1EXPL: 0CVE-2018-12633
https://notcve.org/view.php?id=CVE-2018-12633
An issue was discovered in the Linux kernel through 4.17.2. vbg_misc_device_ioctl() in drivers/virt/vboxguest/vboxguest_linux.c reads the same user data twice with copy_from_user. The header part of the user data is double-fetched, and a malicious user thread can tamper with the critical variables (hdr.size_in and hdr.size_out) in the header between the two fetches because of a race condition, leading to severe kernel errors, such as buffer over-accesses. This bug can cause a local denial of service and information leakage. Se ha descubierto un problema en el kernel de Linux hasta la versión 4.17.2. vbg_misc_device_ioctl() en drivers/virt/vboxguest/vboxguest_linux.c lee los mismos datos de usuario dos veces con copy_from_user. La cabecera de los datos de usuario es de tipo double-fetch y un hilo de usuario malicioso puede falsificar las variables críticas (hdr.size_in y hdr.size_out) en la cabecera entre los dos fetch debido a una condición de carrera. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=bd23a7269834dc7c1f93e83535d16ebc44b75eba https://bugzilla.kernel.org/show_bug.cgi?id=200131 https://github.com/torvalds/linux/commit/bd23a7269834dc7c1f93e83535d16ebc44b75eba • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2016-10723
https://notcve.org/view.php?id=CVE-2016-10723
An issue was discovered in the Linux kernel through 4.17.2. Since the page allocator does not yield CPU resources to the owner of the oom_lock mutex, a local unprivileged user can trivially lock up the system forever by wasting CPU resources from the page allocator (e.g., via concurrent page fault events) when the global OOM killer is invoked. NOTE: the software maintainer has not accepted certain proposed patches, in part because of a viewpoint that "the underlying problem is non-trivial to handle. ** EN DISPUTA ** Se ha descubierto un problema en el kernel de Linux hasta la versión 4.17.2. Debido a que el asignador de páginas no asigna recursos de la CPU al propietario del mutex oom_lock mutex, un usuario local sin privilegios puede bloquear el sistema para siempre malgastando recursos de la CPU del asignador de la página (p.ej., mediante eventos concurrentes de error de página) cuando se invoca al killer OOM global. NOTA: el mantenedor de software no ha aceptado ciertos parches propuestos, en parte debido que, según su punto de vista, "el problema subyacente no es trivial de manejar". • https://patchwork.kernel.org/patch/10395909 https://patchwork.kernel.org/patch/9842889 https://www.spinics.net/lists/linux-mm/msg117896.html • CWE-399: Resource Management Errors •
CVSS: 7.0EPSS: 0%CPEs: 7EXPL: 0CVE-2018-5814
https://notcve.org/view.php?id=CVE-2018-5814
In the Linux Kernel before version 4.16.11, 4.14.43, 4.9.102, and 4.4.133, multiple race condition errors when handling probe, disconnect, and rebind operations can be exploited to trigger a use-after-free condition or a NULL pointer dereference by sending multiple USB over IP packets. En el kernel de Linux en versiones anteriores a la 4.16.11, 4.14.43, 4.9.102 y 4.4.133, múltiples errores de condición de carrera al gestionar operaciones probe, disconnect y rebind pueden explotarse para desencadenar una condición de uso de memoria previamente liberada o una desreferencia de puntero NULL mediante el envío de múltiples paquetes USB por IP. • http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00043.html http://www.securitytracker.com/id/1041050 https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.43 https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.16.11 https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.133 https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.102 https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git/commit/?id=2207 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •