CVSS: 4.7EPSS: 0%CPEs: 18EXPL: 1CVE-2012-4565 – kernel: net: divide by zero in tcp algorithm illinois
https://notcve.org/view.php?id=CVE-2012-4565
The tcp_illinois_info function in net/ipv4/tcp_illinois.c in the Linux kernel before 3.4.19, when the net.ipv4.tcp_congestion_control illinois setting is enabled, allows local users to cause a denial of service (divide-by-zero error and OOPS) by reading TCP stats. La función tcp_illinois_info en net/ipv4/tcp_illinois.c en el kernel de Linux antes de v3.4.19, cuando la opción net.ipv4.tcp_congestion_control illinois está habilitada, permite a usuarios locales provocar una denegación de servicio (división por cero y caída) mediante la lectura de estadísticas TCP. • http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=8f363b77ee4fbf7c3bbcf5ec2c5ca482d396d664 http://lists.fedoraproject.org/pipermail/package-announce/2012-November/091110.html http://rhn.redhat.com/errata/RHSA-2012-1580.html http://secunia.com/advisories/51409 http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.4.19 http://www.openwall.com/lists/oss-security/2012/10/31/5 http://www.securityfocus.com/bid/56346 http://www.ubuntu.com/usn/USN- • CWE-189: Numeric Errors •
CVSS: 6.6EPSS: 0%CPEs: 143EXPL: 1CVE-2012-4467
https://notcve.org/view.php?id=CVE-2012-4467
The (1) do_siocgstamp and (2) do_siocgstampns functions in net/socket.c in the Linux kernel before 3.5.4 use an incorrect argument order, which allows local users to obtain sensitive information from kernel memory or cause a denial of service (system crash) via a crafted ioctl call. Las funciones (1) do_siocgstamp y (2) do_siocgstampns en net/socket.c en el kernel Linux antes de v3.5.4, utiliza un orden incorrecto de los argumentos, lo que podría permitir a un usuario local obtener información sensible de la memoria del kernel o provocar una denegación de servicio (caída del sistema) a través de una llamada ioctl manipulada. • http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=ed6fe9d614fc1bca95eb8c0ccd0e92db00ef9d5d http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.5.4 http://www.openwall.com/lists/oss-security/2012/10/04/2 http://www.securityfocus.com/bid/55785 https://github.com/torvalds/linux/commit/ed6fe9d614fc1bca95eb8c0ccd0e92db00ef9d5d • CWE-399: Resource Management Errors •
CVSS: 4.4EPSS: 0%CPEs: 53EXPL: 1CVE-2012-3520 – kernel: af_netlink: invalid handling of SCM_CREDENTIALS passing
https://notcve.org/view.php?id=CVE-2012-3520
The Netlink implementation in the Linux kernel before 3.2.30 does not properly handle messages that lack SCM_CREDENTIALS data, which might allow local users to spoof Netlink communication via a crafted message, as demonstrated by a message to (1) Avahi or (2) NetworkManager. La implementación Netlink en el kernel Linux antes de v3.2.30, no controla correctamente los mensajes que carecen de datos SCM_CREDENTIALS, lo que podría permitir a usuarios locales falsificar la comunicación Netlink a través de un mensaje elaborado, como lo demuestra un mensaje para (1) Avahi o (2) NetworkManager. • http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=e0e3cea46d31d23dc40df0a49a7a2c04fe8edfea http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00005.html http://lists.opensuse.org/opensuse-updates/2013-02/msg00018.html http://secunia.com/advisories/50848 http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.2.30 http://www.openwall.com/lists/oss-security/2012/08/22/1 http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.h • CWE-287: Improper Authentication •
CVSS: 4.9EPSS: 0%CPEs: 126EXPL: 0CVE-2012-4398 – kernel: request_module() OOM local DoS
https://notcve.org/view.php?id=CVE-2012-4398
The __request_module function in kernel/kmod.c in the Linux kernel before 3.4 does not set a certain killable attribute, which allows local users to cause a denial of service (memory consumption) via a crafted application. La función __request_module en kernel/kmod.c en el kernel de Linux anterior a v3.4 no establece un atributo "killable", lo que permite a usuarios locales provocar una denegación de servicio (consumo de memoria) a través de una aplicación especialmente diseñada. • http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00010.html http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00025.html http://lkml.indiana.edu/hypermail/linux/kernel/1202.0/03340.html http://rhn.redhat.com/errata/RHSA-2013-0223.html http://rhn.redhat.com/errata/RHSA-2013-1348.html http://secunia.com/advisories/55077 http://www.kernel.org/pub/linux/kernel/v3.x/linux-3.4.tar.bz2 http://www.openwall.com/lists/oss-security/2012/09/02/3 h • CWE-20: Improper Input Validation •
CVSS: 2.1EPSS: 0%CPEs: 43EXPL: 2CVE-2012-3430 – Linux Kernel 2.6.x - 'rds_recvmsg()' Local Information Disclosure
https://notcve.org/view.php?id=CVE-2012-3430
The rds_recvmsg function in net/rds/recv.c in the Linux kernel before 3.0.44 does not initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via a (1) recvfrom or (2) recvmsg system call on an RDS socket. La función rds_recvmsg en net/rds/recv.c en el Kernell de Linux anteriores a v3.0.44 no inicializa el cierto miembro de la estructura, lo que permite a usuarios locales a obtener información potencialmente sensible de la pila de memoria del kernel a través de (1) recvfrom o (2) llamada a sistema recvmsg en un socket RDS. • https://www.exploit-db.com/exploits/37543 http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=06b6a1cf6e776426766298d055bb3991957d90a7 http://rhn.redhat.com/errata/RHSA-2012-1323.html http://secunia.com/advisories/50633 http://secunia.com/advisories/50732 http://secunia.com/advisories/50811 http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.0.44 http://www.openwall.com/lists/oss-security/2012/07/26/5 http://www.ubuntu.com/usn/USN- • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •