CVSS: 7.8EPSS: 7%CPEs: 306EXPL: 4CVE-2009-3613 – Linux Kernel 2.6.x - '/drivers/net/r8169.c' Out-of-IOMMU Error Local Denial of Service
https://notcve.org/view.php?id=CVE-2009-3613
The swiotlb functionality in the r8169 driver in drivers/net/r8169.c in the Linux kernel before 2.6.27.22 allows remote attackers to cause a denial of service (IOMMU space exhaustion and system crash) by using jumbo frames for a large amount of network traffic, as demonstrated by a flood ping. La funcionalidad swiotlb en el controlador r8169 en drivers/net/r8169.c en el núcleo de Linux anterior a v2.6.27.22 permite a atacantes remotos provocar una denegación de servicio (agotamiento de espacio en la Unidad de Gestión de E/S de memoria y parada del sistema) mediante la utilización de una tramas grandes para una gran cantidad de tráfico de red, como se ha demostrado con un desbordamiento ping. • https://www.exploit-db.com/exploits/33289 http://bugzilla.kernel.org/show_bug.cgi?id=9468 http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=97d477a914b146e7e6722ded21afa79886ae8ccd http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=a866bbf6aacf95f849810079442a20be118ce905 http://lists.opensuse.org/opensuse-security-announce/2009-12/msg00005.html http://lists.vmware.com/pipermail/security-announce/2010/000082.html http://marc.info/?l=o • CWE-399: Resource Management Errors •
CVSS: 2.1EPSS: 0%CPEs: 20EXPL: 0CVE-2009-3612 – kernel: tcf_fill_node() infoleak due to typo in 9ef1d4c7
https://notcve.org/view.php?id=CVE-2009-3612
The tcf_fill_node function in net/sched/cls_api.c in the netlink subsystem in the Linux kernel 2.6.x before 2.6.32-rc5, and 2.4.37.6 and earlier, does not initialize a certain tcm__pad2 structure member, which might allow local users to obtain sensitive information from kernel memory via unspecified vectors. NOTE: this issue exists because of an incomplete fix for CVE-2005-4881. La función tcf_fill_node en net/sched/cls_api.c del subsistema netlink en el kernel de Linux v2.6.x hasta la v2.6.32-rc5, y v2.4.37.6 y anteriores, no inicializa un determinado miembro de la estructura tcm__pad2, lo que puede permitir a usuarios locales obtener información confidencial de la memoria del kernel a través de vectores de ataque sin especificar. NOTA: esta vulnerabilidad existe debido a una solución incompleta de CVE-2005-4881. • http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=ad61df918c44316940404891d5082c63e79c256a http://lists.opensuse.org/opensuse-security-announce/2009-12/msg00002.html http://lists.opensuse.org/opensuse-security-announce/2009-12/msg00005.html http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00005.html http://lists.vmware.com/pipermail/security-announce/2010/000082.html http://patchwork.ozlabs.org/patch/35412 http://secunia.com/advisories/37086 http://secunia& • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.9EPSS: 0%CPEs: 97EXPL: 0CVE-2005-4881 – kernel: netlink: fix numerous padding memleaks
https://notcve.org/view.php?id=CVE-2005-4881
The netlink subsystem in the Linux kernel 2.4.x before 2.4.37.6 and 2.6.x before 2.6.13-rc1 does not initialize certain padding fields in structures, which might allow local users to obtain sensitive information from kernel memory via unspecified vectors, related to the (1) tc_fill_qdisc, (2) tcf_fill_node, (3) neightbl_fill_info, (4) neightbl_fill_param_info, (5) neigh_fill_info, (6) rtnetlink_fill_ifinfo, (7) rtnetlink_fill_iwinfo, (8) vif_delete, (9) ipmr_destroy_unres, (10) ipmr_cache_alloc_unres, (11) ipmr_cache_resolve, (12) inet6_fill_ifinfo, (13) tca_get_fill, (14) tca_action_flush, (15) tcf_add_notify, (16) tc_dump_action, (17) cbq_dump_police, (18) __nlmsg_put, (19) __rta_fill, (20) __rta_reserve, (21) inet6_fill_prefix, (22) rsvp_dump, and (23) cbq_dump_ovl functions. El subsistema netlink del kernel de Linux v2.4.x anteriores a la v2.4.37.6 y v2.6.x anteriores a la v2.6.13-rc1 no inicializa unos determinados campos de relleno de estructuras; lo que permite a usuarios locales obtener información confidencial de la memoria del kernel a través de vectores de ataque sin especificar, relacionados con las funciones (1) tc_fill_qdisc, (2) tcf_fill_node, (3) neightbl_fill_info, (4) neightbl_fill_param_info, (5) neigh_fill_info, (6) rtnetlink_fill_ifinfo, (7) rtnetlink_fill_iwinfo, (8) vif_delete, (9) ipmr_destroy_unres, (10) ipmr_cache_alloc_unres, (11) ipmr_cache_resolve, (12) inet6_fill_ifinfo, (13) tca_get_fill, (14) tca_action_flush, (15) tcf_add_notify, (16) tc_dump_action, (17) cbq_dump_police, (18) __nlmsg_put, (19) __rta_fill, (20) __rta_reserve, (21) inet6_fill_prefix, (22) rsvp_dump, y (23) cbq_dump_ovl. • http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.4.37.y.git%3Ba=commit%3Bh=0f3f2328f63c521fe4b435f148687452f98b2349 http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.4.37.y.git%3Ba=commit%3Bh=30e744716c4a6cc4e8ecaaddf68f20057c03dc8d http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.4.37.y.git%3Ba=commit%3Bh=3408cce0c2f380884070896420ca566704452fb5 http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=8a47077a0b5aa2649751c46e7a27884e6686ccbf http://git.kernel • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0CVE-2009-2908 – kernel ecryptfs NULL pointer dereference
https://notcve.org/view.php?id=CVE-2009-2908
The d_delete function in fs/ecryptfs/inode.c in eCryptfs in the Linux kernel 2.6.31 allows local users to cause a denial of service (kernel OOPS) and possibly execute arbitrary code via unspecified vectors that cause a "negative dentry" and trigger a NULL pointer dereference, as demonstrated via a Mutt temporary directory in an eCryptfs mount. La función d_delete function en fs/ecryptfs/inode.c en eCryptfs en el kernel de Linux v2.6.31 permite a usuarios locales causar una denegación de servicio (kernel OOPS) y probablemente ejecutar código de su elección a través de vectores no especificados que causa una "entrada negativa" y ejecuta una deferencia a puntero NULL, como fue demostrado a través del directorio temporal Mutt en eCryptifs. • http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.31.y.git%3Ba=commit%3Bh=afc2b6932f48f200736d3e36ad66fee0ec733136 http://lists.vmware.com/pipermail/security-announce/2010/000082.html http://secunia.com/advisories/37075 http://secunia.com/advisories/37105 http://secunia.com/advisories/38794 http://secunia.com/advisories/38834 http://www.openwall.com/lists/oss-security/2009/10/06/1 http://www.securityfocus.com/bid/36639 http://www.ubuntu.com/usn/USN-852-1 http:/ • CWE-476: NULL Pointer Dereference •
CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 0CVE-2009-3290 – kernel: KVM: x86: Disallow hypercalls for guest callers in rings > 0
https://notcve.org/view.php?id=CVE-2009-3290
The kvm_emulate_hypercall function in arch/x86/kvm/x86.c in KVM in the Linux kernel 2.6.25-rc1, and other versions before 2.6.31, when running on x86 systems, does not prevent access to MMU hypercalls from ring 0, which allows local guest OS users to cause a denial of service (guest kernel crash) and read or write guest kernel memory via unspecified "random addresses." La función kvm_emulate_hypercall en el archivo arch/x86/kvm/x86.c en KVM en el kernel de Linux versión 2.6.25-rc1 y otras versiones anteriores a 2.6.31, cuando se ejecuta en sistemas x86, no impide el acceso a hiperllamadas MMU desde el timbre 0, lo que permite a los usuarios del sistema operativo invitado local causar una denegación de servicio (bloqueo del kernel invitado) y leer o escribir la memoria del kernel invitado por medio de "random addresses” no especificadas. • http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff%3Bh=07708c4af1346ab1521b26a202f438366b7bcffd http://patchwork.kernel.org/patch/38926 http://secunia.com/advisories/37105 http://www.openwall.com/lists/oss-security/2009/09/18/1 http://www.openwall.com/lists/oss-security/2009/09/21/1 http://www.openwall.com/lists/oss-security/2009/09/22/8 http://www.redhat.com/support/errata/RHSA-2009-1465.html http://www.ubuntu.com/usn/USN-852-1 https& • CWE-399: Resource Management Errors CWE-648: Incorrect Use of Privileged APIs •