CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 0CVE-2016-8632
https://notcve.org/view.php?id=CVE-2016-8632
The tipc_msg_build function in net/tipc/msg.c in the Linux kernel through 4.8.11 does not validate the relationship between the minimum fragment length and the maximum packet size, which allows local users to gain privileges or cause a denial of service (heap-based buffer overflow) by leveraging the CAP_NET_ADMIN capability. La función tipc_msg_build en net/tipc/msg.c en el kernel Linux hasta la versión 4.8.11 no valida la relación entre la longitud mínima de fragmento y el tamaño máximo de paquete, lo que permite a usuarios locales obtener privilegios o provocar una denegación de servicio (desbordamiento de búfer basado en memoria dinámica) aprovechando la capacidad CAP_NET_ADMIN. • http://www.openwall.com/lists/oss-security/2016/11/08/5 http://www.securityfocus.com/bid/94211 https://bugzilla.redhat.com/show_bug.cgi?id=1390832 https://www.mail-archive.com/netdev%40vger.kernel.org/msg133205.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2016-9191
https://notcve.org/view.php?id=CVE-2016-9191
The cgroup offline implementation in the Linux kernel through 4.8.11 mishandles certain drain operations, which allows local users to cause a denial of service (system hang) by leveraging access to a container environment for executing a crafted application, as demonstrated by trinity. La implementación offline cgroup en el kernel Linux hasta la versión 4.8.11 maneja incorrectamente ciertas operaciones drain, lo que permite a usuarios locales provocar una denegación de servicio (colgado de sistema) aprovechando el acceso al contenedor de ambiente para ejecutar una aplicación manipulada, como es demostrado por trinity. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=93362fa47fe98b62e4a34ab408c4a418432e7939 http://www.debian.org/security/2017/dsa-3791 http://www.openwall.com/lists/oss-security/2016/11/05/4 http://www.securityfocus.com/bid/94129 https://bugzilla.redhat.com/show_bug.cgi?id=1392439 https://github.com/torvalds/linux/commit/93362fa47fe98b62e4a34ab408c4a418432e7939 https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03802en_us • CWE-20: Improper Input Validation CWE-399: Resource Management Errors •
CVSS: 6.2EPSS: 0%CPEs: 1EXPL: 0CVE-2016-8630 – kernel: kvm: x86: NULL pointer dereference during instruction decode
https://notcve.org/view.php?id=CVE-2016-8630
The x86_decode_insn function in arch/x86/kvm/emulate.c in the Linux kernel before 4.8.7, when KVM is enabled, allows local users to cause a denial of service (host OS crash) via a certain use of a ModR/M byte in an undefined instruction. La función x86_decode_insn en arch/x86/kvm/emulate.c en el kernel Linux en versiones anteriores a 4.8.7, cuando KVM está habilitado, permite a usuarios locales provocar una denegación de servicio (caída de SO anfitrión ) a través de cierto uso del byte ModR/M en una instrucción no definida. Linux kernel built with the Kernel-based Virtual Machine (CONFIG_KVM) support is vulnerable to a null pointer dereference flaw. It could occur on x86 platform, when emulating an undefined instruction. An attacker could use this flaw to crash the host kernel resulting in DoS. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=d9092f52d7e61dd1557f2db2400ddb430e85937e http://rhn.redhat.com/errata/RHSA-2017-0386.html http://rhn.redhat.com/errata/RHSA-2017-0387.html http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.8.7 http://www.openwall.com/lists/oss-security/2016/11/22/3 http://www.securityfocus.com/bid/94459 https://bugzilla.redhat.com/show_bug.cgi?id=1393350 https://github.com/torvalds/linux/commit/d9092f52d7e61dd15 • CWE-284: Improper Access Control CWE-476: NULL Pointer Dereference •
CVSS: 9.3EPSS: 0%CPEs: 1EXPL: 1CVE-2016-9313
https://notcve.org/view.php?id=CVE-2016-9313
security/keys/big_key.c in the Linux kernel before 4.8.7 mishandles unsuccessful crypto registration in conjunction with successful key-type registration, which allows local users to cause a denial of service (NULL pointer dereference and panic) or possibly have unspecified other impact via a crafted application that uses the big_key data type. security/keys/big_key.c en el kernel Linux en versiones anteriores a 4.8.7 maneja incorrectamente un registro criptográfico no exitoso en conjunción con un registro key-type exitoso,lo que permite a usuarios locales provocar una denegación de servicio (referencia al puntero NULO y pánico) o tener otros posibles impactos no especificados a través de una aplicación manipulada que utiliza el tipo de dato big_key. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=7df3e59c3d1df4f87fe874c7956ef7a3d2f4d5fb http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.8.7 http://www.openwall.com/lists/oss-security/2016/07/22/1 http://www.securityfocus.com/bid/94546 https://github.com/torvalds/linux/commit/7df3e59c3d1df4f87fe874c7956ef7a3d2f4d5fb • CWE-476: NULL Pointer Dereference •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2016-9178
https://notcve.org/view.php?id=CVE-2016-9178
The __get_user_asm_ex macro in arch/x86/include/asm/uaccess.h in the Linux kernel before 4.7.5 does not initialize a certain integer variable, which allows local users to obtain sensitive information from kernel stack memory by triggering failure of a get_user_ex call. El macro __get_user_asm_ex en arch/x86/include/asm/uaccess.h en el kernel Linux en versiones anteriores a 4.7.5 no inicia ciertas variables de entero, lo que permite a usuarios locales obtener información sensible de la memoria basado en pila del kernel desencadenando un fallo de la llamada get_user_ex. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=1c109fabbd51863475cd12ac206bdd249aee35af http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.7.5 http://www.openwall.com/lists/oss-security/2016/11/04/4 http://www.securityfocus.com/bid/94144 https://bugzilla.redhat.com/show_bug.cgi?id=1391908 https://github.com/torvalds/linux/commit/1c109fabbd51863475cd12ac206bdd249aee35af • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •