CVSS: 7.8EPSS: 0%CPEs: 8EXPL: 0CVE-2017-11473 – kernel: Buffer overflow in mp_override_legacy_irq()
https://notcve.org/view.php?id=CVE-2017-11473
Buffer overflow in the mp_override_legacy_irq() function in arch/x86/kernel/acpi/boot.c in the Linux kernel through 3.2 allows local users to gain privileges via a crafted ACPI table. Desbordamiento de búfer en la función mp_override_legacy_irq() en arch/x86/kernel/acpi/boot.c en el kernel de Linux hasta la versión 3.2 permite que los usuarios locales obtengan privilegios mediante una tabla ACPI manipulada. Buffer overflow in the mp_override_legacy_irq() function in arch/x86/kernel/acpi/boot.c in the Linux kernel through 4.12.2 allows local users to gain privileges via a crafted ACPI table. • http://www.securityfocus.com/bid/100010 https://access.redhat.com/errata/RHSA-2018:0654 https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=70ac67826602edf8c0ccb413e5ba7eacf597a60c https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=96301209473afd3f2f274b91cb7082d161b9be65 https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=dad5ab0db8deac535d03e3fe3d8f2892173fa6a4 https://source.android.com/security/bulletin/pixel/2018-01-01 https://usn.u • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 0%CPEs: 10EXPL: 4CVE-2017-11176 – Linux Kernel < 4.11.8 - 'mq_notify: double sock_put()' Local Privilege Escalation
https://notcve.org/view.php?id=CVE-2017-11176
The mq_notify function in the Linux kernel through 4.11.9 does not set the sock pointer to NULL upon entry into the retry logic. During a user-space close of a Netlink socket, it allows attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact. La función mq_notify en el kernel de Linux hasta versión 4.11.9 no se ajusta el puntero sock a NULL al ingresar a la lógica de reintento. Durante un cierre de espacio de usuario de un socket Netlink, permite que los atacantes causen una denegación de servicio (uso de memoria previamente liberada) o posiblemente tengan otro impacto no especificado. A use-after-free flaw was found in the Netlink functionality of the Linux kernel networking subsystem. • https://www.exploit-db.com/exploits/45553 https://github.com/c3r34lk1ll3r/CVE-2017-11176 https://github.com/Sama-Ayman-Mokhtar/CVE-2017-11176 https://github.com/HckEX/CVE-2017-11176 http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f991af3daabaecff34684fd51fac80319d1baad1 http://www.debian.org/security/2017/dsa-3927 http://www.debian.org/security/2017/dsa-3945 http://www.securityfocus.com/bid/99919 https://access.redhat.com/errata/RHSA-2017:2918 https: • CWE-416: Use After Free •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2017-10911
https://notcve.org/view.php?id=CVE-2017-10911
The make_response function in drivers/block/xen-blkback/blkback.c in the Linux kernel before 4.11.8 allows guest OS users to obtain sensitive information from host OS (or other guest OS) kernel memory by leveraging the copying of uninitialized padding fields in Xen block-interface response structures, aka XSA-216. La función make_response en el archivo drivers/block/xen-blkback/blkback.c en el kernel de Linux anterior a versión 4.11.8, permite a los usuarios del sistema operativo invitado obtener información confidencial de la memoria del kernel del sistema operativo host (u otro sistema operativo invitado) mediante el aprovechamiento de la copia de campos de relleno no inicializados en estructuras de respuesta de la interfaz del bloque Xen, también se conoce como XSA-216. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=089bc0143f489bd3a4578bdff5f4ca68fb26f341 http://www.debian.org/security/2017/dsa-3920 http://www.debian.org/security/2017/dsa-3927 http://www.debian.org/security/2017/dsa-3945 http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.11.8 http://www.securityfocus.com/bid/99162 http://www.securitytracker.com/id/1038720 https://github.com/torvalds/linux/commit/089bc0143f489bd3a4578bdff5f4ca68fb26f341 https://lists. • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 0CVE-2017-10810
https://notcve.org/view.php?id=CVE-2017-10810
Memory leak in the virtio_gpu_object_create function in drivers/gpu/drm/virtio/virtgpu_object.c in the Linux kernel through 4.11.8 allows attackers to cause a denial of service (memory consumption) by triggering object-initialization failures. Una fuga de memoria en la función virtio_gpu_object_create en drivers/gpu/drm/virtio/virtgpu_object.c en el kernel de Linux hasta la versión 4.11.8 permite que atacantes provoquen una denegación de servicio (consumo de memoria) desencadenando fallos de inicialización de objetos. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=385aee965b4e4c36551c362a334378d2985b722a http://www.debian.org/security/2017/dsa-3927 http://www.securityfocus.com/bid/99433 https://github.com/torvalds/linux/commit/385aee965b4e4c36551c362a334378d2985b722a https://lkml.org/lkml/2017/4/6/668 • CWE-772: Missing Release of Resource after Effective Lifetime •
CVSS: 7.8EPSS: 0%CPEs: 11EXPL: 0CVE-2017-7482 – kernel: net/rxrpc: overflow in decoding of krb5 principal
https://notcve.org/view.php?id=CVE-2017-7482
In the Linux kernel before version 4.12, Kerberos 5 tickets decoded when using the RXRPC keys incorrectly assumes the size of a field. This could lead to the size-remaining variable wrapping and the data pointer going over the end of the buffer. This could possibly lead to memory corruption and possible privilege escalation. en el kernel de Linux en versiones anteriores a la 4.12, los tickets de Kerberos 5 descifrados al emplear las claves RXRPC de forma incorrecta asumen el tamaño de un campo. Esto podría conducir a un wrapping de la variable que mantiene el tamaño y en que el puntero de datos vaya más allá final del búfer. Esto podría conducir a una corrupción de memoria y a un posible escalado de privilegios. • http://seclists.org/oss-sec/2017/q2/602 http://www.securityfocus.com/bid/99299 http://www.securitytracker.com/id/1038787 https://access.redhat.com/errata/RHSA-2019:0641 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7482 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5f2f97656ada8d811d3c1bef503ced266fcd53a0 https://www.debian.org/security/2017/dsa-3927 https://www.debian.org/security/2017/dsa-3945 https://access.redhat.com/security/cve&# • CWE-190: Integer Overflow or Wraparound •