CVSS: 7.2EPSS: 0%CPEs: 309EXPL: 1CVE-2009-2407 – kernel: ecryptfs heap overflow in parse_tag_3_packet()
https://notcve.org/view.php?id=CVE-2009-2407
Heap-based buffer overflow in the parse_tag_3_packet function in fs/ecryptfs/keystore.c in the eCryptfs subsystem in the Linux kernel before 2.6.30.4 allows local users to cause a denial of service (system crash) or possibly gain privileges via vectors involving a crafted eCryptfs file, related to a large encrypted key size in a Tag 3 packet. Desbordamiento de búfer basado en memoria dinámica en la función parse_tag_3_packet en fs/ecryptfs/keystore.c en el subsistema eCryptfs del kernel de Linux anteriores a v2.6.30.4 permite a usuarios locales provocar una denegación de servicio (finalización del sistema) o posiblemente obtener mayores privilegios mediante vectores que emplean un fichero eCryptfs modificado, relacionado con un tamaño de clave de cifrado larga en un paquete "Tag 3". • http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=f151cd2c54ddc7714e2f740681350476cda03a28 http://lists.opensuse.org/opensuse-security-announce/2009-09/msg00001.html http://risesecurity.org/advisories/RISE-2009003.txt http://secunia.com/advisories/35985 http://secunia.com/advisories/36045 http://secunia.com/advisories/36051 http://secunia.com/advisories/36054 http://secunia.com/advisories/36116 http://secunia.com/advisories/36131 http://secunia.com/advisories/37 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-122: Heap-based Buffer Overflow •
CVSS: 7.2EPSS: 0%CPEs: 414EXPL: 1CVE-2009-2406 – kernel: ecryptfs stack overflow in parse_tag_11_packet()
https://notcve.org/view.php?id=CVE-2009-2406
Stack-based buffer overflow in the parse_tag_11_packet function in fs/ecryptfs/keystore.c in the eCryptfs subsystem in the Linux kernel before 2.6.30.4 allows local users to cause a denial of service (system crash) or possibly gain privileges via vectors involving a crafted eCryptfs file, related to not ensuring that the key signature length in a Tag 11 packet is compatible with the key signature buffer size. Desbordamiento de búfer basado en pila en la función parse_tag_11_packet en fs/ecryptfs/keystore.c en el subsistema eCryptfs del kernel de Linux anteriores a v2.6.30.4 permite a usuarios locales provocar una denegación de servicio (finalización del sistema) o posiblemente obtener mayores privilegios mediante vectores que utilizan un fichero eCryptfs modificado, relacionados con la no comprobación de que la longitud de la clave de firma en un paquete "Tag 11" es compatible con el tamaño del búfer de la clave de firma. • http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=6352a29305373ae6196491e6d4669f301e26492e http://lists.opensuse.org/opensuse-security-announce/2009-09/msg00001.html http://risesecurity.org/advisories/RISE-2009002.txt http://secunia.com/advisories/35985 http://secunia.com/advisories/36045 http://secunia.com/advisories/36051 http://secunia.com/advisories/36054 http://secunia.com/advisories/36116 http://secunia.com/advisories/36131 http://secunia.com/advisories/37 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-122: Heap-based Buffer Overflow •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 3CVE-2009-2584
https://notcve.org/view.php?id=CVE-2009-2584
Off-by-one error in the options_write function in drivers/misc/sgi-gru/gruprocfs.c in the SGI GRU driver in the Linux kernel 2.6.30.2 and earlier on ia64 and x86 platforms might allow local users to overwrite arbitrary memory locations and gain privileges via a crafted count argument, which triggers a stack-based buffer overflow. Error de superación de límite (Off-by-one) en la función drivers/misc/sgi-gru/gruprocfs.c en el controlador SGI GRU en el kernel de Linux v2.6.30.2 y anteriores en plataformas ia64 y x86 pueden permitir a usuarios locales escribir posiciones de memoria a su elección y obtener privilegios a través de argumentos de cuenta manipulados, provocando un desbordamiento de búfer basado en pila. • http://grsecurity.net/~spender/exploit_demo.c http://lkml.org/lkml/2009/7/20/348 http://lkml.org/lkml/2009/7/20/362 http://secunia.com/advisories/37105 http://www.securityfocus.com/bid/35753 http://www.ubuntu.com/usn/USN-852-1 http://xorl.wordpress.com/2009/07/21/linux-kernel-sgi-gru-driver-off-by-one-overwrite https://exchange.xforce.ibmcloud.com/vulnerabilities/51887 • CWE-189: Numeric Errors •
CVSS: 6.9EPSS: 0%CPEs: 9EXPL: 4CVE-2009-1897 – Linux Kernel 2.6.30 - 'tun_chr_pool()' Null Pointer Dereference
https://notcve.org/view.php?id=CVE-2009-1897
The tun_chr_poll function in drivers/net/tun.c in the tun subsystem in the Linux kernel 2.6.30 and 2.6.30.1, when the -fno-delete-null-pointer-checks gcc option is omitted, allows local users to gain privileges via vectors involving a NULL pointer dereference and an mmap of /dev/net/tun, a different vulnerability than CVE-2009-1894. La función tun_chr_poll en drivers/net/tun.c en el subsistema tun del kernel de Linux v2.6.30 y v2.6.30.1, cuando se omite la opción -fno-delete-null-pointer-checks en gcc, permite a atacantes locales obtener privilegios a través de vectores que implican desreferenciacion de punteros NULL y un nmap de /dev/net/tun, es una vulnerabilidad diferente a CVE-2009-1894. • https://www.exploit-db.com/exploits/33088 https://www.exploit-db.com/exploits/9191 http://archives.neohapsis.com/archives/fulldisclosure/2009-07/0241.html http://archives.neohapsis.com/archives/fulldisclosure/2009-07/0246.html http://article.gmane.org/gmane.linux.network/124939 http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=3c8a9c63d5fd738c261bd0ceece04d9c8357ca13 http://grsecurity.net/~spender/cheddar_bay.tgz http://isc.sans.org/diary.html?storyid=6820 ht • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.2EPSS: 0%CPEs: 9EXPL: 0CVE-2009-1895 – kernel: personality: fix PER_CLEAR_ON_SETID
https://notcve.org/view.php?id=CVE-2009-1895
The personality subsystem in the Linux kernel before 2.6.31-rc3 has a PER_CLEAR_ON_SETID setting that does not clear the ADDR_COMPAT_LAYOUT and MMAP_PAGE_ZERO flags when executing a setuid or setgid program, which makes it easier for local users to leverage the details of memory usage to (1) conduct NULL pointer dereference attacks, (2) bypass the mmap_min_addr protection mechanism, or (3) defeat address space layout randomization (ASLR). El subsistema de personalidad en el Linux kernel anterior a v2.6.31-rc3 tiene establecido que PER_CLEAR_ON_SETID no borre las banderas ADDR_COMPAT_LAYOUT y MMAP_PAGE_ZERO cuando ejecuta un programa setuid o setgid, lo que facilita a usuarios locales aprovechar los detalles del uso actual de memoria para (1) llevar a cabo ataques de deferencia a punteros NULOS, (2) evitar el mecanismo de protección mmap_min_addr o (3) rechazar aleatoriamente el espacio en la capa de direcciones (ASLR). • http://blog.cr0.org/2009/06/bypassing-linux-null-pointer.html http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=f9fabcb58a6d26d6efde842d1703ac7cfa9427b6 http://patchwork.kernel.org/patch/32598 http://secunia.com/advisories/35801 http://secunia.com/advisories/36045 http://secunia.com/advisories/36051 http://secunia.com/advisories/36054 http://secunia.com/advisories/36116 http://secunia.com/advisories/36131 http://secunia.com/advisories/36759 http:// • CWE-16: Configuration •