CVSS: 8.8EPSS: 0%CPEs: 10EXPL: 0CVE-2021-3489 – Linux kernel eBPF RINGBUF map oversized allocation
https://notcve.org/view.php?id=CVE-2021-3489
The eBPF RINGBUF bpf_ringbuf_reserve() function in the Linux kernel did not check that the allocated size was smaller than the ringbuf size, allowing an attacker to perform out-of-bounds writes within the kernel and therefore, arbitrary code execution. This issue was fixed via commit 4b81ccebaeee ("bpf, ringbuf: Deny reserve of buffers larger than ringbuf") (v5.13-rc4) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37. It was introduced via 457f44363a88 ("bpf: Implement BPF ring buffer and verifier support for it") (v5.8-rc1). La función eBPF RINGBUF bpf_ringbuf_reserve() del kernel de Linux no comprobaba que el tamaño asignado fuera menor que el tamaño del ringbuf, lo que permitía a un atacante realizar escrituras fuera de los límites del kernel y, por tanto, la ejecución de código arbitrario. Este problema se solucionó a través del commit 4b81ccebaeee ("bpf, ringbuf: Deny reserve of buffers larger than ringbuf") (v5.13-rc4) y se retroalimentó a los kernels estables en versiones v5.12.4, v5.11.21 y v5.10.37. • https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=4b81ccebaeee885ab1aa1438133f2991e3a2b6ea https://security.netapp.com/advisory/ntap-20210716-0004 https://ubuntu.com/security/notices/USN-4949-1 https://ubuntu.com/security/notices/USN-4950-1 https://www.openwall.com/lists/oss-security/2021/05/11/10 https://www.zerodayinitiative.com/advisories/ZDI-21-590 https://access.redhat.com/security/cve/CVE-2021-3489 https://bugzilla.redhat.com/show_bug.cgi?id=1959559 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-787: Out-of-bounds Write •
CVSS: 8.8EPSS: 0%CPEs: 10EXPL: 2CVE-2021-3490 – Linux kernel eBPF bitwise ops ALU32 bounds tracking
https://notcve.org/view.php?id=CVE-2021-3490
The eBPF ALU32 bounds tracking for bitwise ops (AND, OR and XOR) in the Linux kernel did not properly update 32-bit bounds, which could be turned into out of bounds reads and writes in the Linux kernel and therefore, arbitrary code execution. This issue was fixed via commit 049c4e13714e ("bpf: Fix alu32 const subreg bound tracking on bitwise operations") (v5.13-rc4) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37. The AND/OR issues were introduced by commit 3f50f132d840 ("bpf: Verifier, do explicit ALU32 bounds tracking") (5.7-rc1) and the XOR variant was introduced by 2921c90d4718 ("bpf:Fix a verifier failure with xor") ( 5.10-rc1). El seguimiento de los límites de la ALU32 de eBPF para las operaciones por bits (AND, OR y XOR) en el kernel de Linux no actualizaba correctamente los límites de 32 bits, lo que podía convertirse en lecturas y escrituras fuera de los límites en el kernel de Linux y, por tanto, en la ejecución de código arbitrario. Este problema fue corregido a través del commit 049c4e13714e ("bpf: Fix alu32 const subreg bound tracking on bitwise operations") (v5.13-rc4) y retrocedido a los kernels estables en v5.12.4, v5.11.21 y v5.10.37. • https://github.com/pivik271/CVE-2021-3490 http://packetstormsecurity.com/files/164015/Linux-eBPF-ALU32-32-bit-Invalid-Bounds-Tracking-Local-Privilege-Escalation.html https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=049c4e13714ecbca567b4d5f6d563f05d431c80e https://security.netapp.com/advisory/ntap-20210716-0004 https://ubuntu.com/security/notices/USN-4949-1 https://ubuntu.com/security/notices/USN-4950-1 https://www.openwall.com/lists/oss-security/2021/05/11/11 https:/ • CWE-20: Improper Input Validation CWE-125: Out-of-bounds Read CWE-787: Out-of-bounds Write •
CVSS: 7.2EPSS: 0%CPEs: 15EXPL: 0CVE-2014-0069 – kernel: cifs: incorrect handling of bogus user pointers during uncached writes
https://notcve.org/view.php?id=CVE-2014-0069
The cifs_iovec_write function in fs/cifs/file.c in the Linux kernel through 3.13.5 does not properly handle uncached write operations that copy fewer than the requested number of bytes, which allows local users to obtain sensitive information from kernel memory, cause a denial of service (memory corruption and system crash), or possibly gain privileges via a writev system call with a crafted pointer. La función cifs_iovec_write en fs/cifs/file.c en el kernel de Linux hasta 3.13.5 no maneja debidamente operaciones de escritura no en caché que copian menos bytes de los solicitados, lo que permite a usuarios locales obtener información sensible de la memoria del kernel, causar una denegación de servicio (corrupción de memoria y caída del sistema) o posiblemente ganar privilegios a través de una llamada al sistema writev con un puntero manipulado. • http://article.gmane.org/gmane.linux.kernel.cifs/9401 http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=5d81de8e8667da7135d3a32a964087c0faf5483f http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00026.html http://rhn.redhat.com/errata/RHSA-2014-0328.html http://www.openwall.com/lists/oss-security/2014/02/17/4 http://www.securityfocus.com/bid/65588 https://bugzilla.redhat.com/show_bug.cgi?id=1064253 https://github.com/torvalds/linux/comm • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 4.6EPSS: 0%CPEs: 5EXPL: 0CVE-2001-0886
https://notcve.org/view.php?id=CVE-2001-0886
Buffer overflow in glob function of glibc allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via a glob pattern that ends in a brace "{" character. Desbordamiento de buffer en la función glob de glibc para Red Hat Linux 6.2 a 7.2, y otros sistemas operativos, permite a atacantes causar una denegación de servicio (caída) y posiblemente ejecutar código arbitrarios mediante un patrón de glob que acaba en una llave "{" • http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000447 http://download.immunix.org/ImmunixOS/7.0/updates/IMNX-2001-70-037-01 http://sources.redhat.com/ml/bug-glibc/2001-11/msg00109.html http://www.ciac.org/ciac/bulletins/m-029.shtml http://www.debian.org/security/2002/dsa-103 http://www.linux-mandrake.com/en/security/2001/MDKSA-2001-095.php3 http://www.linuxsecurity.com/advisories/other_advisory-1752.html http://www.redhat.com/support/errata/RHSA-2001-160&# •
CVSS: 7.5EPSS: 1%CPEs: 1EXPL: 0CVE-1999-1346
https://notcve.org/view.php?id=CVE-1999-1346
PAM configuration file for rlogin in Red Hat Linux 6.1 and earlier includes a less restrictive rule before a more restrictive one, which allows users to access the host via rlogin even if rlogin has been explicitly disabled using the /etc/nologin file. • http://marc.info/?l=bugtraq&m=93942774609925&w=2 •