CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2017-6348
https://notcve.org/view.php?id=CVE-2017-6348
The hashbin_delete function in net/irda/irqueue.c in the Linux kernel before 4.9.13 improperly manages lock dropping, which allows local users to cause a denial of service (deadlock) via crafted operations on IrDA devices. La función hashben_delete en net/irda/irqueue.c en el kernel de Linux en versiones anteriores a 4.9.13 administra incorrectamente el soltado del bloqueo, lo que permite a usuarios locales provocar una denegación de servicio (punto muerto) a través de operaciones manipuladas en los dispositivos IrDA. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4c03b862b12f980456f9de92db6d508a4999b788 http://www.debian.org/security/2017/dsa-3804 http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.13 http://www.openwall.com/lists/oss-security/2017/02/28/4 http://www.securityfocus.com/bid/96483 https://github.com/torvalds/linux/commit/4c03b862b12f980456f9de92db6d508a4999b788 https://usn.ubuntu.com/3754-1 •
CVSS: 7.0EPSS: 0%CPEs: 7EXPL: 0CVE-2017-6346
https://notcve.org/view.php?id=CVE-2017-6346
Race condition in net/packet/af_packet.c in the Linux kernel before 4.9.13 allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via a multithreaded application that makes PACKET_FANOUT setsockopt system calls. Condición de carrera en net/packet/af_packet.c en el kernel de Linux en versiones anteriores a 4.9.13 permite a usuarios locales provocar una denegación de servicio (uso después de liberación de memoria) o la posibilidad de tener otro impacto no especificado a través de una aplicación multihilo que realizada llamadas al sistema PACKET_FANOUT setsockopt. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=d199fab63c11998a602205f7ee7ff7c05c97164b http://www.debian.org/security/2017/dsa-3804 http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.13 http://www.openwall.com/lists/oss-security/2017/02/28/6 http://www.securityfocus.com/bid/96508 https://github.com/torvalds/linux/commit/d199fab63c11998a602205f7ee7ff7c05c97164b https://source.android.com/security/bulletin/2017-09-01 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-416: Use After Free •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-6345
https://notcve.org/view.php?id=CVE-2017-6345
The LLC subsystem in the Linux kernel before 4.9.13 does not ensure that a certain destructor exists in required circumstances, which allows local users to cause a denial of service (BUG_ON) or possibly have unspecified other impact via crafted system calls. El subsistema LLC en el kernel de Linux en versiones anteriores a 4.9.13 no garantiza que exista cierto destructor en las circunstancias requeridas, lo que permite a usuarios locales provocar una denegación de servicio (BUG_ON) o posiblemente tener otro impacto no especificado a través de llamadas al sistema manipuladas. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8b74d439e1697110c5e5c600643e823eb1dd0762 http://www.debian.org/security/2017/dsa-3804 http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.13 http://www.openwall.com/lists/oss-security/2017/02/28/7 http://www.securityfocus.com/bid/96510 https://github.com/torvalds/linux/commit/8b74d439e1697110c5e5c600643e823eb1dd0762 https://usn.ubuntu.com/3754-1 • CWE-20: Improper Input Validation •
CVSS: 7.8EPSS: 2%CPEs: 6EXPL: 0CVE-2017-2634 – kernel: dccp: crash while sending ipv6 reset packet
https://notcve.org/view.php?id=CVE-2017-2634
It was found that the Linux kernel's Datagram Congestion Control Protocol (DCCP) implementation before 2.6.22.17 used the IPv4-only inet_sk_rebuild_header() function for both IPv4 and IPv6 DCCP connections, which could result in memory corruptions. A remote attacker could use this flaw to crash the system. Se ha encontrado que la implementación del Protocolo de Control de Congestión de Datagramas (DCCP) del kernel de Linux en versiones anteriores a la 2.6.22.17 usaba la función inet_sk_rebuild_header() solo para IPv4 y conexiones DCCP IPv6, lo que podría resultar en corrupciones de memoria. Un atacante remoto podría utilizar este fallo para provocar un cierre inesperado del sistema. It was found that the Linux kernel's Datagram Congestion Control Protocol (DCCP) implementation used the IPv4-only inet_sk_rebuild_header() function for both IPv4 and IPv6 DCCP connections, which could result in memory corruptions. • http://rhn.redhat.com/errata/RHSA-2017-0323.html http://rhn.redhat.com/errata/RHSA-2017-0346.html http://rhn.redhat.com/errata/RHSA-2017-0347.html http://www.securityfocus.com/bid/96529 http://www.securitytracker.com/id/1037909 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2634 https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=f53dc67c5e7babafe239b93a11678b0e05bead51 https://access.redhat.com/security/cve/CVE-2017-2634 https://bugzilla.redhat • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-476: NULL Pointer Dereference •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2017-5669
https://notcve.org/view.php?id=CVE-2017-5669
The do_shmat function in ipc/shm.c in the Linux kernel through 4.9.12 does not restrict the address calculated by a certain rounding operation, which allows local users to map page zero, and consequently bypass a protection mechanism that exists for the mmap system call, by making crafted shmget and shmat system calls in a privileged context. La función do_shmat en ipc/shm.c en el kernel de Linux hasta la versión 4.9.12 no restringe la dirección calculada por cierta operación de redondeo, lo que permite a usuarios locales asignar la página cero, y como consecuencia, eludir un mecanismo de protección que existe por la llamada de sistema mmap, haciendo llamadas a sistema shmget y shmat manipuladas en un contexto privilegiado. • http://www.debian.org/security/2017/dsa-3804 http://www.securityfocus.com/bid/96754 http://www.securitytracker.com/id/1037918 https://bugzilla.kernel.org/show_bug.cgi?id=192931 https://github.com/torvalds/linux/commit/95e91b831f87ac8e1f8ed50c14d709089b4e01b8 https://github.com/torvalds/linux/commit/e1d35d4dc7f089e6c9c080d556feedf9c706f0c7 https://usn.ubuntu.com/3583-1 https://usn.ubuntu.com/3583-2 •