CVSS: 7.8EPSS: 6%CPEs: 3EXPL: 0CVE-2014-9428
https://notcve.org/view.php?id=CVE-2014-9428
The batadv_frag_merge_packets function in net/batman-adv/fragmentation.c in the B.A.T.M.A.N. implementation in the Linux kernel through 3.18.1 uses an incorrect length field during a calculation of an amount of memory, which allows remote attackers to cause a denial of service (mesh-node system crash) via fragmented packets. La función batadv_frag_merge_packets en net/batman-adv/fragmentation.c en la implementación B.A.T.M.A.N. en el kernel de Linux hasta 3.18.1 utiliza un campo de longitud incorrecto durante un cálculo de una cantidad de memoria, lo que permite a atacantes remotos causar una denegación de servicio (caída del sistema de modo de malla) a través de paquetes fragmentados. • http://bugs.debian.org/774155 http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=5b6698b0e4a37053de35cc24ee695b98a7eb712b http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147864.html http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147973.html http://www.mandriva.com/security/advisories?name=MDVSA-2015:058 http://www.openwall.com/lists/oss-security/2014/12/31/7 http://www.spinics.net/lists/netdev/msg309425.html http:// • CWE-399: Resource Management Errors •
CVSS: 4.9EPSS: 0%CPEs: 1EXPL: 0CVE-2014-9420 – Kernel: fs: isofs: infinite loop in CE record entries
https://notcve.org/view.php?id=CVE-2014-9420
The rock_continue function in fs/isofs/rock.c in the Linux kernel through 3.18.1 does not restrict the number of Rock Ridge continuation entries, which allows local users to cause a denial of service (infinite loop, and system crash or hang) via a crafted iso9660 image. La función rock_continue en fs/isofs/rock.c en el Kernel de Linux a través de 3.18.1 no limita el número entradas de Rock Ridge, lo que permite a usuarios locales causar una denegación de servicio (vuelvas infinitas, y caída o cuelgue del sistema) a través de un imagen modificada iso9660 It was found that the Linux kernel's ISO file system implementation did not correctly limit the traversal of Rock Ridge extension Continuation Entries (CE). An attacker with physical access to the system could use this flaw to trigger an infinite loop in the kernel, resulting in a denial of service. • http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=f54e18f1b831c92f6512d2eedb224cd63d607d3d http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147864.html http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147973.html http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00035.html http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00000.html http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00009.html http:/ • CWE-399: Resource Management Errors CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 2.1EPSS: 0%CPEs: 1EXPL: 0CVE-2014-9419 – kernel: partial ASLR bypass through TLS base addresses leak
https://notcve.org/view.php?id=CVE-2014-9419
The __switch_to function in arch/x86/kernel/process_64.c in the Linux kernel through 3.18.1 does not ensure that Thread Local Storage (TLS) descriptors are loaded before proceeding with other steps, which makes it easier for local users to bypass the ASLR protection mechanism via a crafted application that reads a TLS base address. La función The __switch_to en arch/x86/kernel/process_64.c en el Kernel de Linux a través de 3.18.1 no asegura que los descriptores Thread Local Storage (TLS) se carguen antes de proceder con otros pasos, lo que que sea más fácil para los usuarios locales evadir el mecanismo de protección ASLR a través de una aplicación modificada que lee una dirección base TLS An information leak flaw was found in the way the Linux kernel changed certain segment registers and thread-local storage (TLS) during a context switch. A local, unprivileged user could use this flaw to leak the user space TLS base address of an arbitrary process. • http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=f647d7c155f069c1a068030255c300663516420e http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147864.html http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147973.html http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00020.html http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00009.html http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00015.html http:/ • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 2CVE-2014-4322 – Nexus 5 Android 5.0 - Local Privilege Escalation
https://notcve.org/view.php?id=CVE-2014-4322
drivers/misc/qseecom.c in the QSEECOM driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not validate certain offset, length, and base values within an ioctl call, which allows attackers to gain privileges or cause a denial of service (memory corruption) via a crafted application. drivers/misc/qseecom.c en el driver QSEECOM del Kernel de Linux 3.x utilizada en las contribuciones de Android Qualcomm Innovation Center (QuIC) para los dispositivos MSM y otros productos, no valida el desplazamiento, longitud, y valores base dentro de la llamada ioctl , lo cual permite a atacantes obtener privilegios o causar una denegación de servicio (corrupción de memoria) a través de una aplicación modificada. • https://www.exploit-db.com/exploits/35711 https://github.com/koozxcv/CVE-2014-4322 https://www.codeaurora.org/projects/security-advisories/memory-corruption-qseecom-driver-cve-2014-4322 • CWE-787: Out-of-bounds Write •
CVSS: 2.1EPSS: 0%CPEs: 434EXPL: 0CVE-2014-8133 – kernel: x86: espfix(64) bypass via set_thread_area and CLONE_SETTLS
https://notcve.org/view.php?id=CVE-2014-8133
arch/x86/kernel/tls.c in the Thread Local Storage (TLS) implementation in the Linux kernel through 3.18.1 allows local users to bypass the espfix protection mechanism, and consequently makes it easier for local users to bypass the ASLR protection mechanism, via a crafted application that makes a set_thread_area system call and later reads a 16-bit value. arch/x86/kernel/tls.c en la implementación Thread Local Storage (TLS) en el kernel de Linux hasta 3.18.1 permite a usuarios locales evadir el mecanismo de protección espfix, y como consecuencia facilita a usuarios locales evadir el mecanismo de protección ASLR, a través de una aplicación manipulada que hace una llamada del sistema set_thread_area y posteriormente lee un valor de 16 bits. It was found that the espfix functionality could be bypassed by installing a 16-bit RW data segment into GDT instead of LDT (which espfix checks), and using that segment on the stack. A local, unprivileged user could potentially use this flaw to leak kernel stack addresses. • http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=41bdc78544b8a93a9c6814b8bbbfef966272abbe http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00025.html http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00015.html http://rhn.redhat.com/errata/RHSA-2015-1272.html http://secunia.com/advisories/62801 http://www.debian.org/security/2015/dsa-3128 http://www.mandriva.com/security/advisories?name=MDVSA-2015:058 http://www.openwall.com/lists& • CWE-264: Permissions, Privileges, and Access Controls •