CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-31085
https://notcve.org/view.php?id=CVE-2023-31085
An issue was discovered in drivers/mtd/ubi/cdev.c in the Linux kernel 6.2. There is a divide-by-zero error in do_div(sz,mtd->erasesize), used indirectly by ctrl_cdev_ioctl, when mtd->erasesize is 0. • https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=017c73a34a661a861712f7cc1393a123e5b2208c https://lore.kernel.org/all/687864524.118195.1681799447034.JavaMail.zimbra%40nod.at https://security.netapp.com/advisory/ntap-20230929-0003 • CWE-369: Divide By Zero •
CVSS: 5.6EPSS: 0%CPEs: 2EXPL: 2CVE-2023-1998 – Spectre v2 SMT mitigations problem in Linux kernel
https://notcve.org/view.php?id=CVE-2023-1998
The Linux kernel allows userspace processes to enable mitigations by calling prctl with PR_SET_SPECULATION_CTRL which disables the speculation feature as well as by using seccomp. We had noticed that on VMs of at least one major cloud provider, the kernel still left the victim process exposed to attacks in some cases even after enabling the spectre-BTI mitigation with prctl. The same behavior can be observed on a bare-metal machine when forcing the mitigation to IBRS on boot command line. This happened because when plain IBRS was enabled (not enhanced IBRS), the kernel had some logic that determined that STIBP was not needed. The IBRS bit implicitly protects against cross-thread branch target injection. However, with legacy IBRS, the IBRS bit was cleared on returning to userspace, due to performance reasons, which disabled the implicit STIBP and left userspace threads vulnerable to cross-thread branch target injection against which STIBP protects. • https://www.exploit-db.com/exploits/51384 https://github.com/google/security-research/security/advisories/GHSA-mj4w-6495-6crx https://github.com/torvalds/linux/commit/6921ed9049bc7457f66c1596c5b78aec0dae4a9d https://kernel.dance/#6921ed9049bc7457f66c1596c5b78aec0dae4a9d https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html https://access.redhat.com/security/cve/CVE-2023-1998 https://bugzilla.redhat.com/show_bug.cgi?id=2187257 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-203: Observable Discrepancy CWE-1303: Non-Transparent Sharing of Microarchitectural Resources •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-2176 – kernel: Slab-out-of-bound read in compare_netdev_and_ip
https://notcve.org/view.php?id=CVE-2023-2176
A vulnerability was found in compare_netdev_and_ip in drivers/infiniband/core/cma.c in RDMA in the Linux Kernel. The improper cleanup results in out-of-boundary read, where a local user can utilize this problem to crash the system or escalation of privilege. A vulnerability was found in compare_netdev_and_ip in drivers/infiniband/core/cma.c in RDMA in the Linux kernel. An improper cleanup results in an out-of-boundary read. This flaw allows a local user to crash or escalate privileges on the system. • https://security.netapp.com/advisory/ntap-20230609-0005 https://www.spinics.net/lists/linux-rdma/msg114749.html https://access.redhat.com/security/cve/CVE-2023-2176 https://bugzilla.redhat.com/show_bug.cgi?id=2187931 • CWE-125: Out-of-bounds Read •
CVSS: 5.5EPSS: 0%CPEs: 9EXPL: 0CVE-2023-2177 – Kernel: NULL pointer dereference problem in sctp_sched_dequeue_common
https://notcve.org/view.php?id=CVE-2023-2177
A null pointer dereference issue was found in the sctp network protocol in net/sctp/stream_sched.c in Linux Kernel. If stream_in allocation is failed, stream_out is freed which would further be accessed. A local user could use this flaw to crash the system or potentially cause a denial of service. A NULL pointer dereference issue was found in the SCTP network protocol in net/sctp/stream_sched.c in the Linux kernel. If stream_in allocation fails, stream_out is freed, which would be accessed further. • https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=181d8d2066c0 https://access.redhat.com/security/cve/CVE-2023-2177 https://bugzilla.redhat.com/show_bug.cgi?id=2187953 • CWE-476: NULL Pointer Dereference •
CVSS: 6.7EPSS: 0%CPEs: 7EXPL: 0CVE-2023-2194 – kernel: i2c: out-of-bounds write in xgene_slimpro_i2c_xfer()
https://notcve.org/view.php?id=CVE-2023-2194
An out-of-bounds write vulnerability was found in the Linux kernel's SLIMpro I2C device driver. The userspace "data->block[0]" variable was not capped to a number between 0-255 and was used as the size of a memcpy, possibly writing beyond the end of dma_buffer. This flaw could allow a local privileged user to crash the system or potentially achieve code execution. An out-of-bounds write vulnerability was found in the Linux kernel's SLIMpro I2C device driver. The userspace "data->block[0]" variable was not limited to a number between 0-255 and was used as the size of a memcpy, possibly writing beyond the end of dma_buffer. • https://bugzilla.redhat.com/show_bug.cgi?id=2188396 https://github.com/torvalds/linux/commit/92fbb6d1296f https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html https://access.redhat.com/security/cve/CVE-2023-2194 • CWE-787: Out-of-bounds Write •