CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2011-2525 – kernel: kernel: net_sched: fix qdisc_notify()
https://notcve.org/view.php?id=CVE-2011-2525
The qdisc_notify function in net/sched/sch_api.c in the Linux kernel before 2.6.35 does not prevent tc_fill_qdisc function calls referencing builtin (aka CQ_F_BUILTIN) Qdisc structures, which allows local users to cause a denial of service (NULL pointer dereference and OOPS) or possibly have unspecified other impact via a crafted call. La función qdisc_notify de net/sched/sch_api.c del kernel de Linux en versiones anteriores a la 2.6.35 no previene que la función tc_fill_qdisc haga referencia a estructuras Qdisc (CQ_F_BUILTIN) pre-construídas, lo que permite a usuarios locales provocar una denegación de servicio (resolución de puntero NULL y OOPS) o posiblemente tener otros impactos sin especificar a través de una llamada modificada. • http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=53b0f08042f04813cd1a7473dacd3edfacb28eb3 http://kerneltrap.org/mailarchive/linux-netdev/2010/5/21/6277805 http://mirror.anl.gov/pub/linux/kernel/v2.6/ChangeLog-2.6.35 http://openwall.com/lists/oss-security/2011/07/12/1 http://rhn.redhat.com/errata/RHSA-2011-1065.html http://rhn.redhat.com/errata/RHSA-2011-1163.html https://bugzilla.redhat.com/show_bug.cgi?id=720552 https://access.redhat. • CWE-476: NULL Pointer Dereference •
CVSS: 4.9EPSS: 0%CPEs: 6EXPL: 0CVE-2011-2689 – kernel: gfs2: make sure fallocate bytes is a multiple of blksize
https://notcve.org/view.php?id=CVE-2011-2689
The gfs2_fallocate function in fs/gfs2/file.c in the Linux kernel before 3.0-rc1 does not ensure that the size of a chunk allocation is a multiple of the block size, which allows local users to cause a denial of service (BUG and system crash) by arranging for all resource groups to have too little free space. La función gfs2_fallocate en fs/gfs2/file.c en el kernel de Linux anterior a v3.0-rc1 no garantiza que el tamaño de un trozo de asignación sea un múltiplo del tamaño de bloque, lo que permite a usuarios locales provocar una denegación de servicio (BUG y caída del sistema) mediante la organización de todos los grupos de recursos para tener un espacio libre muy reducido. • http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=6905d9e4dda6112f007e9090bca80507da158e63 http://marc.info/?l=bugtraq&m=139447903326211&w=2 http://rhn.redhat.com/errata/RHSA-2011-1065.html http://secunia.com/advisories/45193 http://securitytracker.com/id?1025776 http://www.kernel.org/pub/linux/kernel/v3.0/testing/ChangeLog-3.0-rc1 http://www.openwall.com/lists/oss-security/2011/07/13/1 http://www.securityfocus.com/bid/48677 https://bu • CWE-400: Uncontrolled Resource Consumption •
CVSS: 1.9EPSS: 0%CPEs: 10EXPL: 0CVE-2011-2492 – kernel: bluetooth: l2cap and rfcomm: fix 1 byte infoleak to userspace
https://notcve.org/view.php?id=CVE-2011-2492
The bluetooth subsystem in the Linux kernel before 3.0-rc4 does not properly initialize certain data structures, which allows local users to obtain potentially sensitive information from kernel memory via a crafted getsockopt system call, related to (1) the l2cap_sock_getsockopt_old function in net/bluetooth/l2cap_sock.c and (2) the rfcomm_sock_getsockopt_old function in net/bluetooth/rfcomm/sock.c. El subsistema de bluetooth en el kernel de Linux anteriores a v3.0-rc4 no inicializa correctamente algunas estructuras de datos, lo que permite a usuarios locales obtener información sensible de la memoria del kernel a través de una llamada getsockopt manipulada, en relación con (1) la función l2cap_sock_getsockopt_old en net/bluetooth/l2cap_sock.c y (2) la función rfcomm_sock_getsockopt_old en net/bluetooth/rfcomm/sock.c. • http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=8d03e971cf403305217b8e62db3a2e5ad2d6263f http://marc.info/?l=bugtraq&m=139447903326211&w=2 http://permalink.gmane.org/gmane.linux.bluez.kernel/12909 http://rhn.redhat.com/errata/RHSA-2011-0927.html http://securitytracker.com/id?1025778 http://www.kernel.org/pub/linux/kernel/v3.0/testing/ChangeLog-3.0-rc4 http://www.openwall.com/lists/oss-security/2011/06/24/2 http://www.openwall.com/lists/ • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.7EPSS: 0%CPEs: 4EXPL: 0CVE-2011-1576 – kernel: net: Fix memory leak/corruption on VLAN GRO_DROP
https://notcve.org/view.php?id=CVE-2011-1576
The Generic Receive Offload (GRO) implementation in the Linux kernel 2.6.18 on Red Hat Enterprise Linux 5 and 2.6.32 on Red Hat Enterprise Linux 6, as used in Red Hat Enterprise Virtualization (RHEV) Hypervisor and other products, allows remote attackers to cause a denial of service via crafted VLAN packets that are processed by the napi_reuse_skb function, leading to (1) a memory leak or (2) memory corruption, a different vulnerability than CVE-2011-1478. Vulnerabilidad en la implementación de Generic Receive Offload (GRO) en el kernel de Linux versión 2.6.18 en Red Hat Enterprise Linux versiones 5 y 2.6.32 en Red Hat Enterprise Linux versión 6, tal y como se utiliza en el Hypervisor Red Hat Enterprise Virtualization (RHEV) y otros productos, permite a los atacantes remotos generar un denegación de servicio mediante paquetes VLAN creados que son procesados por la función napi_reuse_skb, lo que conduce a (1) una fuga de memoria o (2) daños en la memoria, una vulnerabilidad diferente a CVE-2011-1478. • http://rhn.redhat.com/errata/RHSA-2011-0927.html http://www.redhat.com/support/errata/RHSA-2011-1090.html http://www.redhat.com/support/errata/RHSA-2011-1106.html http://www.securityfocus.com/bid/48907 http://www.securitytracker.com/id?1025853 https://bugzilla.redhat.com/show_bug.cgi?id=695173 https://access.redhat.com/security/cve/CVE-2011-1576 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-401: Missing Release of Memory after Effective Lifetime •
CVSS: 5.9EPSS: 1%CPEs: 1EXPL: 1CVE-2011-1573 – kernel: sctp: fix to calc the INIT/INIT-ACK chunk length correctly to set
https://notcve.org/view.php?id=CVE-2011-1573
net/sctp/sm_make_chunk.c in the Linux kernel before 2.6.34, when addip_enable and auth_enable are used, does not consider the amount of zero padding during calculation of chunk lengths for (1) INIT and (2) INIT ACK chunks, which allows remote attackers to cause a denial of service (OOPS) via crafted packet data. net/sctp/sm_make_chunk.c del kernel de Linux en versiones anteriores a 2.6.34, si se utiliza addip_enable y auth_enable, no considera la cantidad de "padding" durante el cálculo de la longitud para los segmentos ("chunks")(1) INIT y (2) INIT ACK, lo que permite a atacantes remotos provocar una denegación de servicio (OOPS) a través de paquetes modificados. • http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=a8170c35e738d62e9919ce5b109cf4ed66e95bde http://mirror.anl.gov/pub/linux/kernel/v2.6/ChangeLog-2.6.34 http://openwall.com/lists/oss-security/2011/04/11/12 http://openwall.com/lists/oss-security/2011/04/11/4 http://rhn.redhat.com/errata/RHSA-2011-0927.html https://bugzilla.redhat.com/show_bug.cgi?id=695383 https://access.redhat.com/security/cve/CVE-2011-1573 • CWE-682: Incorrect Calculation •