CVSS: 7.8EPSS: 0%CPEs: 8EXPL: 0CVE-2021-3444 – Linux kernel bpf verifier incorrect mod32 truncation
https://notcve.org/view.php?id=CVE-2021-3444
The bpf verifier in the Linux kernel did not properly handle mod32 destination register truncation when the source register was known to be 0. A local attacker with the ability to load bpf programs could use this gain out-of-bounds reads in kernel memory leading to information disclosure (kernel memory), and possibly out-of-bounds writes that could potentially lead to code execution. This issue was addressed in the upstream kernel in commit 9b00f1b78809 ("bpf: Fix truncation handling for mod32 dst reg wrt zero") and in Linux stable kernels 5.11.2, 5.10.19, and 5.4.101. El comprobador bpf en el kernel de Linux no manejó apropiadamente el truncamiento del registro de destino mod32 cuando se sabía que el registro de origen era 0. Un atacante local con la habilidad de cargar programas bpf podría usar esta ganancia para lecturas fuera de límites en la memoria del kernel que conllevan a una divulgación de información (memoria del kernel) y, posiblemente, escrituras fuera de límites que podrían conllevar a una ejecución de código. • http://packetstormsecurity.com/files/162117/Kernel-Live-Patch-Security-Notice-LSN-0075-1.html http://packetstormsecurity.com/files/164950/Kernel-Live-Patch-Security-Notice-LSN-0082-1.html http://www.openwall.com/lists/oss-security/2021/03/23/2 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9b00f1b78809 https://lists.debian.org/debian-lts-announce/2021/10/msg00010.html https://security.netapp.com/advisory/ntap-20210416-0006 https://www.openwall.com/lists&# • CWE-125: Out-of-bounds Read CWE-681: Incorrect Conversion between Numeric Types •
CVSS: 6.0EPSS: 0%CPEs: 9EXPL: 0CVE-2020-27171
https://notcve.org/view.php?id=CVE-2020-27171
An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c has an off-by-one error (with a resultant integer underflow) affecting out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory, aka CID-10d2bb2e6b1d. Se detectó un problema en el kernel de Linux versiones anteriores a 5.11.8. El archivo kernel/bpf/verifier.c presenta un error por un paso (con un subdesbordamiento de enteros resultante) afectando la especulación fuera de límites en la aritmética de punteros, conllevando a ataques de canal lateral que anulan las mitigaciones de Spectre y consiguen información confidencial de la memoria del kernel , también se conoce como CID-10d2bb2e6b1d • http://packetstormsecurity.com/files/162117/Kernel-Live-Patch-Security-Notice-LSN-0075-1.html http://www.openwall.com/lists/oss-security/2021/03/24/5 https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.11.8 https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/patch/?id=10d2bb2e6b1d8c4576c56a748f697dbeb8388899 https://lists.debian.org/debian-lts-announce/2021/03/msg00035.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FB6LUXPEIRLZH • CWE-193: Off-by-one Error •
CVSS: 4.7EPSS: 0%CPEs: 9EXPL: 0CVE-2020-27170 – kernel: Speculation on pointer arithmetic against bpf_context pointer
https://notcve.org/view.php?id=CVE-2020-27170
An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c performs undesirable out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory, aka CID-f232326f6966. This affects pointer types that do not define a ptr_limit. Se detectó un problema en el kernel de Linux versiones anteriores a 5.11.8. El archivo kernel/bpf/verifier.c lleva a cabo especulaciones no deseadas fuera de límites en aritmética de punteros, conllevando a ataques de canal lateral que anulan las mitigaciones de Spectre y consiguen información confidencial de la memoria del kernel, también se conoce como CID-f232326f6966. Esto afecta a los tipos de punteros que no definen un ptr_limit A flaw was found in the Linux kernels eBPF verification code. • http://packetstormsecurity.com/files/162117/Kernel-Live-Patch-Security-Notice-LSN-0075-1.html http://www.openwall.com/lists/oss-security/2021/03/24/4 https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.11.8 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f232326f6966cf2a1d1db7bc917a4ce5f9f55f76 https://lists.debian.org/debian-lts-announce/2021/03/msg00035.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FB6LU • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-203: Observable Discrepancy •
CVSS: 7.1EPSS: 0%CPEs: 9EXPL: 1CVE-2021-27364 – kernel: out-of-bounds read in libiscsi module
https://notcve.org/view.php?id=CVE-2021-27364
An issue was discovered in the Linux kernel through 5.11.3. drivers/scsi/scsi_transport_iscsi.c is adversely affected by the ability of an unprivileged user to craft Netlink messages. Se detectó un problema en el kernel de Linux versiones hasta 5.11.3. El archivo drivers/scsi/scsi_transport_iscsi.c está afectado negativamente por la capacidad de un usuario sin privilegios de crear mensajes Netlink A flaw was found in the Linux kernel. An out-of-bounds read was discovered in the libiscsi module that could lead to reading kernel memory or a crash. The highest threat from this vulnerability is to data confidentiality as well as system availability. • http://packetstormsecurity.com/files/162117/Kernel-Live-Patch-Security-Notice-LSN-0075-1.html https://blog.grimm-co.com/2021/03/new-old-bugs-in-linux-kernel.html https://bugzilla.suse.com/show_bug.cgi?id=1182717 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=688e8128b7a92df982709a4137ea4588d16f24aa https://lists.debian.org/debian-lts-announce/2021/03/msg00010.html https://lists.debian.org/debian-lts-announce/2021/03/msg00035.html https://security.netapp.com&# • CWE-125: Out-of-bounds Read •
CVSS: 2.8EPSS: 0%CPEs: 10EXPL: 0CVE-2020-27351 – Various memory and file descriptor leaks in apt-python
https://notcve.org/view.php?id=CVE-2020-27351
Various memory and file descriptor leaks were found in apt-python files python/arfile.cc, python/tag.cc, python/tarfile.cc, aka GHSL-2020-170. This issue affects: python-apt 1.1.0~beta1 versions prior to 1.1.0~beta1ubuntu0.16.04.10; 1.6.5ubuntu0 versions prior to 1.6.5ubuntu0.4; 2.0.0ubuntu0 versions prior to 2.0.0ubuntu0.20.04.2; 2.1.3ubuntu1 versions prior to 2.1.3ubuntu1.1; Se encontraron varios filtrados de memoria y descriptores de archivos en los archivos python/arfile.cc, python/tag.cc, python/tarfile.cc, también se conoce como GHSL-2020-170. Este problema afecta a: python-apt versiones 1.1.0~beta1 anteriores a 1.1.0~beta1ubuntu0.16.04.10; versiones 1.6.5ubuntu0 anteriores a 1.6.5ubuntu0.4; versiones 2.0.0ubuntu0 anteriores a 2.0.0ubuntu0.20.04.2; versiones 2.1.3ubuntu1 anteriores a 2.1.3ubuntu1.1; • https://bugs.launchpad.net/bugs/1899193 https://usn.ubuntu.com/usn/usn-4668-1 https://www.debian.org/security/2020/dsa-4809 • CWE-772: Missing Release of Resource after Effective Lifetime •