CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-13093 – kernel: NULL pointer dereference in lookup_slow function
https://notcve.org/view.php?id=CVE-2018-13093
An issue was discovered in fs/xfs/xfs_icache.c in the Linux kernel through 4.17.3. There is a NULL pointer dereference and panic in lookup_slow() on a NULL inode->i_ops pointer when doing pathwalks on a corrupted xfs image. This occurs because of a lack of proper validation that cached inodes are free during allocation. Se ha descubierto un problema en fs/xfs/xfs_icache.c en el kernel de Linux hasta la versión 4.17.3. Existe una desreferencia de puntero NULL y pánico en lookup_slow() en un puntero NULL inode->i_ops cuando se navega por rutas en una imagen xfs corrupta. • https://access.redhat.com/errata/RHSA-2019:2029 https://access.redhat.com/errata/RHSA-2019:2043 https://bugzilla.kernel.org/show_bug.cgi?id=199367 https://git.kernel.org/pub/scm/fs/xfs/xfs-linux.git/commit/?h=for-next&id=afca6c5b2595fc44383919fba740c194b0b76aff https://github.com/torvalds/linux/commit/afca6c5b2595fc44383919fba740c194b0b76aff https://lists.debian.org/debian-lts-announce/2020/03/msg00001.html https://usn.ubuntu.com/4094-1 https://usn.ubuntu.com/4118-1 https://access.re • CWE-476: NULL Pointer Dereference •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 1CVE-2018-12896
https://notcve.org/view.php?id=CVE-2018-12896
An issue was discovered in the Linux kernel through 4.17.3. An Integer Overflow in kernel/time/posix-timers.c in the POSIX timer code is caused by the way the overrun accounting works. Depending on interval and expiry time values, the overrun can be larger than INT_MAX, but the accounting is int based. This basically makes the accounting values, which are visible to user space via timer_getoverrun(2) and siginfo::si_overrun, random. For example, a local user can cause a denial of service (signed integer overflow) via crafted mmap, futex, timer_create, and timer_settime system calls. • https://bugzilla.kernel.org/show_bug.cgi?id=200189 https://github.com/lcytxw/bug_repro/tree/master/bug_200189 https://github.com/torvalds/linux/commit/78c9c4dfbf8c04883941445a195276bb4bb92c76 https://lists.debian.org/debian-lts-announce/2019/03/msg00017.html https://lists.debian.org/debian-lts-announce/2019/03/msg00034.html https://lists.debian.org/debian-lts-announce/2019/04/msg00004.html https://usn.ubuntu.com/3847-1 https://usn.ubuntu.com/3847-2 https://usn.ubuntu.com/3847- • CWE-190: Integer Overflow or Wraparound •
CVSS: 3.3EPSS: 0%CPEs: 4EXPL: 0CVE-2018-13053 – kernel: Integer overflow in the alarm_timer_nsleep function
https://notcve.org/view.php?id=CVE-2018-13053
The alarm_timer_nsleep function in kernel/time/alarmtimer.c in the Linux kernel through 4.17.3 has an integer overflow via a large relative timeout because ktime_add_safe is not used. La función alarm_timer_nsleep en kernel/time/alarmtimer.c en el kernel de Linux hasta la versión 4.17.3 tiene un desbordamiento de enteros a través de un tiempo de espera relativo grande porque no se utiliza ktime_add_safe. A flaw was found in the alarm_timer_nsleep() function in kernel/time/alarmtimer.c in the Linux kernel. The ktime_add_safe() function is not used and an integer overflow can happen causing an alarm not to fire or possibly a denial-of-service if using a large relative timeout. • http://www.securityfocus.com/bid/104671 https://access.redhat.com/errata/RHSA-2019:0831 https://access.redhat.com/errata/RHSA-2019:2029 https://access.redhat.com/errata/RHSA-2019:2043 https://bugzilla.kernel.org/show_bug.cgi?id=200303 https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=5f936e19cc0ef97dbe3a56e9498922ad5ba1edef https://lists.debian.org/debian-lts-announce/2019/03/msg00017.html https://lists.debian.org/debian-lts-announce/2019/03/msg00034.html https • CWE-190: Integer Overflow or Wraparound •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2018-12931 – kernel: stack-based out-of-bounds write in ntfs_attr_find in the ntfs.ko
https://notcve.org/view.php?id=CVE-2018-12931
ntfs_attr_find in the ntfs.ko filesystem driver in the Linux kernel 4.15.0 allows attackers to trigger a stack-based out-of-bounds write and cause a denial of service (kernel oops or panic) or possibly have unspecified other impact via a crafted ntfs filesystem. ntfs_attr_find en el controlador en el sistema de archivos ntfs.ko en el kernel de Linux 4.15.0 permite que los atacantes desencadenen una escritura fuera de límites basada en la pila de memoria y provoquen una denegación de servicio (OOPS o pánico del kernel) o, posiblemente, provoquen otro impacto no especificado mediante un sistema de archivos ntfs manipulado. A flaw was found in ntfs_attr_find in the ntfs.ko filesystem driver in the Linux kernel. This allows attackers to trigger a stack-based out-of-bounds write and cause a denial of service or possibly have unspecified other impact via a crafted ntfs filesystem image. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is unlikely. • http://www.securityfocus.com/bid/104588 https://access.redhat.com/errata/RHSA-2019:0641 https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1763403 https://marc.info/?l=linux-ntfs-dev&m=152413769810234&w=2 https://access.redhat.com/security/cve/CVE-2018-12931 https://bugzilla.redhat.com/show_bug.cgi?id=1597843 • CWE-787: Out-of-bounds Write •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2018-12929 – kernel: use-after-free in ntfs_read_locked_inode in the ntfs.ko
https://notcve.org/view.php?id=CVE-2018-12929
ntfs_read_locked_inode in the ntfs.ko filesystem driver in the Linux kernel 4.15.0 allows attackers to trigger a use-after-free read and possibly cause a denial of service (kernel oops or panic) via a crafted ntfs filesystem. ntfs_read_locked_inode en el controlador en el sistema de archivos ntfs.ko en el kernel de Linux 4.15.0 permite que los atacantes desencadenen una lectura de uso de memoria previamente liberada y, posiblemente, provoquen una denegación de servicio (OOPS o pánico del kernel) mediante un sistema de archivos ntfs manipulado. A flaw was found in ntfs_read_locked_inode in the ntfs.ko filesystem driver in the Linux kernel. This allows attackers to trigger a use-after-free read and possibly cause a denial of service via a crafted ntfs filesystem. • http://www.securityfocus.com/bid/104588 https://access.redhat.com/errata/RHSA-2019:0641 https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1763403 https://marc.info/?l=linux-ntfs-dev&m=152413769810234&w=2 https://access.redhat.com/security/cve/CVE-2018-12929 https://bugzilla.redhat.com/show_bug.cgi?id=1597831 • CWE-416: Use After Free •