CVSS: 7.6EPSS: 0%CPEs: 2EXPL: 0CVE-2017-0610
https://notcve.org/view.php?id=CVE-2017-0610
An elevation of privilege vulnerability in the Qualcomm sound driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-35399404. • http://www.securityfocus.com/bid/98255 https://source.android.com/security/bulletin/2017-05-01 • CWE-754: Improper Check for Unusual or Exceptional Conditions •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 2CVE-2017-7472 – Linux Kernel < 4.10.13 - 'keyctl_set_reqkey_keyring' Local Denial of Service
https://notcve.org/view.php?id=CVE-2017-7472
The KEYS subsystem in the Linux kernel before 4.10.13 allows local users to cause a denial of service (memory consumption) via a series of KEY_REQKEY_DEFL_THREAD_KEYRING keyctl_set_reqkey_keyring calls. El subsistema KEYS en el kernel de Linux anterior a 4.10.13 permite a los usuarios locales causar una denegación de servicio (consumo de memoria) a través de una serie de llamadas KEY_REQKEY_DEFL_THREAD_KEYRING keyctl_set_reqkey_keyring. A vulnerability was found in the Linux kernel where the keyctl_set_reqkey_keyring() function leaks the thread keyring. This allows an unprivileged local user to exhaust kernel memory and thus cause a DoS. Linux Kernel versions prior to 4.10.13 suffer from a keyctl_set_reqkey_keyring local denial of service vulnerability. • https://www.exploit-db.com/exploits/42136 https://github.com/homjxi0e/CVE-2017-7472 http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=c9f838d104fed6f2f61d68164712e3204bf5271b http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00007.html http://openwall.com/lists/oss-security/2017/05/11/1 http://www.securityfocus.com/bid/98422 http://www.securitytracker.com/id/1038471 https://access.redhat.com/errata/RHSA-2018:0151 https://access.redhat.com/errat • CWE-400: Uncontrolled Resource Consumption CWE-404: Improper Resource Shutdown or Release •
CVSS: 7.8EPSS: 0%CPEs: 10EXPL: 2CVE-2017-8890 – kernel: Double free in the inet_csk_clone_lock function in net/ipv4/inet_connection_sock.c
https://notcve.org/view.php?id=CVE-2017-8890
The inet_csk_clone_lock function in net/ipv4/inet_connection_sock.c in the Linux kernel through 4.10.15 allows attackers to cause a denial of service (double free) or possibly have unspecified other impact by leveraging use of the accept system call. La función inet_csk_clone_lock en net / ipv4 / inet_connection_sock.c en el kernel de Linux hasta la versión 4.10.15 permite a los atacantes causar una denegación de servicio (double free) u otro impacto no especificado al aprovechar el uso de la llamada al sistema accept. The inet_csk_clone_lock function in net/ipv4/inet_connection_sock.c in the Linux kernel allows attackers to cause a denial of service (double free) or possibly have unspecified other impact by leveraging use of the accept system call. An unprivileged local user could use this flaw to induce kernel memory corruption on the system, leading to a crash. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is unlikely. • https://github.com/beraphin/CVE-2017-8890 https://github.com/thinkycx/CVE-2017-8890 http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=657831ffc38e30092a2d5f03d385d710eb88b09a http://www.debian.org/security/2017/dsa-3886 http://www.securityfocus.com/bid/98562 https://access.redhat.com/errata/RHSA-2017:1842 https://access.redhat.com/errata/RHSA-2017:2077 https://access.redhat.com/errata/RHSA-2017:2669 https://access.redhat.com/errata/RHSA-2018:1854 https: • CWE-415: Double Free CWE-416: Use After Free •
CVSS: 6.9EPSS: 0%CPEs: 3EXPL: 0CVE-2017-8831
https://notcve.org/view.php?id=CVE-2017-8831
The saa7164_bus_get function in drivers/media/pci/saa7164/saa7164-bus.c in the Linux kernel through 4.11.5 allows local users to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact by changing a certain sequence-number value, aka a "double fetch" vulnerability. La función saa7164_bus_get en el archivo drivers/media/pci/saa7164/saa7164-bus.c en el kernel de Linux hasta versión 4.11.5, permite a los usuarios locales causar una denegación de servicio (acceso de matriz fuera de límites) o posiblemente tener otro impacto no especificado por el cambio de un valor predeterminado de número de secuencia, también se conoce como una vulnerabilidad de "double fetch". • http://www.securityfocus.com/archive/1/540770/30/0/threaded http://www.securityfocus.com/bid/99619 https://bugzilla.kernel.org/show_bug.cgi?id=195559 https://github.com/stoth68000/media-tree/commit/354dd3924a2e43806774953de536257548b5002c https://lists.debian.org/debian-lts-announce/2017/12/msg00004.html https://usn.ubuntu.com/3754-1 • CWE-125: Out-of-bounds Read •
CVSS: 9.3EPSS: 0%CPEs: 2EXPL: 0CVE-2017-0331
https://notcve.org/view.php?id=CVE-2017-0331
An elevation of privilege vulnerability in the NVIDIA video driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: Kernel 3.10. Android ID: A-34113000. • http://nvidia.custhelp.com/app/answers/detail/a_id/4561 http://www.securityfocus.com/bid/98150 https://source.android.com/security/bulletin/2017-05-01 • CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition •