CVSS: 7.8EPSS: 0%CPEs: 11EXPL: 0CVE-2017-7184 – Linux Kernel XFRM Out-Of-Bounds Access Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2017-7184
The xfrm_replay_verify_len function in net/xfrm/xfrm_user.c in the Linux kernel through 4.10.6 does not validate certain size data after an XFRM_MSG_NEWAE update, which allows local users to obtain root privileges or cause a denial of service (heap-based out-of-bounds access) by leveraging the CAP_NET_ADMIN capability, as demonstrated during a Pwn2Own competition at CanSecWest 2017 for the Ubuntu 16.10 linux-image-* package 4.8.0.41.52. La función xfrm_replay_verify_len en net/xfrm/xfrm_user.c en el kernel de Linux hasta la versión 4.10.6 no valida ciertos datos de tamaño después de una actualización XFRM_MSG_NEWAE, lo que permite a usuarios locales obtener privilegios de root o provocar una denegación de servicio (acceso fuera de límites basado en memoria dinámica) aprovechando la capacidad CAP_NET_ADMIN, como se demostró durante una competición Pwn2Own en CanSecWest 2017 para el paquete Ubuntu 16.10 linux-image-* 4.8.0.41.52. Out-of-bounds kernel heap access vulnerability was found in xfrm, kernel's IP framework for transforming packets. An error dealing with netlink messages from an unprivileged user leads to arbitrary read/write and privilege escalation. This vulnerability allows local attackers to execute arbitrary code on vulnerable installations of the Linux Kernel. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=677e806da4d916052585301785d847c3b3e6186a http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f843ee6dd019bcece3e74e76ad9df0155655d0df http://openwall.com/lists/oss-security/2017/03/29/2 http://www.eweek.com/security/ubuntu-linux-falls-on-day-1-of-pwn2own-hacking-competition http://www.securityfocus.com/bid/97018 http://www.securitytracker.com/id/1038166 https://access.redhat.com/errata/RHSA-2017:2918 • CWE-122: Heap-based Buffer Overflow •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2017-6951 – kernel: NULL pointer dereference in keyring_search_aux function
https://notcve.org/view.php?id=CVE-2017-6951
The keyring_search_aux function in security/keys/keyring.c in the Linux kernel through 3.14.79 allows local users to cause a denial of service (NULL pointer dereference and OOPS) via a request_key system call for the "dead" type. La función keyring_search_aux en security/keys/keyring.c en el kernel de Linux hasta la versión 3.14.79 permite a usuarios locales provocar una denegación de servicio (referencia a puntero NULL y OOPS) a través de una llamada al sistema request_key para el tipo "muerte". The keyring_search_aux function in security/keys/keyring.c in the Linux kernel allows local users to cause a denial of service via a request_key system call for the "dead" key type. • http://www.securityfocus.com/bid/96943 http://www.spinics.net/lists/keyrings/msg01845.html http://www.spinics.net/lists/keyrings/msg01846.html http://www.spinics.net/lists/keyrings/msg01849.html https://access.redhat.com/errata/RHSA-2017:1842 https://access.redhat.com/errata/RHSA-2017:2077 https://access.redhat.com/errata/RHSA-2017:2669 https://access.redhat.com/security/cve/CVE-2017-6951 https://bugzilla.redhat.com/show_bug.cgi?id=1433252 • CWE-476: NULL Pointer Dereference •
CVSS: 7.0EPSS: 0%CPEs: 2EXPL: 0CVE-2017-6874
https://notcve.org/view.php?id=CVE-2017-6874
Race condition in kernel/ucount.c in the Linux kernel through 4.10.2 allows local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via crafted system calls that leverage certain decrement behavior that causes incorrect interaction between put_ucounts and get_ucounts. Condición de carrera en kernel/ucount.c en el kernel de Linux hasta la versión 4.10.2 permite a usuarios locales provocar una denegación de servicio (uso después de liberación y caída del sistema) o tener otro posible impacto no especificado a través de llamadas al sistema manipuladas que aprovechan cierto decremento de comportamiento que causa una interacción incorrecta entre put_ucounts y get_ucounts. • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=040757f738e13caaa9c5078bca79aa97e11dde88 http://www.securityfocus.com/bid/96856 https://github.com/torvalds/linux/commit/040757f738e13caaa9c5078bca79aa97e11dde88 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-416: Use After Free •
CVSS: 9.3EPSS: 0%CPEs: 1EXPL: 0CVE-2017-0335
https://notcve.org/view.php?id=CVE-2017-0335
An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: Kernel-3.18. Android ID: A-33043375. • http://www.securityfocus.com/bid/96723 http://www.securitytracker.com/id/1037968 https://source.android.com/security/bulletin/2017-03-01.html •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2016-8483
https://notcve.org/view.php?id=CVE-2016-8483
An information disclosure vulnerability in the Qualcomm power driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as High because it could be used to access sensitive data without explicit user permission. Product: Android. Versions: Kernel-3.10. Android ID: A-33745862. • http://www.securityfocus.com/bid/96805 http://www.securitytracker.com/id/1037968 https://source.android.com/security/bulletin/2017-03-01 https://source.android.com/security/bulletin/2017-03-01.html https://source.codeaurora.org/quic/la//kernel/msm-3.18/commit/?id=6997dcb7ade1315474855821e64782205cb0b53a • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •