CVSS: 7.2EPSS: 0%CPEs: 319EXPL: 3CVE-2009-3638
https://notcve.org/view.php?id=CVE-2009-3638
Integer overflow in the kvm_dev_ioctl_get_supported_cpuid function in arch/x86/kvm/x86.c in the KVM subsystem in the Linux kernel before 2.6.31.4 allows local users to have an unspecified impact via a KVM_GET_SUPPORTED_CPUID request to the kvm_arch_dev_ioctl function. Desbordamiento de entero en la función kvm_dev_ioctl_get_supported_cpuid en arch/x86/kvm/x86.c en el subsistema KVM en el kernel de Linux anteriores a v2.6.31.4 permite a usuarios locales conseguir un impacto desconocido a través de una petición KVM_GET_SUPPORTED_CPUID a la función kvm_arch_dev_ioctl. • http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=6a54435560efdab1a08f429a954df4d6c740bddf http://marc.info/?l=oss-security&m=125628917011048&w=2 http://marc.info/?l=oss-security&m=125632898507373&w=2 http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.31.4 http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.32-rc4 http://www.mandriva.com/security/advisories?name=MDVSA-2009:329 http://www.securityfocus.com/bid/36803 • CWE-189: Numeric Errors •
CVSS: 4.9EPSS: 0%CPEs: 337EXPL: 0CVE-2009-3640
https://notcve.org/view.php?id=CVE-2009-3640
The update_cr8_intercept function in arch/x86/kvm/x86.c in the KVM subsystem in the Linux kernel before 2.6.32-rc1 does not properly handle the absence of an Advanced Programmable Interrupt Controller (APIC), which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly gain privileges via a call to the kvm_vcpu_ioctl function. La función update_cr8_intercept en arch/x86/kvm/x86.c en el subsistema KVM en el kernel de Linux anteriores v2.6.32-rc1 no gestiona adecuadamente la ausencia del "Advanced Programmable Interrupt Controller (APIC)", lo que permite a usuarios locales producir una denegación de servicio (desreferencia a puntero nulo y caída del sistema) o posiblemente conseguir privilegios a través de una llamada a la funcion kvm_vcpu_ioctl. • http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=88c808fd42b53a7e01a2ac3253ef31fef74cb5af http://marc.info/?l=oss-security&m=125626965020571&w=2 http://marc.info/?l=oss-security&m=125640417219385&w=2 http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.32-rc1 http://www.securityfocus.com/bid/36805 https://exchange.xforce.ibmcloud.com/vulnerabilities/53947 • CWE-20: Improper Input Validation •
CVSS: 7.8EPSS: 0%CPEs: 16EXPL: 0CVE-2009-3620 – kernel: r128 IOCTL NULL pointer dereferences when CCE state is uninitialised
https://notcve.org/view.php?id=CVE-2009-3620
The ATI Rage 128 (aka r128) driver in the Linux kernel before 2.6.31-git11 does not properly verify Concurrent Command Engine (CCE) state initialization, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly gain privileges via unspecified ioctl calls. El controlador ATI Rage 128 (también conocido como r128), en el Kernel de Linux anterior a v2.6.31-git11 no verifica de forma adecuada el estado de inicialización del "Concurrent Command Engine (CCE)", lo que permite a usuarios locales provocar una denegación de servicio (desreferenciación de puntero nulo y caída del sistema) o posiblemente obtener privilegios a través de llamadas ioctl sin especificar. • http://article.gmane.org/gmane.linux.kernel/892259 http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=7dc482dfeeeefcfd000d4271c4626937406756d7 http://lists.opensuse.org/opensuse-security-announce/2009-12/msg00002.html http://lists.opensuse.org/opensuse-security-announce/2009-12/msg00005.html http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00005.html http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00007.html http://lists.vmware.com/pipermail/sec • CWE-476: NULL Pointer Dereference CWE-908: Use of Uninitialized Resource •
CVSS: 5.5EPSS: 0%CPEs: 15EXPL: 5CVE-2009-3621 – Linux Kernel 2.6.31.4 - 'unix_stream_connect()' Local Denial of Service
https://notcve.org/view.php?id=CVE-2009-3621
net/unix/af_unix.c in the Linux kernel 2.6.31.4 and earlier allows local users to cause a denial of service (system hang) by creating an abstract-namespace AF_UNIX listening socket, performing a shutdown operation on this socket, and then performing a series of connect operations to this socket. net/unix/af_unix.c en el kernel de Linux v2.6.31.4 y anteriores permite a usuarios locales causar una denegación de servicio (el servidor se bloquea) creando un socket abstract-namespace AF_UNIX y realizando una operación de apagado en ese socket, para luego luego realizar una serie de operaciones de conexión en dicho socket. • https://www.exploit-db.com/exploits/10022 http://git.kernel.org/?p=linux/kernel/git/davem/net-2.6.git%3Ba=commit%3Bh=77238f2b942b38ab4e7f3aced44084493e4a8675 http://lists.opensuse.org/opensuse-security-announce/2009-12/msg00002.html http://lists.opensuse.org/opensuse-security-announce/2009-12/msg00005.html http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00000.html http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00005.html http://lists.opensuse.org/opensuse-security-announce • CWE-400: Uncontrolled Resource Consumption •
CVSS: 2.1EPSS: 0%CPEs: 18EXPL: 0CVE-2009-2910 – kernel: x86_64 32 bit process register leak
https://notcve.org/view.php?id=CVE-2009-2910
arch/x86/ia32/ia32entry.S in the Linux kernel before 2.6.31.4 on the x86_64 platform does not clear certain kernel registers before a return to user mode, which allows local users to read register values from an earlier process by switching an ia32 process to 64-bit mode. arch/x86/ia32/ia32entry.S en el kernel de Linux anteriores a v2.6.31.4 en plataformas x86_64 no limpia adecuadamente ciertos registros del kernel antes de regresar al modo usuario, lo que permite a usuarios locales leer valores del registro desde un proceso anterior mediante el cambio de un proceso ia32 al modo 64-bit • http://git.kernel.org/?p=linux/kernel/git/x86/linux-2.6-tip.git%3Ba=commit%3Bh=24e35800cdc4350fc34e2bed37b608a9e13ab3b6 http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00005.html http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00007.html http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00005.html http://lkml.org/lkml/2009/10/1/164 http://marc.info/?l=oss-security&m=125442304214452&w=2 http://marc.info/?l=oss-security&m=125444390112831&w&# • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •