CVSS: 7.8EPSS: 0%CPEs: 26EXPL: 3CVE-2021-42008
https://notcve.org/view.php?id=CVE-2021-42008
The decode_data function in drivers/net/hamradio/6pack.c in the Linux kernel before 5.13.13 has a slab out-of-bounds write. Input from a process that has the CAP_NET_ADMIN capability can lead to root access. La función decode_data en el archivo drivers/net/hamradio/6pack.c en el kernel de Linux versiones anteriores a 5.13.13, presenta una escritura fuera de límites. La entrada desde un proceso que tiene la capacidad CAP_NET_ADMIN puede conllevar a un acceso de root • https://github.com/0xdevil/CVE-2021-42008 https://github.com/numanturle/CVE-2021-42008 https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.13.13 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=19d1532a187669ce86d5a2696eb7275310070793 https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html https://security.netapp.com/advisory/ntap-20211104-0002 https://www.youtube.com/watch?v=d5f9xLK8Vhw • CWE-787: Out-of-bounds Write •
CVSS: 8.8EPSS: 3%CPEs: 3EXPL: 0CVE-2021-32765 – Integer Overflow to Buffer Overflow in Hiredis
https://notcve.org/view.php?id=CVE-2021-32765
Hiredis is a minimalistic C client library for the Redis database. In affected versions Hiredis is vulnurable to integer overflow if provided maliciously crafted or corrupted `RESP` `mult-bulk` protocol data. When parsing `multi-bulk` (array-like) replies, hiredis fails to check if `count * sizeof(redisReply*)` can be represented in `SIZE_MAX`. If it can not, and the `calloc()` call doesn't itself make this check, it would result in a short allocation and subsequent buffer overflow. Users of hiredis who are unable to update may set the [maxelements](https://github.com/redis/hiredis#reader-max-array-elements) context option to a value small enough that no overflow is possible. • https://github.com/redis/hiredis/commit/76a7b10005c70babee357a7d0f2becf28ec7ed1e https://github.com/redis/hiredis/security/advisories/GHSA-hfm9-39pp-55p2 https://lists.debian.org/debian-lts-announce/2021/10/msg00007.html https://security.gentoo.org/glsa/202210-32 https://security.netapp.com/advisory/ntap-20211104-0003 https://wiki.sei.cmu.edu/confluence/display/c/MEM07-C.+Ensure+that+the+arguments+to+calloc%28%29%2C+when+multiplied%2C+do+not+wrap • CWE-190: Integer Overflow or Wraparound CWE-680: Integer Overflow to Buffer Overflow •
CVSS: 7.8EPSS: 0%CPEs: 27EXPL: 0CVE-2021-41864 – kernel: eBPF multiplication integer overflow in prealloc_elems_and_freelist() in kernel/bpf/stackmap.c leads to out-of-bounds write
https://notcve.org/view.php?id=CVE-2021-41864
prealloc_elems_and_freelist in kernel/bpf/stackmap.c in the Linux kernel before 5.14.12 allows unprivileged users to trigger an eBPF multiplication integer overflow with a resultant out-of-bounds write. prealloc_elems_and_freelist en kernel/bpf/stackmap.c en el kernel de Linux antes de la versión 5.14.12 permite a usuarios sin privilegios desencadenar un desbordamiento de enteros en la multiplicación de eBPF con una escritura fuera de los límites resultante. An out-of-bounds (OOB) memory write flaw was found in prealloc_elems_and_freelist in kernel/bpf/stackmap.c in the bpf in the Linux kernel. In this flaw, the multiplication to calculate the size could lead to an integer overflow which could allow a local attacker, with a special user privilege, to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. • https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.14.12 https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=30e29a9a2bc6a4888335a6ede968b75cd329657a https://github.com/torvalds/linux/commit/30e29a9a2bc6a4888335a6ede968b75cd329657a https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7BLLVKYAIETEORUPTFO3TR3C33ZPFXQM http • CWE-190: Integer Overflow or Wraparound CWE-787: Out-of-bounds Write •
CVSS: 4.9EPSS: 0%CPEs: 4EXPL: 0CVE-2021-20317 – kernel: timer tree corruption leads to missing wakeup and system freeze
https://notcve.org/view.php?id=CVE-2021-20317
A flaw was found in the Linux kernel. A corrupted timer tree caused the task wakeup to be missing in the timerqueue_add function in lib/timerqueue.c. This flaw allows a local attacker with special user privileges to cause a denial of service, slowing and eventually stopping the system while running OSP. Se ha encontrado un fallo en el kernel de Linux. Un árbol de temporizadores corrompido hacía que faltara el despertar de la tarea en la función timerqueue_add en el archivo lib/timerqueue.c. • https://bugzilla.redhat.com/show_bug.cgi?id=2005258 https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/commit/?id=511885d7061eda3eb1faf3f57dcc936ff75863f1 https://lists.debian.org/debian-lts-announce/2021/12/msg00012.html https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html https://www.debian.org/security/2022/dsa-5096 https://access.redhat.com/security/cve/CVE-2021-20317 • CWE-665: Improper Initialization •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 1CVE-2021-32274
https://notcve.org/view.php?id=CVE-2021-32274
An issue was discovered in faad2 through 2.10.0. A heap-buffer-overflow exists in the function sbr_qmf_synthesis_64 located in sbr_qmf.c. It allows an attacker to cause code Execution. Se ha detectado un problema en faad2 versiones hasta 2.10.0. Se presenta un desbordamiento del búfer de la pila en la función sbr_qmf_synthesis_64 ubicada en el archivo sbr_qmf.c. • https://github.com/knik0/faad2/issues/60 https://lists.debian.org/debian-lts-announce/2021/10/msg00020.html https://www.debian.org/security/2022/dsa-5109 • CWE-787: Out-of-bounds Write •