Transmit requests in Xen's virtual network protocol can consist of
multiple parts. While not really useful, except for the initial part
any of them may be of zero length, i.e.carry no data at all. Besides a
certain initial portion of the to be transferred data, these parts are
directly translated into what Linux calls SKB fragments. Such converted
request parts can, when for a particular SKB they are all of length
zero, lead to a de-reference of NULL in core networking code.
NULL Pointer Dereference vulnerability in Linux Linux kernel kernel on Linux, x86, ARM (net, bluetooth modules) allows Overflow Buffers. This vulnerability is associated with program files /net/bluetooth/rfcomm/core.C.
This issue affects Linux kernel: v2.6.12-rc2.
CloudLinux CageFS 7.0.8-2 or below insufficiently restricts file paths supplied to the sendmail proxy command. This allows local users to read and write arbitrary files of certain file formats outside the CageFS environment.
A use-after-free flaw was found in the __ext4_remount in fs/ext4/super.c in ext4 in the Linux kernel. This flaw allows a local user to cause an information leak problem while freeing the old quota file names before a potential failure, leading to a use-after-free.
An out-of-bounds memory read flaw was found in receive_encrypted_standard in fs/smb/client/smb2ops.c in the SMB Client sub-component in the Linux Kernel. This issue occurs due to integer underflow on the memcpy length, leading to a denial of service.
Closing of an event channel in the Linux kernel can result in a deadlock.
This happens when the close is being performed in parallel to an unrelated
Xen console action and the handling of a Xen console interrupt in an
unprivileged guest.
The closing of an event channel is e.g.triggered by removal of a
paravirtual device on the other side. As this action will cause console
messages to be issued on the other side quite often, the chance of
triggering the deadlock is not neglectable.
Note that 32-bit Arm-guests are not affected, as the 32-bit Linux kernel
on Arm doesn't use queued-RW-locks, which are required to trigger the
issue (on Arm32 a waiting writer doesn't block further readers to get
the lock).
CVE-2014-0196 is a race condition vulnerability in the Linux Kernel's n_tty_write function. It allows local users to cause denial-of-service (DoS) or escalate privileges by performing read and write operations with long strings. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the input data.
CVE-2010-3904 is a high-severity vulnerability in the Linux Kernel's Reliable Datagram Sockets (RDS) protocol implementation. It involves improper input validation that can be exploited by local users to gain elevated privileges via crafted use of the sendmsg and recvmsg system calls. This vulnerability has been exploited in the wild.
A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system.
A use after free vulnerability exists in the ALSA PCM package in the Linux Kernel. SNDRV_CTL_IOCTL_ELEM_{READ|WRITE}32 is missing locks that can be used in a use-after-free that can result in a priviledge escalation to gain ring0 access from the system user. We recommend upgrading past commit 56b88b50565cd8b946a2d00b0c83927b7ebb055e
CVE-2021-3493 is a privilege escalation vulnerability in the Linux kernel's overlayfs stacking file system. It arises because the kernel does not properly validate file capabilities in relation to user namespaces, potentially allowing an attacker to escalate privileges. This vulnerability has been exploited in the wild and is considered high severity.
CVE-2014-3153 is a Linux kernel vulnerability in the futex_requeue function that allows local users to escalate privileges by exploiting improper checks on futex addresses. This flaw has been exploited in the wild. No specific affected versions or patch information is provided in the input data.
CVE-2022-0847, known as 'Dirty Pipe,' is a Linux kernel vulnerability that allows an unprivileged local user to escalate their privileges due to improper initialization. It has been exploited in the wild, posing a high risk to affected systems.
CVE-2021-22600 is a vulnerability in the Linux Kernel's packet socket (AF_PACKET) implementation that can cause incorrect memory freeing. This flaw allows a local user to potentially cause a denial-of-service (DoS) or escalate privileges on the affected system. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the input data.
CVE-2016-5195 is a race condition vulnerability in the Linux kernel's mm/gup.c component that allows local users to escalate privileges. This vulnerability has been exploited in the wild and is considered high severity. It affects the Linux kernel but specific affected versions are not provided in the input data.
CVE-2019-13272 is a Linux kernel vulnerability in the ptrace subsystem that improperly manages privileges, allowing local users to escalate their privileges to root. This vulnerability has been exploited in the wild. It affects the Linux kernel but no specific affected versions are provided in the available data.
A race condition was found in util-linux before 2.32.1 in the way su handled the management of child processes. A local authenticated attacker could use this flaw to kill other processes with root privileges under specific conditions.
