Linux kernel vulnerabilities

Linux Kernel versions 2.6.38 through 4.14 have a problematic use of pmd_mkdirty() in touch_pmd(), which may lead to overwriting read-only huge pages. Although not as severe as the original 'Dirty cow' vulnerability, it allows for overwriting pages like zero huge page.

The mm_init function in the Linux kernel before version 4.12.10 does not clear the ->exe_file member of a new process's mm_struct, allowing a local attacker to achieve a use-after-free or possibly have unspecified other impact by running a specially crafted program.

The XFRM dump policy implementation in the Linux kernel before version 4.13.11 allows local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages.

The sctp_do_peeloff function in the Linux kernel before version 4.14 does not check whether the intended netns is used in a peel-off action, which can lead to denial of service (use-after-free and system crash) or other unspecified impacts via crafted system calls.

In the Linux kernel before version 4.13.6, a vulnerability allows local users to gain privileges via crafted system calls. The issue arises from a race condition that leads to mishandling of packet_fanout data structures, resulting in a use-after-free error.

A vulnerability in the Linux kernel related to memory corruption that occurs when switching the path from UFO to non-UFO. The issue arises when UFO packet lengths exceed MTU, leading to negative values in calculations and writing out-of-bounds.

The Linux kernel has a heap out-of-bounds vulnerability in AF_PACKET sockets. This issue is analogous to the previously disclosed CVE-2016-8655, where a socket option changing socket state may race with safety checks.

The prepare_vmcs02 function in the Linux kernel up to version 4.13.3 does not ensure that the 'CR8-load exiting' and 'CR8-store exiting' controls exist when L1 omits the 'use TPR shadow' control, allowing KVM L2 guest OS users to gain read and write access to the hardware CR8 register.

A flaw in the Linux kernel (as used in Red Hat Enterprise Linux 7, kernel-rt, and Enterprise MRG 2) when booted with UEFI Secure Boot enabled allows local users to bypass intended securelevel/secureboot restrictions through improper handling of the secure_boot flag across kexec reboot.

The tpacket_rcv function in the Linux kernel before version 4.13 mishandles vnet headers, which might allow local users to cause a denial of service through buffer overflow and disk and memory corruption.

The driver_override implementation in the Linux kernel before version 4.12.1 allows local users to gain privileges by leveraging a race condition between a read operation and a store operation involving different overrides.

The sanity_check_ckpt function in the Linux kernel before version 4.12.4 does not validate the blkoff and segno arrays, allowing local users to gain privileges via unspecified vectors.

The sanity_check_raw_super function in the Linux kernel before version 4.11.1 does not validate the segment count, allowing local users to gain privileges via unspecified vectors.

A race condition in the Linux kernel before version 4.10.15 in fs/timerfd.c allows local users to gain privileges or cause a denial of service through simultaneous file-descriptor operations.

The mq_notify function in the Linux kernel through version 4.11.9 does not set the sock pointer to NULL upon entry into the retry logic. This may lead to use-after-free vulnerabilities or other unspecified impacts.

The offset2lib patch in the Linux Kernel contains a vulnerability that allows a PIE binary to be execve()'d with 1GB of arguments or environmental strings, leading to the stack occupying the address 0x80000000. The PIE binary is mapped above 0x40000000, nullifying the protection of the offset2lib patch.

The Linux Kernel imposes a size restriction on the arguments and environmental strings passed through RLIMIT_STACK/RLIM_INFINITY, but does not take the argument and environment pointers into account, allowing attackers to bypass this limitation. This affects Linux Kernel versions 4.11.5 and earlier.

An issue was discovered in the size of the stack guard page on Linux. A 4k stack guard page is not sufficiently large and can be 'jumped' over, affecting Linux Kernel versions 4.11.5 and earlier.

The tcp_v6_syn_recv_sock function in the Linux kernel through version 4.11.1 mishandles inheritance, allowing local users to cause a denial of service or possibly have unspecified other impact via crafted system calls.

The dccp_v6_request_recv_sock function in the Linux kernel through version 4.11.1 mishandles inheritance, allowing local users to cause a denial of service or possibly have unspecified other impact via crafted system calls.

The sctp_v6_create_accept_sk function in the Linux kernel through version 4.11.1 mishandles inheritance, allowing local users to cause a denial of service or possibly have unspecified other impact via crafted system calls.

The IPv6 fragmentation implementation in the Linux kernel through version 4.11.1 does not consider that the nexthdr field may be associated with an invalid option. This allows local users to cause a denial of service (out-of-bounds read and BUG) or possibly have unspecified other impact via crafted socket and send system calls.

The ipxitf_ioctl function in the Linux kernel through version 4.11.1 mishandles reference counts, allowing local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via a failed SIOCGIFADDR ioctl call for an IPX interface.

The inet_csk_clone_lock function in the Linux kernel up to version 4.10.15 allows attackers to cause a denial of service (double free) or possibly have unspecified other impact by leveraging the accept system call.

The Linux kernel before version 3.19 has a flaw in counter grouping handling, allowing local users to gain elevated privileges via a crafted application.

The regulator_ena_gpio_free function in the Linux kernel before version 3.19 allows local users to gain privileges or cause a denial of service (use-after-free) via a crafted application.

The packet_set_ring function in the Linux kernel through version 4.10.6 does not properly validate certain block-size data, potentially leading to denial of service or privilege escalation by local users.

A race condition in the Linux kernel up to version 4.10.2 in kernel/ucount.c allows local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via crafted system calls.

The ip_cmsg_recv_checksum function in the Linux kernel before version 4.10.1 has incorrect expectations about skb data layout, allowing local users to cause a denial of service (buffer over-read) or potentially have unspecified other impact via crafted system calls.

A race condition in the Linux kernel before version 4.9.13 in net/packet/af_packet.c allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via a multithreaded application making PACKET_FANOUT setsockopt system calls.

The LLC subsystem in the Linux kernel before version 4.9.13 does not ensure that a certain destructor exists in required circumstances, allowing local users to cause a denial of service (BUG_ON) or possibly have unspecified other impact via crafted system calls.

The do_shmat function in the Linux kernel through version 4.9.12 does not restrict the address calculated by a certain rounding operation, allowing local users to map page zero. This enables bypassing a protection mechanism for the mmap system call.

The tcp_splice_read function in the Linux kernel before version 4.9.11 allows remote attackers to cause a denial of service through the use of a TCP packet with the URG flag, leading to an infinite loop and soft lockup.

The dccp_rcv_state_process function in the Linux kernel through version 4.9.11 mishandles DCCP_PKT_REQUEST packet data structures in the LISTEN state, allowing local users to obtain root privileges or cause a denial of service (double free) via an application making an IPV6_RECVPKTINFO setsockopt system call.

A race condition in the Linux kernel before version 4.9.7 in kernel/events/core.c allows local users to gain privileges via a crafted application making concurrent perf_event_open system calls to move a software group into a hardware context.

The TCP stack in the Linux kernel 3.x does not properly implement a SYN cookie protection mechanism for the case of a fast network connection, allowing remote attackers to cause a denial of service (CPU consumption) by sending many TCP SYN packets.

The ipv4_pktinfo_prepare function in the Linux kernel through version 4.9.9 allows attackers to cause a system crash via crafted system calls or possibly IPv4 traffic with invalid IP options.

The aio_mount function in the Linux kernel before version 4.7.7 does not properly restrict execute access, allowing local users to bypass intended SELinux W^X policy restrictions and gain privileges via an io_setup system call.

A race condition in the ip4_datagram_release_cb function in the Linux kernel before version 3.15.2 allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging incorrect expectations about locking during multithreaded access to internal data structures for IPv4 UDP sockets.

The freelist-randomization feature in mm/slab.c in the Linux kernel 4.8.x and 4.9.x before 4.9.5 allows local users to cause a denial of service (duplicate freelist entries and system crash) or possibly have unspecified other impact in opportunistic circumstances by leveraging the selection of a large value for a random number.

The Linux kernel through version 4.9.3 has a vulnerability that allows local users to obtain sensitive information from kernel memory or cause a denial of service (use-after-free) via a crafted application leveraging instruction emulation for fxrstor, fxsave, sgdt, and sidt.

A race condition in the netlink_dump function in the Linux kernel before version 4.6.3 allows local users to cause a denial of service (double free) or possibly have unspecified other impact via a crafted application that makes sendmsg system calls, leading to an unexpected free operation.

The sock_setsockopt function in the Linux kernel before version 4.8.14 mishandles negative values of sk_sndbuf and sk_rcvbuf. This can lead to system crashes or memory corruption by local users leveraging the CAP_NET_ADMIN capability.

The blk_rq_map_user_iov function in the Linux kernel before version 4.8.14 does not properly restrict the type of iterator, allowing local users to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging access to a /dev/sg device.

The sock_setsockopt function in the Linux kernel before version 3.5 mishandles negative values of sk_sndbuf and sk_rcvbuf. This allows local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact.

In the Linux kernel before version 4.0, a vulnerability allows local users to bypass the 'strict page permissions' protection mechanism and modify the system-call table, potentially gaining elevated privileges.

In the Linux kernel before version 4.4, there is a vulnerability that allows local users to gain elevated privileges via crafted F_OFD_GETLK, F_OFD_SETLK, or F_OFD_SETLKW commands in an fcntl64 system call.

The icmp6_send function in the Linux kernel up to version 4.8.12 omits a certain check of the dst data structure, allowing remote attackers to cause a denial of service (panic) via a fragmented IPv6 packet.

In the Linux kernel before version 4.8.7, there is an issue with mishandling unsuccessful crypto registration in conjunction with successful key-type registration. This can lead to denial of service (NULL pointer dereference and panic) or possibly other unspecified impacts via a crafted application using the big_key data type.

The tipc_msg_build function in the Linux kernel through version 4.8.11 does not validate the relationship between the minimum fragment length and the maximum packet size, which can lead to a heap-based buffer overflow.