Linux kernel vulnerabilities

A use-after-free vulnerability in the ffs_user_copy_worker function in the Linux kernel before version 4.5.3 allows local users to gain privileges by accessing an I/O data structure after a certain callback call.

A race condition in the get_task_ioprio function in the Linux kernel before version 4.6.6 allows local users to gain privileges or cause a denial of service (use-after-free) via a crafted ioprio_get system call.

A use-after-free vulnerability in the disk_seqf_stop function in the Linux kernel before version 4.7.1 allows local users to gain privileges by leveraging the execution of a certain stop operation even if the corresponding start operation had failed.

A race condition in the Linux kernel before version 4.4 in kernel/events/core.c allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging incorrect handling of an swevent data structure during a CPU unplug operation.

A double free vulnerability in the sg_common_write function in the Linux kernel before version 4.4 allows local users to gain privileges or cause a denial of service by detaching a device during an SG_IO ioctl call.

The __ext4_journal_stop function in the Linux kernel before version 4.3.3 allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging improper access to a certain error field.

The XFS subsystem in the Linux kernel through 4.8.2 allows local users to cause a denial of service (fdatasync failure and system hang) by using the vfs syscall group in the trinity program, related to a "page lock order bug in the XFS seek hole/data implementation."

In the Linux kernel before version 4.1.4, there is an issue with mishandling anonymous pages, allowing local users to gain privileges or cause a denial of service via a crafted application that triggers writing to page zero.

The apparmor_setprocattr function in the Linux kernel before version 4.6.5 does not validate the buffer size, allowing local users to gain privileges by triggering an AppArmor setprocattr hook.

The Linux kernel in version 4.7-rc6 has a vulnerability that allows local users to cause a denial of service (panic) or potentially have unspecified other impact via certain IPv6 socket operations.

The IPv6 stack in the Linux kernel before version 4.3.3 mishandles options data, allowing local users to gain privileges or cause a denial of service via a crafted sendmsg system call.

The trace_writeback_dirty_page implementation in the Linux kernel before version 4.4 improperly interacts with mm/migrate.c, allowing local users to cause a denial of service through NULL pointer dereference and system crash.

The rds_inc_info_copy function in the Linux kernel through version 4.6.3 does not initialize a certain structure member, allowing remote attackers to obtain sensitive information from kernel stack memory by reading an RDS message.

The ecryptfs_privileged_open function in the Linux kernel before version 4.6.3 allows local users to gain privileges or cause a denial of service via crafted mmap calls for /proc pathnames, leading to recursive pagefault handling.

Integer overflow in lib/asn1_decoder.c in the Linux kernel before 4.6 allows local users to gain privileges via crafted ASN.1 data.

The tipc_nl_publ_dump function in the Linux kernel through version 4.6 does not verify socket existence, allowing local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a dumpit operation.

Use-after-free vulnerability in mm/percpu.c in the Linux kernel through 4.6 allows local users to cause a denial of service (BUG) or possibly have unspecified other impact via crafted use of the mmap and bpf system calls.

The x25_negotiate_facilities function in the Linux kernel before version 4.5.5 does not properly initialize a certain data structure, allowing attackers to obtain sensitive information from kernel stack memory via an X.25 Call Request.

The replace_map_fd_with_map_ptr function in the Linux kernel before version 4.5.5 does not properly maintain an fd data structure, allowing local users to gain privileges or cause a denial of service (use-after-free) via crafted BPF instructions referencing an incorrect file descriptor.

The llc_cmsg_rcv function in the Linux kernel before version 4.5.5 does not initialize a certain data structure, allowing attackers to obtain sensitive information from kernel stack memory by reading a message.

The tcp_cwnd_reduction function in the Linux kernel before version 4.3.5 allows remote attackers to cause a denial of service via a divide-by-zero error, leading to system crashes.

Integer overflow in the aio_setup_single_vector function in Linux kernel 4.0 allows local users to cause denial of service or possibly have unspecified other impact via a large AIO iovec.

The Linux kernel 3.19 before 3.19.3 does not validate certain range data for sendto and recvfrom system calls, allowing local users to gain privileges by leveraging a subsystem that uses the copy_from_iter function in the iov_iter interface.

Integer overflow in fs/aio.c in the Linux kernel before 3.4.1 allows local users to cause a denial of service or possibly have unspecified other impact via a large AIO iovec.

The netlink_sendmsg function in the Linux kernel before version 3.5.5 does not validate the dst_pid field, allowing local users to spoof Netlink messages.

The redirect_target function in the Linux kernel before version 2.6.0 allows remote attackers to cause a denial of service by sending packets to an interface with a 0.0.0.0 IP address, leading to a NULL pointer dereference.

The arch_pick_mmap_layout function in the Linux kernel up to version 4.5.2 does not properly randomize the legacy base address, making it easier for local users to bypass restrictions on the ADDR_NO_RANDOMIZE flag and the ASLR protection mechanism for setuid or setgid programs.

A race condition in the Linux kernel before version 4.4.1 in arch/x86/mm/tlb.c allows local users to gain privileges by triggering access to a paging structure by a different CPU.

The __switch_to function in the Linux kernel does not properly context-switch IOPL on 64-bit PV Xen guests, allowing local guest OS users to gain privileges, cause a denial of service (guest OS crash), or obtain sensitive information by leveraging I/O port access.

The join_session_keyring function in the Linux kernel before version 4.4.1 mishandles object references in an error case, allowing local users to gain privileges or cause a denial of service (integer overflow and use-after-free) via crafted keyctl commands.

The Linux kernel through version 4.4.1 mishandles uid and gid mappings, allowing local users to gain privileges by establishing a user namespace and using the ptrace system call.

The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects. This allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated by JavaScript code that creates many CANVAS elements for rendering by Chrome or Firefox.

The udp_recvmsg and udpv6_recvmsg functions in the Linux kernel before version 4.0.6 do not properly consider yielding a processor, allowing remote attackers to cause a denial of service (system hang) via incorrect checksums within a UDP packet flood.

In the Linux kernel before version 4.1.6 on the x86_64 platform, there is a flaw in handling IRET faults during NMI processing that occurred during userspace execution. This may allow local users to gain privileges by triggering an NMI.

The pipe_read and pipe_write implementations in the Linux kernel before version 3.16 do not properly consider the side effects of failed __copy_to_user_inatomic and __copy_from_user_inatomic calls. This can lead to system crashes or potential privilege escalation by local users via a crafted application.

The __driver_rfc4106_decrypt function in the Linux kernel before version 3.19.3 improperly determines the memory locations used for encrypted data, which can lead to buffer overflow and system crash or potentially arbitrary code execution.

The pmd_none_or_trans_huge_or_clear_bad function in the Linux kernel before version 3.13 on NUMA systems improperly determines whether a Page Middle Directory (PMD) entry is a transparent huge-table entry, potentially leading to system crashes.

The implementation of certain splice_write file operations in the Linux kernel before version 3.16 does not enforce a restriction on the maximum size of a single file, allowing local users to cause a denial of service (system crash) or possibly have unspecified other impacts via a crafted splice system call.

The Linux kernel before version 3.17.5 has an issue with handling faults related to the Stack Segment (SS) segment register, allowing local users to gain privileges by triggering an IRET instruction that leads to access to a GS Base address from the wrong space.

The Linux kernel up to version 3.17.2 has an issue with handling private syscall numbers in the ftrace subsystem, allowing local users to gain privileges or cause a denial of service via a crafted application.

The Linux kernel before version 2.6.36 has a flaw in include/linux/netdevice.h that incorrectly uses macros for netdev_printk and its related logging implementation. This allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) by sending invalid packets to a VxLAN interface.

The do_remount function in the Linux kernel up to version 3.16.1 does not maintain the MNT_LOCK_READONLY bit across a remount of a bind mount, allowing local users to bypass an intended read-only restriction.

The sctp_sf_do_5_1D_ce function in the Linux kernel through version 3.13.6 does not validate certain auth_enable and auth_capable fields before making an sctp_sf_authenticate call. This allows remote attackers to cause a denial of service via an SCTP handshake with a modified INIT chunk and a crafted AUTH chunk before a COOKIE_ECHO chunk.

Buffer overflow in the complete_emulated_mmio function in the Linux kernel before version 3.13.6 allows guest OS users to execute arbitrary code on the host OS. It leverages a loop that triggers an invalid memory copy affecting certain cancel_work_item data.

A vulnerability related to use-after-free in drm_crtc_commit after release has been fixed in the Linux kernel. The issue involved improper duplication of the drm_plane_state in the atmel_hlcdc_plane_atomic_duplicate_state() function.

A vulnerability has been identified and resolved in the Linux kernel. The issue concerns the fbcon_open() function, which, if it fails, does not set the info->fbcon_par pointer, leading to later dereferencing of a NULL pointer.

A vulnerability has been identified in the Linux kernel that has been resolved. In the tw9906_probe() function, there was a potential memory leak because memory allocated in v4l2_ctrl_handler_init() and v4l2_ctrl_new_std() was not freed.

A vulnerability has been identified in the Linux kernel related to the kexec_load_purgatory() function, which derives the start image from the SHF_EXECINSTR section. The issue occurs when the purgatory object contains multiple executable sections with overlapping addresses.

A vulnerability has been identified in the Linux kernel related to a regmap leak on probe failure. The allocated mmio regmap is never freed, which can lead to memory issues.

In the Linux kernel, a vulnerability in KVM for AMD SEV-SNP was found. During SNP launch finish, the synchronization and encryption of VMSA (Virtual Machine Save Area) does not lock all vCPUs, allowing userspace to manipulate or run a vCPU while its state is being synchronized.