239 results · Clear filters · Feed
-
Medium 5.3
It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-…
KEV Jun 26, 2024 -
High 7.8CVE-2023-6931 Public exploit
Out-of-bounds write in Linux kernel's Performance Events system component
A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be exploited to achieve local privilege escalation. A perf_event's read_size can overflow, leading to an heap out-of-bounds increment or write in perf_read_…
-
High 7.8CVE-2022-22942 Public exploit
The vmwgfx driver contains a local privilege escalation vulnerability that allows unprivileged users to gain access to …
-
High 8.8CVE-2023-5178 Public exploit
Kernel: use after free in nvmet_tcp_free_crypto in nvme
A use-after-free vulnerability was found in drivers/nvme/target/tcp.c` in `nvmet_tcp_free_crypto` due to a logical bug in the NVMe/TCP subsystem in the Linux kernel. This issue may allow a malicious user to cause a use-after-free and double-free problem, whic…
-
High 7.0CVE-2023-46813 Public exploit
An issue was discovered in the Linux kernel before 6.5.9, exploitable by local users with userspace access to MMIO regi…
-
High 7.8CVE-2023-5717 Public exploit
Out-of-bounds write in Linux kernel's Linux Kernel Performance Events (perf) component
A heap out-of-bounds write vulnerability in the Linux kernel's Linux Kernel Performance Events (perf) component can be exploited to achieve local privilege escalation. If perf_read_group() is called while an event's sibling_list is smaller than its child's si…
-
Critical 10.0CVE-2023-2163 Public exploit
Incorrect Verifier Branch Pruning Logic Leads To Arbitrary Read/Write In Linux Kernel and Lateral Privilege Escalation
Incorrect verifier pruning in BPF in Linux Kernel >=5.4 leads to unsafe code paths being incorrectly marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege escalation, and container escape.
-
High 7.8CVE-2023-4622 Public exploit
Use-after-free in Linux kernel's af_unix component
A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local privilege escalation. The unix_stream_sendpage() function tries to add data to the last skb in the peer's recv queue without locking the queue. Thus there…
-
High 7.8CVE-2023-32629 Public exploit
Local privilege escalation vulnerability in Ubuntu Kernels overlayfs ovl_copy_up_meta_inode_data skip permission checks…
-
High 7.8
On Ubuntu kernels carrying both c914c0e27eb0 and "UBUNTU: SAUCE: overlayfs: Skip permission checking for trusted.overla…
-
Unscored —CVE-2023-20593 Public exploit
An issue in “Zen 2” CPUs, under specific microarchitectural circumstances, may allow an attacker to potentially access …
-
High 7.0CVE-2023-3640 Public exploit
Kernel: x86/mm: a per-cpu entry area leak was identified through the init_cea_offsets function when prefetchnta and prefetcht2 instructions being used for the per-cpu entry area mapping to the user space
A possible unauthorized memory access flaw was found in the Linux kernel's cpu_entry_area mapping of X86 CPU data to memory, where a user may guess the location of exception stacks or other important data. Based on the previous CVE-2023-0597, the 'Randomize p…
-
High 7.8CVE-2023-3776 Public exploit
Use-after-free in Linux kernel's net/sched: cls_fw component
A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to achieve local privilege escalation. If tcf_change_indev() fails, fw_set_parms() will immediately return an error after incrementing or decrementing the refere…
-
High 7.8CVE-2023-3609 Public exploit
Use-after-free in Linux kernel's net/sched: cls_u32 component
A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation. If tcf_change_indev() fails, u32_set_parms() will immediately return an error after incrementing or decrementing the refe…
-
High 7.8CVE-2023-35001 Public exploit
Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability
Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register contents when CAP_NET_ADMIN is in any user or network namespace
-
Unscored —CVE-2023-1206 Public exploit
A hash collision flaw was found in the IPv6 connection lookup table in the Linux kernel’s IPv6 functionality when a use…
-
Medium 6.5CVE-2023-3338 Public exploit
Crash due to a null pointer dereference in the dn_nsp_send function
A null pointer dereference flaw was found in the Linux kernel's DECnet networking protocol. This issue could allow a remote user to crash the system.
-
High 7.8CVE-2023-3390 Public exploit
Use-after-free in Linux kernel's netfilter subsystem
A use-after-free vulnerability was found in the Linux kernel's netfilter subsystem in net/netfilter/nf_tables_api.c. Mishandled error handling with NFT_MSG_NEWRULE makes it possible to use a dangling pointer in the same transaction causing a use-after-free vu…
-
High 7.0CVE-2023-35828 Public exploit
An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in renesas_usb3_remove in drivers/…
-
High 7.8CVE-2023-35788 Public exploit
An issue was discovered in fl_set_geneve_opt in net/sched/cls_flower.c in the Linux kernel before 6.3.7. It allows an o…
-
Unscored —CVE-2023-2002 Public exploit
A vulnerability was found in the HCI sockets implementation due to a missing capability check in net/bluetooth/hci_sock…
-
High 7.8
In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests can be abused…
-
Medium 4.7CVE-2023-0045 Public exploit
Incorrect indirect branch prediction barrier in the Linux Kernel
The current implementation of the prctl syscall does not issue an IBPB immediately during the syscall. The ib_prctl_set function updates the Thread Information Flags (TIFs) for the task and updates the SPEC_CTRL MSR on the function __speculation_ctrl_update,…
-
Medium 5.6CVE-2023-1998 Public exploit
Spectre v2 SMT mitigations problem in Linux kernel
The Linux kernel allows userspace processes to enable mitigations by calling prctl with PR_SET_SPECULATION_CTRL which disables the speculation feature as well as by using seccomp. We had noticed that on VMs of at least one major cloud provider, the kernel sti…
-
High 8.2CVE-2023-2008 Public exploit
Kernel: udmabuf: improper validation of array index leading to local privilege escalation
A flaw was found in the Linux kernel's udmabuf device driver, within a fault handler. This issue occurs due to the lack of proper validation of user-supplied data, which can result in memory access past the end of an array. This may allow an attacker to escal…
-
High 7.8CVE-2023-1829 Public exploit
Use-after-free in tcindex (traffic control index filter) in the Linux Kernel
A use-after-free vulnerability in the Linux Kernel traffic control index filter (tcindex) can be exploited to achieve local privilege escalation. The tcindex_delete function which does not properly deactivate filters in case of a perfect hashes while deleting…
-
Medium 6.7CVE-2023-28772 Public exploit
An issue was discovered in the Linux kernel before 5.13.3. lib/seq_buf.c has a seq_buf_putmem_hex buffer overflow.
-
High 7.8CVE-2023-1281 Public exploit
UAF in Linux kernel's tcindex (traffic control index filter) implementation
Use After Free vulnerability in Linux kernel traffic control index filter (tcindex) allows Privilege Escalation. The imperfect hash area can be updated while packets are traversing, which will cause a use-after-free when 'tcf_exts_exec()' is called with the d…
-
High 7.8CVE-2023-0461 Public exploit
Use-after-free vulnerability in the Linux Kernel
There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local privilege escalation. To reach the vulnerability kernel configuration flag CONFIG_TLS or CONFIG_XFRM_ESPINTCP has to be configured, but the operation does not …
-
High 8.1CVE-2023-20938 Public exploit
In binder_transaction_buffer_release of binder.c, there is a possible use after free due to improper input validation. …
-
High 7.1CVE-2023-26607 Public exploit
In the Linux kernel 6.0.8, there is an out-of-bounds read in ntfs_attr_find in fs/ntfs/attrib.c.
-
High 7.9
Use after free in SNDRV_CTL_IOCTL_ELEM in Linux Kernel
A use after free vulnerability exists in the ALSA PCM package in the Linux Kernel. SNDRV_CTL_IOCTL_ELEM_{READ|WRITE}32 is missing locks that can be used in a use-after-free that can result in a priviledge escalation to gain ring0 access from the system user. …
KEV Mar 30, 2023 -
Medium 5.5CVE-2022-4543 Public exploit
A flaw named "EntryBleed" was found in the Linux Kernel Page Table Isolation (KPTI). This issue could allow a local att…
-
High 7.8CVE-2022-45934 Public exploit
An issue was discovered in the Linux kernel through 6.0.10. l2cap_config_req in net/bluetooth/l2cap_core.c has an integ…
-
High 8.0CVE-2022-42896 Public exploit
Info Leak in l2cap_core in the Linux Kernel
There are use-after-free vulnerabilities in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_connect and l2cap_le_connect_req functions which may allow code execution and leaking kernel memory (respectively) remotely via Bluetooth. A remote attacker coul…
-
Medium 5.5CVE-2022-3564 Public exploit
Linux Kernel Bluetooth l2cap_core.c l2cap_reassemble_sdu use after free
A vulnerability classified as critical was found in Linux Kernel. Affected by this vulnerability is the function l2cap_reassemble_sdu of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The manipulation leads to use after free. It is recommende…
-
Unscored —CVE-2022-20421 Public exploit
In binder_inc_ref_for_node of binder.c, there is a possible way to corrupt memory due to a use after free. This could l…
-
Unscored —CVE-2022-42703 Public exploit
mm/rmap.c in the Linux kernel before 5.19.7 has a use-after-free related to leaf anon_vma double reuse.
-
Medium 5.5CVE-2022-41218 Public exploit
In drivers/media/dvb-core/dmxdev.c in the Linux kernel through 5.19.10, there is a use-after-free caused by refcount ra…
-
Unscored —CVE-2022-2639 Public exploit
An integer coercion error was found in the openvswitch kernel module. Given a sufficiently large number of actions, whi…