311 results · Clear filters · Feed
-
High 8.8CVE-2021-31440 Public exploit
This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel 5.11.15. An …
-
Unscored —CVE-2021-33034 Public exploit
In the Linux kernel before 5.12.4, net/bluetooth/hci_event.c has a use-after-free when destroying an hci_chan, aka CID-…
-
Unscored —CVE-2021-32399 Public exploit
net/bluetooth/hci_request.c in the Linux kernel through 5.12.2 has a race condition for removal of the HCI controller.
-
Unscored —CVE-2021-29155 Public exploit
An issue was discovered in the Linux kernel through 5.11.x. kernel/bpf/verifier.c performs undesirable out-of-bounds sp…
-
High 8.8
The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting …
KEV Oct 20, 2022 -
Unscored —CVE-2021-27365 Public exploit
An issue was discovered in the Linux kernel through 5.11.3. Certain iSCSI data structures do not have appropriate lengt…
-
Unscored —CVE-2021-26708 Public exploit
A local privilege escalation was discovered in the Linux kernel before 5.10.13. Multiple race conditions in the AF_VSOC…
-
High 7.8CVE-2021-3347 Public exploit
An issue was discovered in the Linux kernel through 5.10.11. PI futexes have a kernel stack use-after-free during fault…
-
Unscored —CVE-2020-27786 Public exploit
A flaw was found in the Linux kernel’s implementation of MIDI, where an attacker with a local account and the permissio…
-
Unscored —CVE-2020-29661 Public exploit
A locking issue was discovered in the tty subsystem of the Linux kernel through 5.9.13. drivers/tty/tty_jobctrl.c allow…
-
High 7.8CVE-2020-14381 Public exploit
A flaw was found in the Linux kernel’s futex implementation. This flaw allows a local attacker to corrupt system memory…
-
Unscored —CVE-2020-29370 Public exploit
An issue was discovered in kmem_cache_alloc_bulk in mm/slub.c in the Linux kernel before 5.5.11. The slowpath lacks the…
-
Unscored —CVE-2020-15436 Public exploit
Use-after-free vulnerability in fs/block_dev.c in the Linux kernel before 5.8 allows local users to gain privileges or …
-
Unscored —CVE-2020-12352 Public exploit
Improper access control in BlueZ may allow an unauthenticated user to potentially enable information disclosure via adj…
-
Unscored —CVE-2020-12351 Public exploit
Improper input validation in BlueZ may allow an unauthenticated user to potentially enable escalation of privilege via …
-
Unscored —CVE-2020-25705 Public exploit
A flaw in ICMP packets in the Linux kernel may allow an attacker to quickly scan open UDP ports. This flaw allows an of…
-
Unscored —CVE-2020-8694 Public exploit
Insufficient access control in the Linux kernel driver for some Intel(R) Processors may allow an authenticated user to …
-
Unscored —CVE-2020-0423 Public exploit
In binder_release_work of binder.c, there is a possible use-after-free due to improper locking. This could lead to loca…
-
Medium 6.7CVE-2020-14386 Public exploit
A flaw was found in the Linux kernel before 5.9-rc4. Memory corruption can be exploited to gain root privileges from un…
-
Unscored —CVE-2020-15802 Public exploit
Devices supporting Bluetooth before 5.1 may allow man-in-the-middle attacks, aka BLURtooth. Cross Transport Key Derivat…
-
Unscored —CVE-2020-14356 Public exploit
A flaw null pointer dereference in the Linux kernel cgroupv2 subsystem in versions before 5.7.10 was found in the way w…
-
Unscored —CVE-2020-15780 Public exploit
An issue was discovered in drivers/acpi/acpi_configfs.c in the Linux kernel before 5.7.7. Injection of malicious ACPI t…
-
Unscored —CVE-2020-10757 Public exploit
A flaw was found in the Linux Kernel in versions after 4.5-rc1 in the way mremap handled DAX Huge Pages. This flaw allo…
-
Medium 5.4CVE-2020-10135 Public exploit
Bluetooth devices supporting BR/EDR v5.2 and earlier are vulnerable to impersonation attacks
Legacy pairing and secure-connections pairing authentication in Bluetooth BR/EDR Core Specification v5.2 and earlier may allow an unauthenticated user to complete authentication without pairing credentials via adjacent access. An unauthenticated, adjacent att…
-
Unscored —CVE-2019-14615 Public exploit
Insufficient control flow in certain data structures for some Intel(R) Processors with Intel(R) Processor Graphics may …
-
Unscored —CVE-2020-0009 Public exploit
In calc_vm_may_flags of ashmem.c, there is a possible arbitrary write to shared memory due to a permissions bypass. Thi…
-
Unscored —CVE-2019-19447 Public exploit
In the Linux kernel 5.0.21, mounting a crafted ext4 filesystem image, performing some operations, and unmounting can le…
-
High 8.0CVE-2019-10220 Public exploit
Linux kernel CIFS implementation, version 4.9.0 is vulnerable to a relative paths injection in directory entry lists.
-
Medium 4.7CVE-2019-10207 Public exploit
A flaw was found in the Linux kernel's Bluetooth implementation of UART, all versions kernel 3.x.x before 4.18.0 and ke…
-
Unscored —CVE-2019-18885 Public exploit
fs/btrfs/volumes.c in the Linux kernel before 5.1 allows a btrfs_verify_dev_extents NULL pointer dereference via a craf…
-
Unscored —CVE-2019-18683 Public exploit
An issue was discovered in drivers/media/platform/vivid in the Linux kernel through 5.3.8. It is exploitable for privil…
-
Unscored —CVE-2019-17666 Public exploit
rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel through 5.3.6 lacks a certain upper-bou…
-
Unscored —
An issue was discovered in net/wireless/nl80211.c in the Linux kernel through 5.2.17. It does not check the length of v…
-
Medium 5.6CVE-2019-1125 Public exploit
Windows Kernel Information Disclosure Vulnerability
An information disclosure vulnerability exists when certain central processing units (CPU) speculatively access memory. An attacker who successfully exploited the vulnerability could read privileged data across trust boundaries. To exploit this vulnerability,…
-
High 7.6CVE-2019-9506 Public exploit
Blutooth BR/EDR specification does not specify sufficient encryption key length and allows an attacker to influence key length negotiation
The Bluetooth BR/EDR specification up to and including version 5.1 permits sufficiently low encryption key length and does not prevent an attacker from influencing the key length negotiation. This allows practical brute-force attacks (aka "KNOB") that can dec…
-
High 7.8
In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a proc…
KEV Dec 10, 2021 -
Medium 5.3
SACK can cause extensive memory use via fragmented resend queue
Jonathan Looney discovered that the TCP retransmission queue implementation in tcp_fragment in the Linux kernel could be fragmented when handling certain TCP Selective Acknowledgment (SACK) sequences. A remote attacker could use this to cause a denial of serv…
-
High 7.5
Integer overflow in TCP_SKB_CB(skb)->tcp_gso_segs
Jonathan Looney discovered that the TCP_SKB_CB(skb)->tcp_gso_segs value was subject to an integer overflow in the Linux kernel when handling TCP Selective Acknowledgments (SACKs). A remote attacker could use this to cause a denial of service. This has been fi…
-
Unscored —CVE-2019-11599 Public exploit
The coredump implementation in the Linux kernel before 5.0.10 does not use locking or other mechanisms to prevent vma l…
-
Unscored —CVE-2019-9213 Public exploit
In the Linux kernel before 4.20.14, expand_downwards in mm/mmap.c lacks a check for the mmap minimum address, which mak…