109 results · Clear filters · Feed
-
Medium 5.5CVE-2022-41218 Public exploit
In drivers/media/dvb-core/dmxdev.c in the Linux kernel through 5.19.10, there is a use-after-free caused by refcount ra…
-
Medium 6.3
There is an out-of-bounds write vulnerability in vmwgfx driver
An out-of-bounds(OOB) memory access vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_kms.c in GPU component in the Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the…
-
Medium 6.2
A flaw in net_rds_alloc_sgs() in Oracle Linux kernels allows unprivileged local users to crash the machine. CVSS 3.1 Ba…
-
Medium 4.4
Kernel: security regression for cve-2018-13405
A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that allows local users to create files for the XFS file-system with an unintended group ownership and with group execution and SGID permission bits set, in a sc…
-
Medium 5.5
Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow an authorize…
-
Medium 6.9
Linux Kernel LoadPin bypass via dm-verity table reload
Dm-verity is used for extending root-of-trust to root filesystems. LoadPin builds on this property to restrict module/firmware loads to just the trusted root filesystem. Device-mapper table reloads currently allow users with root privileges to switch out the …
-
Medium 5.5
An issue was discovered in the Linux kernel through 5.18.14. xfrm_expand_policies in net/xfrm/xfrm_policy.c can cause a…
-
Medium 5.5
The Linux kernel was found vulnerable out of bounds memory access in the drivers/video/fbdev/sm712fb.c:smtcfb_read() fu…
-
Medium 5.6
Arbitrary Memory Disclosure through CPU Side-Channel Attacks (Retbleed)
Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can hijack return instructions to achieve arbitrary…
-
Medium 6.7
KGDB and KDB allow read and write access to kernel memory, and thus should be restricted during lockdown. An attacker w…
-
Medium 5.5
usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c in the Linux kernel through 5.17.1 has a double free.
-
Medium 5.5
In the Linux kernel before 5.17.1, a refcount leak bug was found in net/llc/af_llc.c.
-
Medium 6.5
Non-transparent sharing of branch predictor within a context in some Intel(R) Processors may allow an authorized user t…
-
Medium 6.5CVE-2022-0001 Public exploit
Non-transparent sharing of branch predictor selectors between contexts in some Intel(R) Processors may allow an authori…
-
Medium 6.6
Double Free in net/packet/af_packet.c leading to priviledge escalation
A double free bug in packet_set_ring() in net/packet/af_packet.c can be exploited by a local user through crafted syscalls to escalate privileges or deny service. We recommend upgrading kernel past the effected versions or rebuilding past ec6af094ea28f0f2dda1…
KEV Apr 11, 2022 -
Medium 6.5
Guest can force Linux netback driver to hog large amounts of kernel memory T[his CNA information record relates to mult…
-
Medium 6.4CVE-2021-0920 Exploited
In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This could lead to loc…
KEV May 23, 2022 -
Medium 4.0
An information disclosure vulnerability exists in the ARM SIGPAGE functionality of Linux Kernel v5.4.66 and v5.4.54. Th…
-
Medium 6.7
Linux Kernel sctp_destroy_sock race condition
A race condition in Linux kernel SCTP sockets (net/sctp/socket.c) before 5.12-rc8 can lead to kernel privilege escalation from the context of a network service or an unprivileged process. If sctp_destroy_sock is called without sock_net(sk)->sctp.addr_wq_lock …
-
Medium 5.1
Unprivileged overlay + shiftfs read access
Overlayfs did not properly perform permission checking when copying up files in an overlayfs and could be exploited from within a user namespace, if, for example, unprivileged user namespaces were allowed. It was possible to have a file not readable by an unp…
-
Medium 6.3
DCCP CCID structure use-after-free
Use-after-free vulnerability in the Linux kernel exploitable by a local attacker due to reuse of a DCCP socket with an attached dccps_hc_tx_ccid object as a listener after being released. Fixed in Ubuntu Linux kernel 5.4.0-51.56, 5.3.0-68.63, 4.15.0-121.123, …
-
Medium 5.1
IBM Power9 (AIX 7.1, 7.2, and VIOS 3.1) processors could allow a local user to obtain sensitive information from the da…
-
Medium 5.5
An issue was discovered in drivers/accessibility/speakup/spk_ttyio.c in the Linux kernel through 5.9.9. Local attackers…
-
Medium 6.7CVE-2020-14386 Public exploit
A flaw was found in the Linux kernel before 5.9-rc4. Memory corruption can be exploited to gain root privileges from un…
-
Medium 5.5
A flaw was found in the Linux Kernel before 5.8-rc6 in the ZRAM kernel module, where a user with a local account and th…
-
Medium 5.5
A flaw was found in the Linux Kernel before 5.8-rc1 in the prctl() function, where it can be used to enable indirect br…
-
Medium 5.5
A flaw was found in the Linux kernel before 5.8-rc1 in the implementation of the Enhanced IBPB (Indirect Branch Predict…
-
Medium 5.5
A logic bug flaw was found in Linux kernel before 5.8-rc1 in the implementation of SSBD. A bug in the logic handling al…
-
Medium 5.5
A memory out-of-bounds read flaw was found in the Linux kernel before 5.9-rc2 with the ext3/ext4 file system, in the wa…
-
Medium 4.4
A stack information leak flaw was found in s390/s390x in the Linux kernel’s memory manager functionality, where it inco…
-
Medium 6.1
A flaw was found in the Linux kernels SELinux LSM hook implementation before version 5.7, where it incorrectly assumed …
-
Medium 5.9
A NULL pointer dereference flaw was found in the Linux kernel's SELinux subsystem in versions before 5.7. This flaw occ…
-
Medium 5.4CVE-2020-10135 Public exploit
Bluetooth devices supporting BR/EDR v5.2 and earlier are vulnerable to impersonation attacks
Legacy pairing and secure-connections pairing authentication in Bluetooth BR/EDR Core Specification v5.2 and earlier may allow an unauthenticated user to complete authentication without pairing credentials via adjacent access. An unauthenticated, adjacent att…
-
Medium 6.5
There is a use-after-free in kernel versions before 5.5 due to a race condition between the release of ptp_clock and cd…
-
Medium 6.1
An out-of-bounds memory write issue was found in the Linux Kernel, version 3.13 through 5.4, in the way the Linux kerne…
-
Medium 6.6
A stack-based buffer overflow was found in the Linux kernel, version kernel-2.6.32, in Marvell WiFi chip driver. An att…
-
Medium 4.7CVE-2019-10207 Public exploit
A flaw was found in the Linux kernel's Bluetooth implementation of UART, all versions kernel 3.x.x before 4.18.0 and ke…
-
Medium 6.5
TSX Asynchronous Abort condition on some CPUs utilizing speculative execution may allow an authenticated user to potent…
-
Medium 5.5
There is heap-based buffer overflow in Linux kernel, all versions up to, excluding 5.3, in the marvell wifi chip driver…
-
Medium 5.5
There is heap-based buffer overflow in kernel, all versions up to, excluding 5.3, in the marvell wifi chip driver in Li…