Design/Logic Flaw

fs/direct-io.c in the dio subsystem in the Linux kernel before 2.6.23 does not properly zero out the dio struct, which allows local users to cause a denial of service OOPS, as demonstrated by a certain fio test...

CVE-2007-6716: Undefined Security Weakness

fs/direct-io.c in the dio subsystem in the Linux kernel before 2.6.23 does not properly zero out the dio struct, which allows local users to cause a denial of service OOPS, as demonstrated by a certain fio test...

linux/x86 writes a php connectback shell to the fs 508 bytes

No description provided by source. include stdlib.h / Grayscale Research: Linux Write FS PHP Connect Back Utility Shellcode Function: Opens /var/www/cb.php and writes a php connectback shell to the filesystem. Shellcode Size: 508 bytes No Encodings PHP Shell Usage: // victim...

CVE-2008-3275

The 1 reallookup and 2 lookuphash functions in fs/namei.c in the vfs implementation in the Linux kernel before 2.6.25.15 do not prevent creation of a child dentry for a deleted aka SDEAD directory, which allows local users to cause a denial of service "overflow" of the UBIFS orphan area via a...

CVE-2008-3275: Buffer Copy without Checking Size of Input

The 1 reallookup and 2 lookuphash functions in fs/namei.c in the vfs implementation in the Linux kernel before 2.6.25.15 do not prevent creation of a child dentry for a deleted aka SDEAD directory, which allows local users to cause a denial of service "overflow" of the UBIFS orphan area via a...

CVE-2008-2931

The CVE-2008-2931 issue affects the Linux kernel (fs/namespace.c) prior to version 2.6.22, where do_change_type does not verify CAP_SYS_ADMIN, enabling a local user to gain privileges or cause a denial of service by modifying mountpoint properties. The vulnerability is documented across multiple ...

CVE-2008-2931: Improper Privilege Management

The dochangetype function in fs/namespace.c in the Linux kernel before 2.6.22 does not verify that the caller has the CAPSYSADMIN capability, which allows local users to gain privileges or cause a denial of service by modifying the properties of a mountpoint...

CVE-2008-2348

MeltingIce File System 1.0 allows remote attackers to bypass application authentication, create new user accounts, and exceed application quotas via a direct request to admin/adduser.php...

kernel security and bug fix update

2.6.18-53.1.19.0.1.el5 - NET Add entropy support to e1000 and bnx2 John Sobecki ORA 6045759 - NET Fix msi issue with kexec/kdump Michael Chan ORA 6219364 - MM Fix allocpagesnode static nid' race made kernel crash Joe Jin ORA 6187457 - splice Fix bad unlockpage in error case Jens Axboe ORA 6263574...

CVE-2008-1078

expn in the am-utils and net-fs packages for Gentoo, rPath Linux, and other distributions, allows local users to overwrite arbitrary files via a symlink attack on the expnPID temporary file. NOTE: this is the same issue as CVE-2003-0308.1...

CVE-2008-1078

expn in the am-utils and net-fs packages for Gentoo, rPath Linux, and other distributions, allows local users to overwrite arbitrary files via a symlink attack on the expnPID temporary file. NOTE: this is the same issue as CVE-2003-0308.1...

CVE-2008-1078

CVE-2008-1078 affects the expn component of am-utils (and related net-fs usage) on Gentoo, rPath Linux, and other distros. The issue is an insecure temporary-file handling in expn that allows a local user to perform a symlink attack on expn[PID], enabling overwriting of arbitrary files. This vuln...

CVE-2008-1078: Improper Link Resolution Before File Access

expn in the am-utils and net-fs packages for Gentoo, rPath Linux, and other distributions, allows local users to overwrite arbitrary files via a symlink attack on the expnPID temporary file. NOTE: this is the same issue as CVE-2003-0308.1...

Linux Kernel copy_from_user_mmap_sem()函数内存访问漏洞

BUGTRAQ ID: 27796 CVECAN ID: CVE-2008-0010 Linux Kernel是开放源码操作系统Linux所使用的内核。 Linux Kernel的实现上存在漏洞，本地攻击者可能利用此漏洞获取内核内存的敏感信息。 Linux Kernel的fs/splice.c文件中的copyfromusermmapsem函数未经验证用户提供的指针便使用copyfromuserinatomic拷贝了用户进程内存中的数据： ---8--- fs/splice.c:1188 ---8--- partial = copyfromuserinatomicdst, src, n;...

Linux Kernel vmsplice_to_user()函数本地权限提升漏洞

BUGTRAQ ID: 27799 CVECAN ID: CVE-2008-0009 Linux Kernel是开放源码操作系统Linux所使用的内核。 Linux Kernel的实现上存在漏洞，本地攻击者可能利用此漏洞提升自己的权限。 Linux Kernel的fs/splice.c文件中的vmsplicetouser函数错误地引用了用户提供的内存指针: ---8--- fs/splice.c:1378 ---8--- error = getuserbase, &iov-iovbase; / ... / if unlikely!base error = -EFAULT; break; ...

Null pointer dereference

The copyfromusermmapsem function in fs/splice.c in the Linux kernel 2.6.22 through 2.6.24 does not validate a certain userspace pointer before dereference, which allow local users to read from arbitrary kernel memory locations...

CVE-2008-0009

The CVE-2008-0009 entry is supported by connected documents: it affects Linux kernel 2.6.22–2.6.24 where vmsplice_to_user dereferences a userspace pointer without validation, enabling local access to kernel memory. The issue is a local privilege‑escalation vulnerability; remediation is associated...

CVE-2008-0010: Improper Input Validation

The copyfromusermmapsem function in fs/splice.c in the Linux kernel 2.6.22 through 2.6.24 does not validate a certain userspace pointer before dereference, which allow local users to read from arbitrary kernel memory locations...

CVE-2008-0009: Improper Input Validation

The vmsplicetouser function in fs/splice.c in the Linux kernel 2.6.22 through 2.6.24 does not validate a certain userspace pointer before dereference, which might allow local users to access arbitrary kernel memory locations...

CVE-2007-6206: Exposure of Sensitive Information to an Unauthorized Actor

The docoredump function in fs/exec.c in Linux kernel 2.4.x and 2.6.x up to 2.6.24-rc3, and possibly other versions, does not change the UID of a core dump file if it exists before a root process creates a core dump in the same location, which might allow local users to obtain sensitive informatio...