CVE-2016-9039

CVE-2016-9039 affects Joyent SmartOS Hyprlofs fs. The vulnerability exists in the IOCTL HYPRLOFS_ADD_ENTRIES path where buffers are allocated (kmem_alloc) and may not be freed on error, enabling memory exhaustion through repeated exploitation and resulting in a denial of service on affected Smart...

CVE-2016-9039

An exploitable denial of service exists in the Joyent SmartOS 20161110T013148Z Hyprlofs file system. The vulnerability is present in the Ioctl system call with the command HYPRLOFSADDENTRIES. An attacker can cause a buffer to be allocated and never freed. When repeatedly exploited this will resul...

CVE-2016-10150

Use-after-free vulnerability in the kvmioctlcreatedevice function in virt/kvm/kvmmain.c in the Linux kernel before 4.8.13 allows host OS users to cause a denial of service host OS crash or possibly gain privileges via crafted ioctl calls on the /dev/kvm device...

Design/Logic Flaw

Firejail 0.9.38.4 allows local users to execute arbitrary commands outside of the sandbox via a crafted TIOCSTI ioctl call...

CVE-2016-9016

Firejail 0.9.38.4 allows local users to execute arbitrary commands outside of the sandbox via a crafted TIOCSTI ioctl call...

CVE-2016-7545

SELinux policycoreutils allows local users to execute arbitrary commands outside of the sandbox via a crafted TIOCSTI ioctl call...

Design/Logic Flaw

SELinux policycoreutils allows local users to execute arbitrary commands outside of the sandbox via a crafted TIOCSTI ioctl call...

CVE-2016-9016

Firejail 0.9.38.4 allows local users to execute arbitrary commands outside of the sandbox via a crafted TIOCSTI ioctl call...

CVE-2016-7545

SELinux policycoreutils allows local users to execute arbitrary commands outside of the sandbox via a crafted TIOCSTI ioctl call...

CVE-2016-9016

Firejail 0.9.38.4 allows local users to execute arbitrary commands outside of the sandbox via a crafted TIOCSTI ioctl call...

CVE-2016-9016

Firejail 0.9.38.4 allows local users to execute arbitrary commands outside of the sandbox via a crafted TIOCSTI ioctl call...

CVE-2016-7545

SELinux policycoreutils allows local users to execute arbitrary commands outside of the sandbox via a crafted TIOCSTI ioctl call...

CVE-2016-7545

SELinux policycoreutils allows local users to execute arbitrary commands outside of the sandbox via a crafted TIOCSTI ioctl call...

CVE-2016-9278

The Samsung Exynos fimg2d driver for Android with Exynos 5433, 54xx, or 7420 chipsets allows local users to cause a denial of service kernel panic via a crafted ioctl command. The Samsung ID is SVE-2016-6736...

Command injection

The Samsung Exynos fimg2d driver for Android with Exynos 5433, 54xx, or 7420 chipsets allows local users to cause a denial of service kernel panic via a crafted ioctl command. The Samsung ID is SVE-2016-6736...

CVE-2016-9278

The Samsung Exynos fimg2d driver for Android with Exynos 5433, 54xx, or 7420 chipsets allows local users to cause a denial of service kernel panic via a crafted ioctl command. The Samsung ID is SVE-2016-6736...

Android ssp_batch_ioctl Out-Of-Bounds Write Exploit

Android suffers from an out-of-bounds write in sspbatchioctl. Android: OOB write in sspbatchioctl SensorHub exposes a character device under /dev/batchio which can be used in order to send instructions to batches of running sensors. The IOCTL handler from this device has the following high-level...

CVE-2016-6492

The MT6573FDVTSetRegHW function in camerafdvt.c in the MediaTek driver for Linux allows local users to gain privileges via a crafted application that makes an MT6573FDVTIOCTSETFDCONFCMD IOCTL call...

CVE-2016-6492

The MT6573FDVTSetRegHW function in camerafdvt.c in the MediaTek driver for Linux allows local users to gain privileges via a crafted application that makes an MT6573FDVTIOCTSETFDCONFCMD IOCTL call...

Redmi 2A phone has command vulnerability in multiple devices

The Redmi 2A phone is a new model launched by Xiaomi on March 31, 2015, as a derivative of the Redmi 2 phone. The ioctl cmd=0x40046b0a for the Redmi 2A kernel device /dev/hx170dec and the ioctl cmd=0xc00c7503 handler function for /dev/comip-ureg lacks a validity judgment, which allows an attacker...