SUSE CVE-2016-9604

It was discovered in the Linux kernel before 4.11-rc8 that root can gain direct access to an internal keyring, such as '.dnsresolver' in RHEL-7 or '.builtintrustedkeys' upstream, by joining it as its session keyring. This allows root to bypass module signature verification by adding a new public...

SUSE CVE-2017-2647

The KEYS subsystem in the Linux kernel before 3.18 allows local users to gain privileges or cause a denial of service NULL pointer dereference and system crash via vectors involving a NULL value for a certain match field, related to the keyringsearchiterator function in keyring.c...

SUSE CVE-2017-7374

Use-after-free vulnerability in fs/crypto/ in the Linux kernel before 4.10.7 allows local users to cause a denial of service NULL pointer dereference or possibly gain privileges by revoking keyring keys being used for ext4, f2fs, or ubifs encryption, causing cryptographic transform objects to be...

SUSE CVE-2017-12193

The assocarrayinsertintoterminalnode function in lib/assocarray.c in the Linux kernel before 4.13.11 mishandles node splitting, which allows local users to cause a denial of service NULL pointer dereference and panic via a crafted application, as demonstrated by the keyring key type, and key...

SUSE CVE-2017-17807

The KEYS subsystem in the Linux kernel before 4.14.6 omitted an access-control check when adding a key to the current task's "default request-key keyring" via the requestkey system call, allowing a local user to use a sequence of crafted system calls to add keys to a keyring with only Search...

SUSE CVE-2018-19358

GNOME Keyring through 3.28.2 allows local users to retrieve login credentials via a Secret Service API call and the D-Bus interface if the keyring is unlocked, a similar issue to CVE-2008-7320. One perspective is that this occurs because available D-Bus protection mechanisms involving the busconf...

SUSE CVE-2018-20781

In pam/gkr-pam-module.c in GNOME Keyring before 3.27.2, the user's password is kept in a session-child process spawned from the LightDM daemon. This can expose the credential in cleartext...

SUSE CVE-2020-26541

The Linux kernel through 5.8.13 does not properly enforce the Secure Boot Forbidden Signature Database aka dbx protection mechanism. This affects certs/blacklist.c and certs/systemkeyring.c...

SA40135 - Linux kernel: Possible use-after-free vulnerability in keyring facility (CVE-2016-0728)

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. An issue has been found within the Linux kernel that can allow exploitation. Pulse secure does utilize the Linux kernel, however we are not vulnerable as we are not using the vulnerabl...

GSD-2023-1001471 integrity: Fix memory leakage in keyring allocation error path

integrity: Fix memory leakage in keyring allocation error path This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.163 by commit...

GSD-2023-1001168 integrity: Fix memory leakage in keyring allocation error path

integrity: Fix memory leakage in keyring allocation error path This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.86 by commit...

GSD-2023-1000771 integrity: Fix memory leakage in keyring allocation error path

integrity: Fix memory leakage in keyring allocation error path This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.16 by commit...

GSD-2022-1008097 fscrypt: fix keyring memory leak on mount failure

fscrypt: fix keyring memory leak on mount failure This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.154 by commit...

GSD-2022-1007978 fscrypt: fix keyring memory leak on mount failure

fscrypt: fix keyring memory leak on mount failure This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.78 by commit...

GSD-2022-1007830 fscrypt: fix keyring memory leak on mount failure

fscrypt: fix keyring memory leak on mount failure This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.8 by commit...

PT-2022-36085 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.8 Description: A memory leak issue was discovered in the fscrypt keyring on mount failure. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions prio...

The vulnerability of the Keybase open-source keyring client for Windows allows a hacker to execute arbitrary code.

The vulnerability of Keybase’s open-source keyring for Windows relates to an incorrect limitation on the path name of the restricted access directory. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

OESA-2022-1847 gnupg2 security update

GnuPG is a complete and free implementation of the OpenPGP standard as defined by RFC4880 also known as PGP. GnuPG enables encryption and signing of data and communication, and features a versatile key management system as well as access modules for public key directories. Security Fixes: GnuPG...

GnuPG through 2.3.6 in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints (e.g. use of GPGME) are met allows signature forgery via injection into the status line.

...

Signature Forgery

gnupg2 is vulnerable to signature forgery. The vulnerability exists when an attacker possesses any secret-key information from a victim’s keyring and other constraints are met causing a forgery...