CVE-2020-10676

In Rancher 2.x before 2.6.13 and 2.7.x before 2.7.4, an incorrectly applied authorization check allows users who have certain access to a namespace to move that namespace to a different project...

Rancher Labs Rancher Security Vulnerabilities

Rancher Labs Rancher is a suite of open source, enterprise-grade container management platforms from Rancher Labs, Inc. in the United States. A security vulnerability in Rancher Labs Rancher version 2.x prior to 2.6.13 and version 2.7.x prior to 2.7.4, which stems from a misapplied authorization...

CVE-2020-10676

In Rancher 2.x before 2.6.13 and in 2.7.x before 2.7.4, an incorrectly applied authorization check allows users with certain namespace access to move that namespace to a different project. This misconfiguration lets affected users potentially access project-specific resources (e.g., secrets) and ...

Docker cgroups Container Escape Exploit

This Metasploit exploit module takes advantage of a Docker image which has either the privileged flag, or SYSADMIN Linux capability. If the host kernel is vulnerable, its possible to escape the Docker image and achieve root on the host operating system. A vulnerability was found in the Linux...

Docker cgroups Container Escape

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Docker cgroups Container Escape', 'Description' = %q This exploit module takes advantage of a Docker image which has either the privileged flag, ...

Docker cgroups Container Escape

This exploit module takes advantage of a Docker image which has either the privileged flag, or SYSADMIN Linux capability. If the host kernel is vulnerable, its possible to escape the Docker image and achieve root on the host operating system. A vulnerability was found in the Linux kernel's...

GHSA-WJ7F-468M-6MV8 Environment variables still accessible through /proc

Impact Environment variables can be read from procfs unless a new process is started. PoC use birdcage::Birdcage, Sandbox; use std::env, fs; fn main Birdcage::new.lock.unwrap; asserteq!env::varos"SECRET", None; let environ = fs::readtostring"/proc/self/environ".unwrap;...

Environment variables still accessible through /proc

Impact Environment variables can be read from procfs unless a new process is started. PoC use birdcage::Birdcage, Sandbox; use std::env, fs; fn main Birdcage::new.lock.unwrap; asserteq!env::varos"SECRET", None; let environ = fs::readtostring"/proc/self/environ".unwrap;...

capsule-proxy Authorization Issues Vulnerability

capsule-proxy is allowed to overcome the limitations of the Kubernetes API Server in listing the cluster-wide resources it owns, such as Namespace, Ingress and Storage Classes, Nodes, and other resources covered by Capsule. An authorization issue vulnerability exists in capsule-proxy version 0.4....

kernel: net: openvswitch: fix race on port output

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix race on port output assume the following setup on a single machine: 1. An openvswitch instance with one bridge and default flows 2. two network namespaces "server" and "client" 3. two ovs interfaces "server"...

NewStart CGSL MAIN 6.06 : containerd.io Multiple Vulnerabilities (NS-SA-2023-0139)

The remote NewStart CGSL host, running version MAIN 6.06, has containerd.io packages installed that are affected by multiple vulnerabilities: - runc is a CLI tool for spawning and running containers according to the OCI specification. In affected versions it was found that rootless runc makes...

CLSA-2023-1699393971 libxml2: Fix of CVE-2016-4658

CVE-2016-4658: disallow namespace nodes in XPointer ranges...

GHSA-6758-979H-249X capsule-proxy service discloses Namespaces of colliding tenants to owners of different tenants with the same ServiceAccount name

Summary A bug in the RoleBinding reflector used by capsule-proxy gives ServiceAccount tenant owners the right to list Namespaces of other tenants backed by the same owner kind and name. Details - Tenant solar, owned by a ServiceAccount named tenant-owner in the Namespace solar - Tenant wind, owne...

libxml2: Fix of CVE-2016-4658

CVE-2016-4658: disallow namespace nodes in XPointer ranges...

CLSA-2023-1699381307 libxml2: Fix of CVE-2016-4658

CVE-2016-4658: disallow namespace nodes in XPointer ranges...

kernel: raw: Fix NULL deref in raw_get_next()

In the Linux kernel, the following vulnerability has been resolved: raw: Fix NULL deref in rawgetnext. Dae R. Jeong reported a NULL deref in rawgetnext 0. It seems that the repro was running these sequences in parallel so that one thread was iterating on a socket that was being freed in another...

kernel: net: openvswitch: fix race on port output

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix race on port output assume the following setup on a single machine: 1. An openvswitch instance with one bridge and default flows 2. two network namespaces "server" and "client" 3. two ovs interfaces "server"...

kernel: Linux kernel: netfilter use-after-free vulnerability leading to denial of service

A flaw was found in the Linux kernel's netfilter component. When a virtual Ethernet veth device is released, the associated network namespace netns device memory may be prematurely freed. This can lead to a use-after-free vulnerability during the unregistration of netdev hooks. A local attacker...

kernel: nfsd: move init of percpu reply_cache_stats counters back to nfsd_init_net

A flaw was identified in the NFS server nfsd implementation in the Linux kernel where the initialization of the per-CPU replycachestats counters was relocated incorrectly in the code path. This change can lead to use of uninitialized per-CPU statistical counters during NFS request handling when t...

Rocky Linux 8 : kernel-rt (RLSA-2022:0819)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:0819 advisory. - In unixscmtoskb of afunix.c, there is a possible use after free bug due to a race condition. This could lead to local escalation of privilege with...