5470 matches found
CVE-2019-15794
Overlayfs in the Linux kernel and shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, both replace vma-vmfile in their mmap handlers. On error the original value is not restored, and the reference is put for the file to which vmfile points. On...
kernel: net-sysfs: *_queue_add_kobject refcount issue
A flaw was found in the way the rxqueueaddkobject and netdevqueueaddkobject functions in the Linux kernel handled refcounting of certain objects. This flaw allows a local user who can trigger the error code path to use this vulnerability to disturb the integrity of the system...
DEBIAN-CVE-2019-11487
The Linux kernel before 5.1-rc5 allows page-refcount reference count overflow, with resultant use-after-free issues, if about 140 GiB of RAM exists. This is related to fs/fuse/dev.c, fs/pipe.c, fs/splice.c, include/linux/mm.h, include/linux/pipefsi.h, kernel/trace/trace.c, mm/gup.c, and...
UBUNTU-CVE-2019-11487
The Linux kernel before 5.1-rc5 allows page-refcount reference count overflow, with resultant use-after-free issues, if about 140 GiB of RAM exists. This is related to fs/fuse/dev.c, fs/pipe.c, fs/splice.c, include/linux/mm.h, include/linux/pipefsi.h, kernel/trace/trace.c, mm/gup.c, and...
PT-2019-2808 · Linux +5 · Linux Kernel +5
Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.1-rc5 Description: The issue is related to a reference count overflow in the Linux kernel, specifically with the page- refcount, which can lead to use-after-free issues. This can occur when there is...
DEBIAN-CVE-2019-9857
In the Linux kernel through 5.0.2, the function inotifyupdateexistingwatch in fs/notify/inotify/inotifyuser.c neglects to call fsnotifyputmark with INMASKCREATE after fsnotifyfindmark, which will cause a memory leak aka refcount leak. Finally, this will cause a denial of service...
CVE-2019-9857
In the Linux kernel through 5.0.2, the function inotifyupdateexistingwatch in fs/notify/inotify/inotifyuser.c neglects to call fsnotifyputmark with INMASKCREATE after fsnotifyfindmark, which will cause a memory leak aka refcount leak. Finally, this will cause a denial of service...
UBUNTU-CVE-2019-9857
In the Linux kernel through 5.0.2, the function inotifyupdateexistingwatch in fs/notify/inotify/inotifyuser.c neglects to call fsnotifyputmark with INMASKCREATE after fsnotifyfindmark, which will cause a memory leak aka refcount leak. Finally, this will cause a denial of service...
Linux - 'kvm_ioctl_create_device()' NULL Pointer Dereference
kvmioctlcreatedevice contains the following code: dev = kzallocsizeofdev, GFPKERNEL; if !dev return -ENOMEM; dev-ops = ops; dev-kvm = kvm; mutexlock&kvm-lock; ret = ops-createdev, cd-type; if ret lock; kfreedev; return ret; listadd&dev-vmnode, &kvm-devices; mutexunlock&kvm-lock; if ops-init...
Lua 5.3.5 - 'debug.upvaluejoin' Use After Free
Exploit Title: Lua 5.3.5 Exploit Author: Fady Mohamed Osman https://twitter.com/fadyothman Exploit-db : http://www.exploit-db.com/author/?a=2986 Blog : https://blog.fadyothman.com/ Date: Jan. 10th 2019 Vendor Homepage: https://www.lua.org/ Software Link: https://www.lua.org/ftp/lua-5.3.5.tar.gz...
OracleVM 3.4 : xen (OVMSA-2018-0039)
The remote OracleVM system is missing necessary patches to address critical security updates : - BUILDINFO: OVMF commit=173bf5c847e3ca8b42c11796ce048d8e2e916ff8 - BUILDINFO: xen commit=b68fb6eb2d74ac16bb1e733c5fe5c9d9622b0838 - BUILDINFO: QEMU upstream...
kernel: memory leak when merging buffers in SCSI IO vectors
It was found that in the Linux kernel through v4.14-rc5, biomapuseriov and biounmapuser in 'block/bio.c' do unbalanced pages refcounting if IO vector has small consecutive buffers belonging to the same page. bioaddpcpage merges them into one, but the page reference is never dropped, causing a...
Fedora 27 : xen (2017-5945560816)
another patch related to the XSA-240, CVE-2017-15595 issue x86 PV guests may gain access to internally used page XSA-248 broken x86 shadow mode refcount overflow check XSA-249 improper x86 shadow mode refcount error handling XSA-250 improper bug check in x86 log-dirty handling XSA-251 Note that...
improper x86 shadow mode refcount error handling
ISSUE DESCRIPTION Pages being used to run x86 guests in shadow mode are reference counted to track their uses. When another reference cannot be acquired, the corresponding page table entry must not be inserted. Due to incorrect error handling, this constraint could be violated. IMPACT A malicious...
broken x86 shadow mode refcount overflow check
ISSUE DESCRIPTION Pages being used to run x86 guests in shadow mode are reference counted to track their uses. Unfortunately the overflow check when trying to obtain a new reference used a mask one bit wider than the reference count actually is, rendering the entire check ineffective. IMPACT A...
DEBIAN-CVE-2014-0143
Multiple integer overflows in the block drivers in QEMU, possibly before 2.0.0, allow local users to cause a denial of service crash via a crafted catalog size in 1 the parallelsopen function in block/parallels.c or 2 bochsopen function in bochs.c, a large L1 table in the 3 qcow2snapshotloadtmp i...
Design/Logic Flaw
The cookie feature in the packet action API implementation in net/sched/actapi.c in the Linux kernel 4.11.x through 4.11-rc7 mishandles the tb nlattr array, which allows local users to cause a denial of service uninitialized memory access and refcount underflow, and system hang or crash or possib...
CVE-2017-7979
The cookie feature in the packet action API implementation in net/sched/actapi.c in the Linux kernel 4.11.x through 4.11-rc7 mishandles the tb nlattr array, which allows local users to cause a denial of service uninitialized memory access and refcount underflow, and system hang or crash or possib...
The use of the Linux kernel in Use-After-Free（UAF）vulnerability to mention the right-vulnerability warning-the black bar safety net
Last month broke the CVE-2 0 1 6-0 7 2 8 （local mention the right loopholes so everyone's attention once again focused on the linux kernel security. And CVE-2 0 1 5-3 6 3 6, The CVE-2 0 1 5-7 3 1 2, The CVE-2 0 1 4-2 8 5 1, CVE-2 0 1 6-0 7 2 8 is a Use-After-Free（UAF types of vulnerabilities. We...
