CVE-2014-9585

The vdsoaddr function in arch/x86/vdso/vma.c in the Linux kernel through 3.18.2 does not properly choose memory locations for the vDSO area, which makes it easier for local users to bypass the ASLR protection mechanism by guessing a location at the end of a PMD...

CVE-2014-9585

The vdsoaddr function in arch/x86/vdso/vma.c in the Linux kernel through 3.18.2 does not properly choose memory locations for the vDSO area, which makes it easier for local users to bypass the ASLR protection mechanism by guessing a location at the end of a PMD...

CVE-2014-9585

The vdsoaddr function in arch/x86/vdso/vma.c in the Linux kernel through 3.18.2 does not properly choose memory locations for the vDSO area, which makes it easier for local users to bypass the ASLR protection mechanism by guessing a location at the end of a PMD...

CVE-2014-9585

The vdsoaddr function in arch/x86/vdso/vma.c in the Linux kernel through 3.18.2 does not properly choose memory locations for the vDSO area, which makes it easier for local users to bypass the ASLR protection mechanism by guessing a location at the end of a PMD...

PT-2015-4295

Name of the Vulnerable Software and Affected Versions Linux kernel versions through 3.18.2 Description The issue concerns the vdso addr function in the Linux kernel, which does not properly choose memory locations for the vDSO area. This makes it easier for local users to bypass the ASLR protecti...

CVE-2014-9585: Undefined Security Weakness

The vdsoaddr function in arch/x86/vdso/vma.c in the Linux kernel through 3.18.2 does not properly choose memory locations for the vDSO area, which makes it easier for local users to bypass the ASLR protection mechanism by guessing a location at the end of a PMD...

OracleVM 3.3 : glibc (OVMSA-2014-0017)

The remote OracleVM system is missing necessary patches to address critical security updates : - Remove gconv transliteration loadable modules support CVE-2014-5119, - nlfindlocale: Improve handling of crafted locale names CVE-2014-0475, - Don't use alloca in addgetnetgrentX 1087789. - Adjust...

glibc security, bug fix, and enhancement update

2.12-1.149 - Remove gconv transliteration loadable modules support CVE-2014-5119, - nlfindlocale: Improve handling of crafted locale names CVE-2014-0475, 2.12-1.148 - Switch gettimeofday from INTUSE to libchiddenproto 1099025. 2.12-1.147 - Fix stack overflow due to large AFINET6 requests...

SuSE 11.3 Security Update : glibc (SAT Patch Number 9262)

This update for the GNU Lib C fixes security issues, some bugs and introduces one new feature. The following security issues have been fixed : - Various potential stack overflows in getaddrinfo and others were fixed. bnc844309. CVE-2013-4357 - A stack frame overflow in getaddrinfo when called wit...

Oracle Linux 5 : kernel (ELSA-2008-0233)

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2008-0233 advisory. - Update: fs fix race condition in dnotify Alexander Viro 439758 CVE-2008-1375 - Update: xen ia64: ftp stress test fixes between HVM/Dom0 Tetsu Yamamot...

The story of the Linux kernel 3.x...

The story of the Linux kernel 3.x... In 2005 everybody was exited about possibility of bypass ASLR on all Linux 2.6 kernels because of the new concept called VDSO Virtual Dynamic Shared Object. More information about this story can be found at the following link:...

Analyzing ASLR in Android Ice Cream Sandwich 4.0

When I first saw the release notes for the new Android Ice Cream Sandwich ICS platform, I was excited to see that Google mentioned that “Android 4.0 now provides address space layout randomization”. For the uninitiated, ASLR randomizes where various areas of memory eg. stack, heap, libs, etc are...

kernel security and bug fix update

2.6.18-238.5.1.0.1.el5 - scsi fix scsi hotplug and rescan race orabug 10260172 - fix filpclose race Joe Jin orabug 10335998 - fix missing aiocomplete in endio Joel Becker orabug 10365195 - make xenkbd.abspointer=1 by default orabug 67188919 - xen check to see if hypervisor supports memory...

Design/Logic Flaw

The Linux kernel 2.6.9 through 2.6.17 on the x8664 and amd64 platforms allows local users to cause a denial of service panic via a 32-bit application that calls mprotect on its Virtual Dynamic Shared Object VDSO page and then triggers a segmentation fault...

CVE-2009-4271

The Linux kernel 2.6.9 through 2.6.17 on the x8664 and amd64 platforms allows local users to cause a denial of service panic via a 32-bit application that calls mprotect on its Virtual Dynamic Shared Object VDSO page and then triggers a segmentation fault...

CVE-2009-4271

CVE-2009-4271 affects Linux kernel 2.6.9–2.6.17 on x86_64/amd64. A local unprivileged user can trigger a NULL pointer dereference when a crafted 32-bit process calls mprotect on the Virtual Dynamic Shared Object (VDSO) page, potentially causing a kernel panic (DoS). The issue is tied to memory pr...

CVE-2009-4271: Undefined Security Weakness

The Linux kernel 2.6.9 through 2.6.17 on the x8664 and amd64 platforms allows local users to cause a denial of service panic via a 32-bit application that calls mprotect on its Virtual Dynamic Shared Object VDSO page and then triggers a segmentation fault...

kernel: 32bit process on 64bit system can trigger a kernel panic

The Linux kernel 2.6.9 through 2.6.17 on the x8664 and amd64 platforms allows local users to cause a denial of service panic via a 32-bit application that calls mprotect on its Virtual Dynamic Shared Object VDSO page and then triggers a segmentation fault...

kernel security and bug fix update

2.6.9-89.0.23.0.1 - XEN fix cpu hotplug crash Joe Jin orabug 7521308 - XEN Bring up vcpus before khelper init Joe Jin orabug 7521308 - XEN flush the tlb cache immediately Dave McCracken, Scott Shi orabug 9138767 - fix skb alignment that was causing sendto to fail with EFAULT Olaf Kirch orabug...

Debian DSA-1687-1 : linux-2.6 - denial of service/privilege escalation

Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or privilege escalation. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2008-3527 Tavis Ormandy reported a local DoS and potential privilege escalation...