CVE-2023-0459

Copyfromuser on 64-bit versions of the Linux kernel does not implement the uaccessbeginnospec allowing a user to bypass the "accessok" check and pass a kernel pointer to copyfromuser. This would allow an attacker to leak information. We recommend upgrading beyond...

CVE-2023-0459

CVE-2023-0459: Linux kernel on 64-bit systems is affected by a local elevation of information disclosure due to Copy_from_user bypassing __uaccess_begin_nospec, bypassing access_ok and allowing a user to pass a kernel pointer to copy_from_user. Root cause is the __uaccess_begin_nospec handling. I...

Ubuntu 18.04 LTS / 20.04 LTS : Linux kernel (Raspberry Pi) vulnerabilities (USN-6109-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6109-1 advisory. Zheng Wang discovered that the Intel i915 graphics driver in the Linux kernel did not properly handle certain error conditions, leading to a...

CVE-2023-0459

Copyfromuser on 64-bit versions of the Linux kernel does not implement the uaccessbeginnospec allowing a user to bypass the "accessok" check and pass a kernel pointer to copyfromuser. This would allow an attacker to leak information. We recommend upgrading beyond...

kernel: Copy_from_user on 64-bit versions may leak kernel information

A vulnerability was found in copyfromuser in 64-bit versions of the Linux kernel. This flaw allows a local attacker to bypass the "accessok" sanity check and pass a kernel pointer to copyfromuser, resulting in kernel data leaking...

GSD-2022-1001940 uaccess: fix integer overflow on access_ok()

uaccess: fix integer overflow on accessok This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.32 by commit...

GSD-2022-1001636 uaccess: fix integer overflow on access_ok()

uaccess: fix integer overflow on accessok This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.16.18 by commit...

GSD-2022-1001328 uaccess: fix integer overflow on access_ok()

uaccess: fix integer overflow on accessok This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.17.1 by commit...

PT-2022-30213

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.32 Description The issue is related to an integer overflow in the access ok function. It was introduced in version v4.20 and fixed in version v5.15.32. The actual impact and attack plausibility have not yet...

CVE-2018-20669

CVE-2018-20669 affects the Linux kernel i915_gem_execbuffer2_ioctl path (drivers/gpu/drm/i915/i915_gem_execbuffer.c) up to kernel 4.19.13. A local attacker can craft an IOCTL call that fails address checks (address provided to access_ok() is not checked), enabling overwriting arbitrary kernel mem...

CVE-2018-20669

An issue where a provided address with accessok is not checked was discovered in i915gemexecbuffer2ioctl in drivers/gpu/drm/i915/i915gemexecbuffer.c in the Linux kernel through 4.19.13. A local attacker can craft a malicious IOCTL function call to overwrite arbitrary kernel memory, resulting in a...

CVE-2018-20669

A flaw was found in the Linux kernel where a provided address with accessok is not checked before accessing userspace data in certain situations. Lack of such checks in i915gemexecbuffer2ioctl in drivers/gpu/drm/i915/i915gemexecbuffer.c may allow a local unprivileged attacker to possible escalate...

openSUSE Security Update : the Linux Kernel (openSUSE-2017-891)

The openSUSE Leap 42.2 kernel was updated to 4.4.79 to receive various security and bugfixes. The following security bugs were fixed : - CVE-2017-7542: The ip6find1stfragopt function in net/ipv6/outputcore.c in the Linux kernel allowed local users to cause a denial of service integer overflow and...

Linux Kernel (ARMARM64) - perf_event_open() Arbitrary Memory Read

Linux Kernel ARMARM64 - perfeventopen Arbitrary Memory Read perfeventopen offers to collect various pieces of information when an event occurs, including a user stack backtrace PERFSAMPLECALLCHAIN. To collect a user stack backtrace, the kernel grabs the userland register state if the event occure...

Linux Kernel (ARM/ARM64) - 'perf_event_open()' Arbitrary Memory Read

perfeventopen offers to collect various pieces of information when an event occurs, including a user stack backtrace PERFSAMPLECALLCHAIN. To collect a user stack backtrace, the kernel grabs the userland register state if the event occured in kernelspace: the userland register state that was...

CVE-2010-4258

The doexit function in kernel/exit.c in the Linux kernel before 2.6.36.2 does not properly handle a KERNELDS getfs value, which allows local users to bypass intended accessok restrictions, overwrite arbitrary kernel memory locations, and gain privileges by leveraging a 1 BUG, 2 NULL pointer...

Null pointer dereference

The doexit function in kernel/exit.c in the Linux kernel before 2.6.36.2 does not properly handle a KERNELDS getfs value, which allows local users to bypass intended accessok restrictions, overwrite arbitrary kernel memory locations, and gain privileges by leveraging a 1 BUG, 2 NULL pointer...

CVE-2010-4258

The doexit function in kernel/exit.c in the Linux kernel before 2.6.36.2 does not properly handle a KERNELDS getfs value, which allows local users to bypass intended accessok restrictions, overwrite arbitrary kernel memory locations, and gain privileges by leveraging a 1 BUG, 2 NULL pointer...

Linux Kernel 2.6.37 (RedHat Ubuntu 10.04) - Full-Nelson.c Local Privilege Escalation

Linux Kernel 2.6.37 RedHat Ubuntu 10.04 - Full-Nelson.c Local Privilege Escalation / Linux Kernel = 2.6.37 local privilege escalation by Dan Rosenberg @djrbliss on twitter Usage: gcc full-nelson.c -o full-nelson ./full-nelson This exploit leverages three vulnerabilities to get root, all of which...

Linux kernel 2.6.x do_io_submit()函数整数溢出漏洞

BUGTRAQ ID: 43353 CVECAN ID: CVE-2010-3067 Linux Kernel是开放源码操作系统Linux所使用的内核。 Linux Kernel的fs/aio.c文件中的doiosubmit函数存在整数溢出漏洞，本地用户可以通过iosubmit调用导致拒绝服务。 iosubmit系统调用直接调用了doiosubmit函数： SYSCALLDEFINE3iosubmit, aiocontextt, ctxid, long, nr, struct iocb user user , iocbpp return doiosubmitctxid, nr,...