USN-3105-1 linux vulnerability

It was discovered that a race condition existed in the memory manager of the Linux kernel when handling copy-on-write breakage of private read-only memory mappings. A local attacker could use this to gain administrative privileges...

Ubuntu 16.04 LTS : Linux kernel vulnerability (USN-3106-1)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-3106-1 advisory. It was discovered that a race condition existed in the memory manager of the Linux kernel when handling copy-on-write breakage of private read-only memory mapping...

CVE-2016-5195

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write COW feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka "Dirty COW."...

UBUNTU-CVE-2016-5195

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write COW feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka "Dirty COW."...

PT-2016-3096

Name of the Vulnerable Software and Affected Versions Linux kernel versions 2.x through 4.8.2 Description A race condition in the mm/gup.c component of the Linux kernel allows local users to gain elevated privileges. This occurs due to the incorrect handling of the copy-on-write COW feature—a...

dirtyc0w

A race condition in the Linux kernel's handling of copy-on-write COW operations means that users can gain write access to otherwise read-only areas of memory and gain permissions...

Fedora 24 : pbuilder (2016-bdb86fbc7d)

Update to version 0.225.2, see http://metadata.ftp-master.debian.org/changelogs//main/p/pbuilder/pbui lder0.225.2changelog for details. ---- This update fixes a potential security issue where copy-on-write does not work when used with eatmydata, resulting in persistent filesystem changes. Note th...

openstack-nova: Host data leak through resize/migration

An information-exposure flaw was found in the OpenStack Compute nova resize and migrate functionality. An authenticated user could write a malicious qcow header to an ephemeral or root disk, referencing a block device as a backing file. With a subsequent resize or migration, file system content o...

DEBIAN-CVE-2015-7548

OpenStack Compute Nova before 2015.1.3 kilo and 12.0.x before 12.0.1 liberty, when using libvirt to spawn instances and usecowimages is set to false, allow remote authenticated users to read arbitrary files by overwriting an instance disk with a crafted image and requesting a snapshot...

openstack-nova: Unprivileged API user can access host data using instance snapshot

A flaw was discovered in the OpenStack Compute nova snapshot feature when using the libvirt driver. A compute user could overwrite an attached instance disk with a malicious header specifying a backing file, and then request a snapshot, causing a file from the compute host to be leaked. This flaw...

Qemu: qcow1: validate L2 table size to avoid integer overflows

An integer overflow flaw was found in the QEMU block driver for QCOW version 1 disk images. A user able to alter the QEMU disk image files loaded by a guest could use this flaw to corrupt QEMU process memory on the host, which could potentially result in arbitrary code execution on the host with...

Qemu: block: missing input validation

QEMU before 2.0.0 block drivers for CLOOP, QCOW2 version 2 and various other image formats are vulnerable to potential memory corruptions, integer/buffer overflows or crash caused by missing input validations which could allow a remote user to execute arbitrary code on the host with the privilege...

openstack-nova: Nova host data leak to vm instance in rescue mode

The instance rescue mode in OpenStack Compute Nova 2013.2 before 2013.2.3 and Icehouse before 2014.1, when using libvirt to spawn images and usecowimages is set to false, allows remote authenticated users to read certain compute host files by overwriting an instance disk with a crafted image...

UBUNTU-CVE-2014-0222

Integer overflow in the qcowopen function in block/qcow.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service crash via a large L2 table in a QCOW version 1 image...

PYSEC-2014-112

The instance rescue mode in OpenStack Compute Nova 2013.2 before 2013.2.3 and Icehouse before 2014.1, when using libvirt to spawn images and usecowimages is set to false, allows remote authenticated users to read certain compute host files by overwriting an instance disk with a crafted image...

PT-2014-2798

Name of the Vulnerable Software and Affected Versions OpenStack Compute Nova versions Folsom through Havana Description The issue allows local users to cause a denial of service, specifically host file system disk consumption, via a compressed QCOW2 image. This is due to the incomplete verificati...

Nova: Compressed disk image DoS

OpenStack Compute Nova Folsom, Grizzly, and Havana does not properly verify the virtual size of a QCOW2 image, which allows local users to cause a denial of service host file system disk consumption via a compressed QCOW2 image. NOTE: this issue is due to an incomplete fix for CVE-2013-2096...

linux.2.x.mmap.DoS.txt

Date: Sun, 7 Mar 1999 01:41:25 +0100 From: Michal Zalewski Linux 2.x mmap vunerability Linux 2.0.36 has the similiar problem with copy-on-write pages allocated with mmap - as these pages are not accounted within per-user limits. Fortunately, it's less harmfull than 5, because memory will be freed...