PT-2024-36869 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A vulnerability in the Linux kernel has been resolved by passing a cred pointer to ceph mds auth match. This change eliminates a redundant get current cred call, as ceph mds check acce...

SUSE CVE-2024-42318

In the Linux kernel, the following vulnerability has been resolved: landlock: Don't lose track of restrictions on credtransfer When a process' cred struct is replaced, this almost always invokes the credprepare LSM hook; but in one special case when KEYCTLSESSIONTOPARENT updates the parent's...

DEBIAN-CVE-2024-42318

In the Linux kernel, the following vulnerability has been resolved: landlock: Don't lose track of restrictions on credtransfer When a process' cred struct is replaced, this almost always invokes the credprepare LSM hook; but in one special case when KEYCTLSESSIONTOPARENT updates the parent's...

UBUNTU-CVE-2024-42318

In the Linux kernel, the following vulnerability has been resolved: landlock: Don't lose track of restrictions on credtransfer When a process' cred struct is replaced, this almost always invokes the credprepare LSM hook; but in one special case when KEYCTLSESSIONTOPARENT updates the parent's...

Linux 5.6 io_uring Cred Refcount Overflow Exploit

Linux versions 5.6 and above appear to suffer from a cred refcount overflow when handling approximately 39 gigabytes of memory usage via iouring. Linux =5.6: cred refcount overflow at 39 GiB memory usage via iouring see also my related prior bug reports about overflowing refcounts with lots of RA...

Linux 5.6 io_uring Cred Refcount Overflow

Linux =5.6: cred refcount overflow at 39 GiB memory usage via iouring see also my related prior bug reports about overflowing refcounts with lots of RAM usage: https://crbug.com/project-zero/809: BPF program refcount, with 32GiB RAM https://crbug.com/project-zero/1752: page-refcount via FUSE with...

SUSE CVE-2004-0643

Double free vulnerability in the krb5rdcred function for MIT Kerberos 5 krb5 1.3.1 and earlier may allow local users to execute arbitrary code...

SUSE CVE-2013-1979

The scmsetcred function in include/net/scm.h in the Linux kernel before 3.8.11 uses incorrect uid and gid values during credentials passing, which allows local users to gain privileges via a crafted application...

Exploit for Server-Side Request Forgery in Vmware Cloud_Foundation

CVE-2021-21975 SSRF-POC - ssrf to cred leak First configur...

Linux Kernel CVE-2019-9213 NULL Dereferences

By following the codepath that Andrea Arcangeli pointed out in his mails regarding the last bug I reported, I noticed that it is possible for userspace on a normal distro to map virtual address 0, which on an X86 system without SMAP enables the exploitation of kernel NULL pointer dereferences. Th...

Linux Kernel 4.14.0-rc4+ - 'waitid()' Privilege Escalation(CVE-2017-5123)

This is a guest post by a young and talented Portuguese exploiter, Federico Bento. He won this year’s Pwnie for Epic Achievement exploiting TIOCSTI ioctl. Days ago he posted a video demonstrating an exploit for CVE-2017-5123 and luckly for you I managed to convince him to do a write-up about it. ...

PT-2019-16759 · Linux +3 · Linux Kernel +3

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 4.8 Description: A race condition in the perf event open function allows local attackers to leak sensitive data from setuid programs. This occurs because no relevant locks, specifically the cred guard mutex, are...

CVE-2009-2768

The loadflatsharedlibrary function in fs/binfmtflat.c in the flat subsystem in the Linux kernel before 2.6.31-rc6 allows local users to cause a denial of service NULL pointer dereference and system crash or possibly have unspecified other impact by executing a shared flat binary, which triggers a...

Linux Kernel libfutex Local Root for RHEL/CentOS 7.0.1406 Exploit

Exploit for linux platform in category local exploits / CVE-2014-3153 exploit for RHEL/CentOS 7.0.1406 By Kaiqu Chen email protected Based on libfutex and the expoilt for Android by GeoHot. Usage: $gcc exploit.c -o exploit -lpthread $./exploit / include include include include include include...

Linux Kernel 3.14.5 (CentOS 7 RHEL) - libfutex Local Privilege Escalation

Linux Kernel 3.14.5 CentOS 7 RHEL - libfutex Local Privilege Escalation / CVE-2014-3153 exploit for RHEL/CentOS 7.0.1406 By Kaiqu Chen [email protected] Based on libfutex and the expoilt for Android by GeoHot. Usage: $gcc exploit.c -o exploit -lpthread $./exploit / include include include include...

ManageEngine Eventlog Analyzer Managed Hosts Administrator Credential Disclosure

ManageEngine Eventlog Analyzer from v7 to v9.9 b9002 has two security vulnerabilities that allow an unauthenticated user to obtain the superuser password of any managed Windows and AS/400 hosts. This module abuses both vulnerabilities to collect all the available usernames and passwords. First th...

DEBIAN-CVE-2013-1979

The scmsetcred function in include/net/scm.h in the Linux kernel before 3.8.11 uses incorrect uid and gid values during credentials passing, which allows local users to gain privileges via a crafted application...

PT-2013-1100 · Debian +2 · Debian +2

Name of the Vulnerable Software and Affected Versions: Debian GNU/Linux versions prior to 3.8.11 Linux kernel versions prior to 3.8.11 Description: The issue concerns multiple vulnerabilities in the Linux package of the Debian GNU/Linux operating system, which can be exploited by a local attacker...

Unbreakable Enterprise kernel Security update

2.6.32-300.29.2 - epoll: epollwait should not use timespecaddns Eric Dumazet - epoll: clear the tfilechecklist on -ELOOP Joe Jin CVE-2012-3375 - Don't limit non-nested epoll paths Jason Baron - epoll: kabi fixups for epoll limit wakeup paths Joe Jin CVE-2011-1083 - epoll: limit paths Jason Baron...

CVE-2009-2768

The loadflatsharedlibrary function in fs/binfmtflat.c in the flat subsystem in the Linux kernel before 2.6.31-rc6 allows local users to cause a denial of service NULL pointer dereference and system crash or possibly have unspecified other impact by executing a shared flat binary, which triggers a...