Ubuntu 15.10 : linux vulnerabilities (USN-2843-1)

Jan Beulich discovered that the KVM svm hypervisor implementation in the Linux kernel did not properly catch Debug exceptions on AMD processors. An attacker in a guest virtual machine could use this to cause a denial of service system crash in the host OS. CVE-2015-8104 Guoyong Gang discovered th...

Ubuntu 15.04 : linux vulnerabilities (USN-2842-1)

Jan Beulich discovered that the KVM svm hypervisor implementation in the Linux kernel did not properly catch Debug exceptions on AMD processors. An attacker in a guest virtual machine could use this to cause a denial of service system crash in the host OS. CVE-2015-8104 Guoyong Gang discovered th...

Debian DLA-360-1 : linux-2.6 security update

This update fixes the CVEs described below. CVE-2013-7446 Dmitry Vyukov discovered that a particular sequence of valid operations on local AFUNIX sockets can result in a use-after-free. This may be used to cause a denial of service crash or possibly for privilege escalation. CVE-2015-7799...

DLA-360-1 linux-2.6 - security update

Bulletin has no description...

Microsoft Windows - ndis.sys IOCTL 0x170034 (ndis!ndisNsiGetIfNameForIfIndex) Pool Buffer Overflow (MS15-117)

Microsoft Windows - ndis.sys IOCTL 0x170034 ndis!ndisNsiGetIfNameForIfIndex Pool Buffer Overflow MS15-117 Source: https://code.google.com/p/google-security-research/issues/detail?id=516 The attached testcase crashes Windows 7 32-bit due to a pool buffer overflow in an ioctl handler. Enabling...

Microsoft Windows - 'ndis.sys' IOCTL 0x170034 (ndis!ndisNsiGetIfNameForIfIndex) Pool Buffer Overflow (MS15-117)

Source: https://code.google.com/p/google-security-research/issues/detail?id=516 The attached testcase crashes Windows 7 32-bit due to a pool buffer overflow in an ioctl handler. Enabling special on ndis.sys netio.sys and ntoskrnl helps to track down the issue, however it will crashes due to a bad...

PT-2019-6480

Name of the Vulnerable Software and Affected Versions shadow versions 4.0 through 4.1.4 sudo versions 1.0 through 1.7.3 Description The issue allows for a possible tty hijacking via "su - user -c program". This can be exploited by using the TIOCSTI ioctl to push characters into the input buffer,...

CVE-2012-4467

The 1 dosiocgstamp and 2 dosiocgstampns functions in net/socket.c in the Linux kernel before 3.5.4 use an incorrect argument order, which allows local users to obtain sensitive information from kernel memory or cause a denial of service system crash via a crafted ioctl call...

CVE-2013-4516

The mpgetcount function in drivers/staging/sb105x/sbpcimp.c in the Linux kernel before 3.12 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via a TIOCGICOUNT ioctl call...

CVE-2011-2906

Integer signedness error in the pmcraidioctlpassthrough function in drivers/scsi/pmcraid.c in the Linux kernel before 3.1 might allow local users to cause a denial of service memory consumption or memory corruption via a negative size value in an ioctl call. NOTE: this may be a vulnerability only...

CVE-2011-0699

A flaw was found in the BTRFS implementation in the Linux kernel, where a local user with elevated permissions either root user or in the disk group can issue an ioctl to the /dev/btrfs-control device node. This flaw panics the system and allows memory allocation if a specially crafted ioctl is...

CVE-2013-4739

The MSM camera driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center QuIC Android contributions for MSM devices and other products, allows attackers to obtain sensitive information from kernel stack memory via 1 a crafted MSMMCRIOCTLEVTGET ioctl call, related to...

CVE-2010-2538

Integer overflow in the btrfsioctlclone function in fs/btrfs/ioctl.c in the Linux kernel before 2.6.35 might allow local users to obtain sensitive information via a BTRFSIOCCLONERANGE ioctl call...

CVE-2010-2537

The btrfsioctlclone function in fs/btrfs/ioctl.c in the Linux kernel before 2.6.35 allows local users to overwrite an append-only file via a 1 BTRFSIOCCLONE or 2 BTRFSIOCCLONERANGE ioctl call that specifies this file as a donor...

CVE-2013-6392

The genlockdevioctl function in genlock.c in the Genlock driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center QuIC Android contributions for MSM devices and other products, does not properly initialize a certain data structure, which allows local users to obtain sensitive...

CVE-2006-7098

The Debian GNU/Linux 033-FNOSETSID patch for the Apache HTTP Server 1.3.34-4 does not properly disassociate httpd from a controlling tty when httpd is started interactively, which allows local users to gain privileges to that tty via a CGI program that calls the TIOCSTI ioctl...

Samsung - m2m1shot Kernel Driver Buffer Overflow

Samsung - m2m1shot Kernel Driver Buffer Overflow Source: https://code.google.com/p/google-security-research/issues/detail?id=493 The Samsung m2m1shot driver framework is used to provide hardware acceleration for certain media functions, such as JPEG decoding and scaling images. The driver endpoin...

Samsung fimg2d - FIMG2D_BITBLT_BLIT ioctl Concurrency Flaw

Samsung fimg2d - FIMG2DBITBLTBLIT ioctl Concurrency Flaw Source: https://code.google.com/p/google-security-research/issues/detail?id=492 The Samsung Graphics 2D driver /dev/fimg2d is accessible by unprivileged users/applications. It was found that the ioctl implementation for this driver contains...

Samsung - 'm2m1shot' Kernel Driver Buffer Overflow

Source: https://code.google.com/p/google-security-research/issues/detail?id=493 The Samsung m2m1shot driver framework is used to provide hardware acceleration for certain media functions, such as JPEG decoding and scaling images. The driver endpoint /dev/m2m1shotjpeg is accessible by the media...

Win10Pcap - Local Privilege Escalation Vulnerability

Win10Pcap - Local Privilege Escalation Vulnerability. Local exploit for windows platform Source: https://github.com/Rootkitsmm/Win10Pcap-Exploit / Win10Pcap kernel-mode driver did not check the virtual addresses which are passed from the user-mode , IOCTL Using Neither Buffered Nor Direct I/O...