Microsoft Windows Server 2003 SP2 - TCP/IP IOCTL Privilege Escalation (MS14-070)

/ Exploit Title: Windows 2k3 SP2 TCP/IP IOCTL Privilege Escalation MS14-070 Date: 2015-08-10 Exploit Author: Tomislav Paskalev Vulnerable Software: Windows 2003 SP2 x86 Windows 2003 SP2 x86-64 Windows 2003 SP2 IA-64 Supported vulnerable software: Windows 2003 SP2 x86 Tested on: Windows 2003 SP2 x...

PT-2015-7139

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.1.5 Description The issue allows local users to cause a denial of service, specifically memory consumption, by making a VHOST SET LOG FD ioctl call that triggers permanent file-descriptor allocation. This occur...

PT-2015-7042

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.1.6 Description The issue allows local users to obtain sensitive information from kernel memory. This is due to the get bitmap file function in drivers/md/md.c not initializing a certain bitmap data structure,...

DEBIAN-CVE-2015-4692

The kvmapichasevents function in arch/x86/kvm/lapic.h in the Linux kernel through 4.1.3 allows local users to cause a denial of service NULL pointer dereference and system crash or possibly have unspecified other impact by leveraging /dev/kvm access for an ioctl call...

Null pointer dereference

The kvmapichasevents function in arch/x86/kvm/lapic.h in the Linux kernel through 4.1.3 allows local users to cause a denial of service NULL pointer dereference and system crash or possibly have unspecified other impact by leveraging /dev/kvm access for an ioctl call...

CVE-2015-4692

The kvmapichasevents function in arch/x86/kvm/lapic.h in the Linux kernel through 4.1.3 allows local users to cause a denial of service NULL pointer dereference and system crash or possibly have unspecified other impact by leveraging /dev/kvm access for an ioctl call...

CVE-2015-4692

CVE-2015-4692 affects the Linux kernel’s KVM code: in arch/x86/kvm/lapic.h, the kvm_apic_has_events() function may dereference a NULL pointer via an ioctl to /dev/kvm, enabling a local attacker to cause a denial of service (system crash). The description indicates the issue exists through kernel ...

CVE-2015-4692

The kvmapichasevents function in arch/x86/kvm/lapic.h in the Linux kernel through 4.1.3 allows local users to cause a denial of service NULL pointer dereference and system crash or possibly have unspecified other impact by leveraging /dev/kvm access for an ioctl call...

CVE-2015-4692: Undefined Security Weakness

The kvmapichasevents function in arch/x86/kvm/lapic.h in the Linux kernel through 4.1.3 allows local users to cause a denial of service NULL pointer dereference and system crash or possibly have unspecified other impact by leveraging /dev/kvm access for an ioctl call...

AVG Internet Security 2013.x < 2013.3495 / 2015.x < 2015.5557 Local Privilege Escalation

The remote Windows host has a version of AVG Internet Security installed that is 2013.x prior to 2013.3495 or 2015.x prior to 2015.5557. It is, therefore, affected by a local privilege escalation vulnerability due to a flaw in the TDI driver avgtdix.sys that occurs when handling 0x830020f8 IOCTL...

PT-2015-6671

Name of the Vulnerable Software and Affected Versions Linux kernel versions through 4.1.3 Description The issue allows local users to cause a denial of service, resulting in a system crash due to a NULL pointer dereference. This is achieved by leveraging access to /dev/kvm for an ioctl call,...

CVE-2015-4692

The kvmapichasevents function in arch/x86/kvm/lapic.h in the Linux kernel through 4.1.3 allows local users to cause a denial of service NULL pointer dereference and system crash or possibly have unspecified other impact by leveraging /dev/kvm access for an ioctl call...

openSUSE Security Update : fuse (openSUSE-2015-401)

Update to version 2.9.4 - fix exec environment for mount and umount bsc931452, CVE-2015-3202 - properly restore the default signal handler - fix directory file handle passed toioctl method. - fix for uids/gids larger than 2147483647 - initialize stat buffer passed to getattr and fgetattr...

PT-2016-2703

Name of the Vulnerable Software and Affected Versions Linux kernel versions 3.x Description The issue is related to the sound/soc/msm/qdsp6v2/msm-audio-effects-q6-v2.c file in the MSM QDSP6 audio driver for the Linux kernel. It involves reading data beyond a specified buffer, which can be exploit...

PT-2016-4994

Name of the Vulnerable Software and Affected Versions Linux kernel versions 3.x Description The issue allows attackers to cause a denial of service or possibly have other impact via a crafted application. This is achieved by making an ioctl call specifying many commands, which can lead to a buffe...

PT-2016-4995

Name of the Vulnerable Software and Affected Versions Linux kernel versions 3.x Description The issue is related to an integer signedness error in the MSM QDSP6 audio driver. This error can be exploited by attackers to gain privileges or cause a denial of service, resulting in memory corruption...

PT-2016-2705

Name of the Vulnerable Software and Affected Versions Linux kernel versions 3.x Description The issue is related to the TSC driver in the Linux kernel, specifically the drivers/media/platform/msm/broadcast/tsc.c file. It allows attackers to cause a denial of service or possibly have other impacts...

PT-2016-3503

Name of the Vulnerable Software and Affected Versions Linux kernel versions 3.x Description The issue concerns a function in the MSM-VFE31 driver that does not properly validate a certain id value. This allows attackers to potentially gain privileges or cause a denial of service, resulting in...

PT-2016-3561

Name of the Vulnerable Software and Affected Versions Linux kernel versions 3.x Description The issue is related to multiple race conditions in the ADSPRPC driver, specifically in the drivers/char/adsprpc.c and drivers/char/adsprpc compat.c files. This can be exploited by attackers to cause a...

Linux Kernel (PonyOS 3.0) - TTY 'ioctl()' Local Privilege Escalation

/ Exploit Title: PonyOS include include int main struct winsize ws; printf"+ PonyOS = 3.0 ioctl local root exploit\n"; memcpy&ws,"\x90\x90\x90\x90\x8b\x45\x08\x89",8; ioctl0, TIOCSWINSZ, &ws; ioctl0, TIOCGWINSZ, void 0x0010f101; printf"- patched syssetuid\n"; asm"movl $0x18,%eax"; asm"xorl...