960 matches found
PT-2023-20353 · Undefined · Undefined
PoC Code for Linux Kernel Privilege Escalation Flaw CVE-2023-259 Published https://securityonline.info/poc-code-for-linux-kernel-privilege-escalation-flaw-cve-2023-259-published/...
kernel: dm flakey: don't corrupt the zero page
A flaw was found in the Linux kernel's dm-flakey device mapper target. When the corrupt bio writes option is enabled, dm-flakey can corrupt the kernel's global zero page. Since the zero page is shared system-wide and used by glibc's calloc implementation via mmap, corrupting it causes userspace...
kernel: hid: Use After Free in asus_remove()
A use-after-free flaw was found in asuskbdbacklightset in drivers/hid/hid-asus.c in the Linux Kernel. This issue could allow an attacker to crash the system when plugging in or disconnecting a malicious USB device, which may lead to a kernel information leak problem...
kernel: Denial of service issue in az6027 driver in drivers/media/usb/dev-usb/az6027.c
A NULL pointer dereference flaw was found in the az6027 driver in drivers/media/usb/dev-usb/az6027.c in the Linux Kernel. The message from user space is not checked properly before transferring into the device. This flaw allows a local user to crash the system or potentially cause a denial of...
kernel: xfrm: NULL pointer dereference in xfrm_update_ae_params()
A flaw was found in the Linux kernel’s IP framework for transforming packets XFRM subsystem. This issue may allow a malicious user with CAPNETADMIN privileges to directly dereference a NULL pointer in xfrmupdateaeparams, leading to a possible kernel crash and denial of service...
kernel: Intel firmware update for insufficient granularity of access control in out-of-band management in some Intel Atom and Intel Xeon Scalable Processors
A flaw was found in the Linux kernel. A potential security vulnerability in some IntelR AtomR and IntelR XeonR Scalable Processors may allow privilege escalation. This flaw may allow a privileged user to enable privilege escalation via adjacent network access...
Rocky Linux Security Updates RLSA-2023:5312 (CVE-2023-20900) and RSLA-2023:5244 (CVE-2023-35001, CVE-2023-4004, CVE-2023-3390, CVE-2023-3776, CVE-2023-3090, CVE-2023-35788, CVE-2023-20593, CVE-2023-2002)
Rocky Linux security update RLSA-2023:5312 CVE-2023-20900 A malicious actor that has been granted Guest Operation Privilegesin a target virtual machine may be able to elevate their privileges if that target virtual machine has been assigned a more privileged Guest Alias Rocky Linux security updat...
CVE-2023-42752
An integer overflow flaw was found in the Linux kernel. This issue leads to the kernel allocating skbsharedinfo in the userspace, which is exploitable in systems without SMAP protection since skbsharedinfo contains references to function pointers...
Kernel: ipv4: null pointer dereference in ipv4_send_dest_unreach()
...
kernel: ipvlan: out-of-bounds write caused by unclear skb->cb
A flaw was found in the IPVLAN network driver in the Linux kernel. This issue is caused by missing skb-cb initialization in ipoptionsecho and can lead to an out-of-bounds write stack overflow. This may allow a local user to cause a denial of service or potentially achieve local privilege escalati...
kernel: LoadPin bypass via dm-verity table reload
A flaw was found in the Linux kernel. Dm-verity is used for extending root-of-trust to root filesystems. LoadPin builds on this property to restrict module and firmware loads to just the trusted root filesystem. Device-mapper table reloads currently allow users with root privileges to switch out...
kernel: cls_flower: out-of-bounds write in fl_set_geneve_opt()
A flaw was found in the TC flower classifier clsflower in the Networking subsystem of the Linux kernel. This issue occurs when sending two TCAFLOWERKEYENCOPTSGENEVE packets with a total size of 252 bytes, which results in an out-of-bounds write when the third packet enters flsetgeneveopt,...
kernel: cls_flower: out-of-bounds write in fl_set_geneve_opt()
A flaw was found in the TC flower classifier clsflower in the Networking subsystem of the Linux kernel. This issue occurs when sending two TCAFLOWERKEYENCOPTSGENEVE packets with a total size of 252 bytes, which results in an out-of-bounds write when the third packet enters flsetgeneveopt,...
kernel: nf_tables: stack-out-of-bounds-read in nft_byteorder_eval()
An out-of-bounds OOB memory access flaw was found in the Netfilter module in the Linux kernel's nftbyteordereval in net/netfilter/nftbyteorder.c. A bound check failure allows a local attacker with CAPNETADMIN access to cause a local privilege escalation issue due to incorrect data alignment...
CVE-2023-39193
A flaw was found in the Netfilter subsystem in the Linux kernel. The sctpmtcheck did not validate the flagcount field. This flaw allows a local privileged CAPNETADMIN attacker to trigger an out-of-bounds read, leading to a crash or information disclosure...
CVE-2023-39194
A flaw was found in the XFRM subsystem in the Linux kernel. The specific flaw exists within the processing of state filters, which can result in a read past the end of an allocated buffer. This flaw allows a local privileged CAPNETADMIN attacker to trigger an out-of-bounds read, potentially leadi...
Information disclosure
A flaw was found in the Netfilter subsystem in the Linux kernel. The nfnlosfaddcallback function did not validate the user mode controlled optnum field. This flaw allows a local privileged CAPNETADMIN attacker to trigger an out-of-bounds read, leading to a crash or information disclosure...
AZL-31150 CVE-2023-39191 affecting package kernel for versions less than 5.15.137.1-1
An improper input validation flaw was found in the eBPF subsystem in the Linux kernel. The issue occurs due to a lack of proper validation of dynamic pointers within user-supplied eBPF programs prior to executing them. This may allow an attacker with CAPBPF privileges to escalate privileges and...
CVE-2023-5158
A flaw was found in vringhkiovadvance in drivers/vhost/vringh.c in the host side of a virtio ring in the Linux Kernel. This issue may result in a denial of service from guest to host via zero length descriptor...
kernel: Intel firmware update for Incorrect default permissions in some memory controller configurations
A flaw was found in the Linux kernel. Some IntelR XeonR processors with Intel® Software Guard Extensions SGX may allow privilege escalation. This issue may allow a privileged user to enable privilege escalation via local access...