556 matches found
kernel: IB/uverbs: Handle large number of entries in poll CQ
The ibuverbspollcq function in drivers/infiniband/core/uverbscmd.c in the Linux kernel before 2.6.37 does not initialize a certain response buffer, which allows local users to obtain potentially sensitive information from kernel memory via vectors that cause this buffer to be only partially fille...
kernel: drivers/serial/serial_core.c: reading uninitialized stack memory
The uartgetcount function in drivers/serial/serialcore.c in the Linux kernel before 2.6.37-rc1 does not properly initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via a TIOCGICOUNT ioctl call...
Linux Kernel < 2.6.36-rc6 (RedHat / Ubuntu 10.04) - 'pktcdvd' Kernel Memory Disclosure
/ cve-2010-3437.c Linux Kernel http://jon.oberheide.org Information: https://bugzilla.redhat.com/showbug.cgi?id=638085 The PKTCTRLCMDSTATUS device ioctl retrieves a pointer to a pktcdvddevice from the global pktdevs array. The index into this array is provided directly by the user and is a signed...
SuSE 11 Security Update : Linux kernel (SAT Patch Numbers 1212 / 1218 / 1219)
The SUSE Linux Enterprise 11 Kernel was updated to 2.6.27.29 fixing various bugs and security issues. The following security issues were fixed : - A missing NULL pointer check in the socket sendpage function can be used by local attackers to gain root privileges. CVE-2009-2692 - A kernel stack...
Linux Kernel < 2.6.14.6 - 'procfs' Kernel Memory Disclosure
/ cve-2005-4605.c Linux Kernel http://jon.oberheide.org Information: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4605 The procfs code procmisc.c in Linux 2.6.14.3 and other versions before 2.6.15 allows attackers to read sensitive kernel memory via unspecified vectors in which a signed...
Linux Kernel < 2.6.14.6 procfs Kernel Memory Disclosure Exploit
Exploit for linux platform in category local exploits =============================================================== Linux Kernel include include include include include include include include include...
CVE-2009-0787: Undefined Security Weakness
The ecryptfswritemetadatatocontents function in the eCryptfs functionality in the Linux kernel 2.6.28 before 2.6.28.9 uses an incorrect size when writing kernel memory to an eCryptfs file header, which triggers an out-of-bounds read and allows local users to obtain portions of kernel memory...
Apple MACOS X xnu <= 1228.x Local Kernel Memory Disclosure Exploit
Exploit for macOS platform in category local exploits ================================================================== Apple MACOS X xnu Apple MACOS X xnu include include include include include include include define TMPFILE "/tmp/xnu-getldt" define READSIZE 0x2000000 int main int argc, char...
Solaris 10 x86/sparc sysinfo Kernel Memory Disclosure Exploit
No description provided by source. / 07/2006: public release SPARC Solaris 10 without 118833-09 x86 Solaris 10 without 118855-06 Solaris sysinfo Kernel Memory Disclosure By qaaz / include stdio.h include stdlib.h include unistd.h include string.h include sys/mman.h include sys/systeminfo.h define...
Solaris fifofs I_PEEK Kernel Memory Disclosure Exploit (x86/sparc)
No description provided by source. / 10/2007: public release SPARC Solaris 8 without 109454-06 Solaris 9 without 117471-04 Solaris 10 without 127737-01 x86 Solaris 8 without 109455-06 Solaris 9 without 117472-04 Solaris 10 without 127738-01 ...
solaris-fifofs.txt
/ 10/2007: public release SPARC Solaris 8 without 109454-06 Solaris 9 without 117471-04 Solaris 10 without 127737-01 x86 Solaris 8 without 109455-06 Solaris 9 without 117472-04 Solaris 10 without 127738-01 Solaris fifofs IPEEK Kernel Memory Disclosure By qaaz / include include include include...
Solaris (SPARCx86) - fifofs I_PEEK Kernel Memory Disclosure
Solaris SPARCx86 - fifofs IPEEK Kernel Memory Disclosure / 10/2007: public release SPARC Solaris 8 without 109454-06 Solaris 9 without 117471-04 Solaris 10 without 127737-01 x86 Solaris 8 without 109455-06 Solaris 9 without 117472-04 Solaris 10 without 127738-01 Solaris fifofs IPEEK Kernel Memory...
Solaris (SPARC/x86) - fifofs I_PEEK Kernel Memory Disclosure
/ 10/2007: public release SPARC Solaris 8 without 109454-06 Solaris 9 without 117471-04 Solaris 10 without 127737-01 x86 Solaris 8 without 109455-06 Solaris 9 without 117472-04 Solaris 10 without 127738-01 Solaris fifofs IPEEK Kernel Memory Disclosure By qaaz / include include include include...
Solaris 10 (SPARCx86) - sysinfo Kernel Memory Disclosure
Solaris 10 SPARCx86 - sysinfo Kernel Memory Disclosure / 07/2006: public release SPARC Solaris 10 without 118833-09 x86 Solaris 10 without 118855-06 Solaris sysinfo Kernel Memory Disclosure By qaaz / include include include include include include define PAGECOUNT 1000 int mainint argc, char argv...
Linux Kernel 2.6.20 with DCCP Support - Memory Disclosure (2)
Linux Kernel 2.6.20 with DCCP Support - Memory Disclosure 2 include include include include include include include define BUFSIZE 0x10000000 int mainint argc, char argv void mem = mmap0, BUFSIZE, PROTREAD | PROTWRITE, MAPANONYMOUS | MAPPRIVATE, 0, 0; if mem == void-1 printf"Alloc failed\n"; retu...
FreeBSD-SA-06:25.kmem
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-06:25.kmem Security Advisory The FreeBSD Project Topic: Kernel memory disclosure in firewire4 Category: core Module: sysdev Announced: 2006-12-06 Credits: Rodrigo...
Solaris <= 10 sysinfo() Local Kernel Memory Disclosure Exploit
Exploit for solaris platform in category local exploits ============================================================== Solaris include include include define bufsize 1294967293 int mainint argc,char argv int fd; ssizet out; char outputbuffer; ifargc \n"; exit1; printf" Solaris = 10 sysinfo kernel...
iDefense Security Advisory 07.20.06: Sun Microsystems Solaris sysinfo() Kernel Memory Disclosure Vulnerability
Sun Microsystems Solaris sysinfo Kernel Memory Disclosure Vulnerability iDefense Security Advisory 07.20.06 http://www.idefense.com/application/poi/display?type=vulnerabilities July 20, 2006 I. BACKGROUND Solaris is a UNIX operating system developed by Sun Microsystems. II. DESCRIPTION Local...
Solaris 10 - 'sysinfo()' Local Kernel Memory Disclosure (1)
/ Sun Microsystems Solaris sysinfo Kernel Memory Disclosure exploit =================================================================== Local exploitation of an integer overflow vulnerability in Sun Microsystems Inc. Solaris allows attackers to read kernel memory from a non-privileged userspace...
CVE-2006-1588: Undefined Security Weakness
The bridge ioctl ifbridge code in NetBSD 1.6 through 3.0 does not clear sensitive memory before copying ioctl results to the requesting process, which allows local users to obtain portions of kernel memory...