solaris-memleak.txt

/ $Id: raptorpeek.c,v 1.1 2007/10/18 08:09:02 raptor Exp $ raptorpeek.c - Solaris fifofs IPEEK kernel memory leak Copyright c 2007 Marco Ivaldi Lame integer signedness error in FIFO filesystems named pipes on Sun Solaris 8 through 10 allows local users to read the contents of unspecified memory...

Solaris 8/9/10 - 'fifofs I_PEEK' Local Kernel Memory Leak

/ $Id: raptorpeek.c,v 1.1 2007/10/18 08:09:02 raptor Exp $ raptorpeek.c - Solaris fifofs IPEEK kernel memory leak Copyright c 2007 Marco Ivaldi Lame integer signedness error in FIFO filesystems named pipes on Sun Solaris 8 through 10 allows local users to read the contents of unspecified memory...

Debian DSA-1505-1 : alsa-driver - kernel memory leak

Takashi Iwai supplied a fix for a memory leak in the sndpagealloc module. Local users could exploit this issue to obtain sensitive information from the kernel CVE-2007-4571 . %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted...

DESlock+ <= 3.2.6 (list) Local Kernel Memory Leak PoC

No description provided by source. / deslock-list-leak.c Copyright c 2008 by [email protected] DESlock+ = 3.2.6 local kernel mem leak POC by mu-b - Fri 21 Dec 2007 - Tested on: DLMFENC.sys 1.0.0.26 kernel pool memory leak by continually allocating link list structures and never freeing them. Th...

DESlock+ <= 3.2.6 (list) Local Kernel Memory Leak PoC

Exploit for unknown platform in category local exploits ===================================================== DESlock+ DESlock+ include include define DLMFENCIOCTL 0x0FA4204C define DLMFENCFLAG 0xC001D00D define ARGSIZEa a-sizeof int2/sizeof void struct ioctlreq int flag; int reqnum; void...

CVE-2007-2875: Undefined Security Weakness

Integer underflow in the cpusettasksread function in the Linux kernel before 2.6.20.13, and 2.6.21.x before 2.6.21.4, when the cpuset filesystem is mounted, allows local users to obtain kernel memory contents by using a large offset when reading the /dev/cpuset/tasks file...

CVE-2007-2831: Improper Restriction of Operations within the Bounds of a Memory Buffer

Array index error in the 1 ieee80211ioctlgetwmmparams and 2 ieee80211ioctlsetwmmparams functions in net80211/ieee80211wireless.c in MadWifi before 0.9.3.1 allows local users to cause a denial of service system crash, possibly obtain kernel memory contents, and possibly execute arbitrary code via ...

CVE-2007-1353: Undefined Security Weakness

The setsockopt function in the L2CAP and HCI Bluetooth support in the Linux kernel before 2.4.34.3 allows context-dependent attackers to read kernel memory and obtain sensitive information via unspecified vectors involving the copyfromuser function accessing an uninitialized stack buffer...

CVE-2007-1734: Undefined Security Weakness

The DCCP support in the dodccpgetsockopt function in net/dccp/proto.c in Linux kernel 2.6.20 and later does not verify the upper bounds of the optlen value, which allows local users running on certain architectures to read kernel memory or cause a denial of service oops, a related issue to...

CVE-2006-5174: Undefined Security Weakness

The copyfromuser function in the uaccess code in Linux kernel 2.6 before 2.6.19-rc1, when running on s390, does not properly clear a kernel buffer, which allows local user space programs to read portions of kernel memory by "appending to a file from a bad address," which triggers a fault that...

sysinforaptor.txt

/ $Id: raptorsysinfo.c,v 1.2 2006/08/22 13:47:54 raptor Exp $ raptorsysinfo.c - Solaris sysinfo2 kernel memory leak Copyright c 2006 Marco Ivaldi systeminfo.c for Sun Solaris allows local users to read kernel memory via a 0 variable count argument to the sysinfo system call, which causes a -1...

CVE-2006-3824: Undefined Security Weakness

systeminfo.c for Sun Solaris allows local users to read kernel memory via a 0 variable count argument to the sysinfo system call, which causes a -1 argument to be used by the copyout function. NOTE: this issue has been referred to as an integer overflow, but it is probably more like a signedness...

Solaris 10 - sysinfo() Local Kernel Memory Disclosure (1)

Solaris 10 - sysinfo Local Kernel Memory Disclosure 1 / Sun Microsystems Solaris sysinfo Kernel Memory Disclosure exploit =================================================================== Local exploitation of an integer overflow vulnerability in Sun Microsystems Inc. Solaris allows attackers t...

CVE-2006-0380: Undefined Security Weakness

A logic error in FreeBSD kernel 5.4-STABLE and 6.0 causes the kernel to calculate an incorrect buffer length, which causes more data to be copied to userland than intended, which could allow local users to read portions of kernel memory...

CVE-2005-4605: Undefined Security Weakness

The procfs code procmisc.c in Linux 2.6.14.3 and other versions before 2.6.15 allows attackers to read sensitive kernel memory via unspecified vectors in which a signed value is added to an unsigned value...

CVE-2005-3181

The audit system in Linux kernel 2.6.6, and other versions before 2.6.13.4, when CONFIGAUDITSYSCALL is enabled, uses an incorrect function to free namescache memory, which prevents the memory from being tracked by AUDITSYSCALL code and leads to a memory leak that allows attackers to cause a denia...

CVE-2004-2302: Undefined Security Weakness

Race condition in the sysfsreadfile and sysfswritefile functions in Linux kernel before 2.6.10 allows local users to read kernel memory and cause a denial of service crash via large offsets in sysfs files...

sendfile() system call may leak sections of kernel memory

Overview The sendfile system call does not handle specially crafted files properly. Exploitation of this vulnerability may leak sensitive information to a local attacker. Description The sendfile system call is used to send a file through a socket without copying the file data into memory. A...

CVE-2005-0708: Undefined Security Weakness

The sendfile system call in FreeBSD 4.8 through 4.11 and 5 through 5.4 can transfer portions of kernel memory if a file is truncated while it is being sent, which could allow remote attackers to obtain sensitive information...

CVE-2005-0530: Undefined Security Weakness

Signedness error in the copyfromreadbuf function in ntty.c for Linux kernel 2.6.10 and 2.6.11rc1 allows local users to read kernel memory via a negative argument...