FreeBSD -- Kernel stack disclosure in Linux compatibility layer

Problem Description: The implementation of the TIOCGSERIAL ioctl2 does not clear the output struct before copying it out to userland. The implementation of the Linux sysinfo system call does not clear the output struct before copying it out to userland. Impact: An unprivileged user can read a...

FreeBSD -- Kernel stack disclosure in 4.3BSD compatibility layer

Problem Description: The implementation of historic stat2 system call does not clear the output struct before copying it out to userland. Impact: An unprivileged user can read a portion of uninitialised kernel stack data, which may contain sensitive information, such as the stack guard, portions ...

Linux kernel information disclosure vulnerability (CNVD-2016-03564)

The Linux kernel is the kernel used by the operating system Linux, released by the Linux Foundation in the United States. An information disclosure vulnerability exists in the 'x25negotiatefacilities' function in the net/x25/x25facilities.c file in versions of the Linux kernel prior to 4.5.5, whi...

DEBIAN-CVE-2016-4578

sound/core/timer.c in the Linux kernel through 4.6 does not initialize certain r1 data structures, which allows local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA timer interface, related to the 1 sndtimeruserccallback and 2 sndtimerusertinterrupt...

DEBIAN-CVE-2016-4569

The sndtimeruserparams function in sound/core/timer.c in the Linux kernel through 4.6 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA timer interface...

CVE-2016-4485

The llccmsgrcv function in net/llc/afllc.c in the Linux kernel before 4.5.5 does not initialize a certain data structure, which allows attackers to obtain sensitive information from kernel stack memory by reading a message...

CVE-2016-4486

The rtnlfilllinkifmap function in net/core/rtnetlink.c in the Linux kernel before 4.5.5 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory by reading a Netlink message...

CVE-2016-4569

The sndtimeruserparams function in sound/core/timer.c in the Linux kernel through 4.6 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA timer interface...

CVE-2016-4485

The llccmsgrcv function in net/llc/afllc.c in the Linux kernel before 4.5.5 does not initialize a certain data structure, which allows attackers to obtain sensitive information from kernel stack memory by reading a message...

CVE-2016-4580: Exposure of Sensitive Information to an Unauthorized Actor

The x25negotiatefacilities function in net/x25/x25facilities.c in the Linux kernel before 4.5.5 does not properly initialize a certain data structure, which allows attackers to obtain sensitive information from kernel stack memory via an X.25 Call Request...

CVE-2016-4569: Exposure of Sensitive Information to an Unauthorized Actor

The sndtimeruserparams function in sound/core/timer.c in the Linux kernel through 4.6 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA timer interface...

PT-2016-5976

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.5.5 Description The issue concerns the rtnl fill link ifmap function in the Linux kernel, which fails to initialize a certain data structure. This allows local users to obtain sensitive information from kernel...

CVE-2016-4569

The sndtimeruserparams function in sound/core/timer.c in the Linux kernel through 4.6 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA timer interface...

PT-2016-6029

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.7 Description The issue is related to the snd timer user params function in the sound/core/timer.c file of the Linux kernel. This function does not properly initialize a certain data structure, allowing local...

PT-2016-6037

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.5.5 Description The issue is related to the x25 negotiate facilities function in the Linux kernel, which does not properly initialize a certain data structure. This allows attackers to obtain sensitive...

PT-2016-5975

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.5.5 Description The issue is related to the llc cmsg rcv function in the Linux kernel, which fails to initialize a certain data structure. This allows attackers to obtain sensitive information from kernel stack...

CVE-2016-4485: Exposure of Sensitive Information to an Unauthorized Actor

The llccmsgrcv function in net/llc/afllc.c in the Linux kernel before 4.5.5 does not initialize a certain data structure, which allows attackers to obtain sensitive information from kernel stack memory by reading a message...

Apple OS X 10.10.5 - 'rootsh' Local Privilege Escalation

rootsh rootsh is a local privilege escalation targeting OS X Yosemite 10.10.5 build 14F27. It exploits CVE-2016-1758 and CVE-2016-1828, two vulnerabilities in XNU that were patched in OS X El Capitan 10.11.4 and 10.11.5. rootsh will not work on platforms with SMAP enabled. CVE-2016-1758:...

kernel: x86: espfix not working for 32-bit KVM paravirt guests

It was found that the espfix functionality does not work for 32-bit KVM paravirtualized guests. A local, unprivileged guest user could potentially use this flaw to leak kernel stack addresses...

CVE-2016-4485

The llccmsgrcv function in net/llc/afllc.c in the Linux kernel before 4.5.5 does not initialize a certain data structure, which allows attackers to obtain sensitive information from kernel stack memory by reading a message...