kernel: security/keys: fix slab-out-of-bounds in key_task_permission

A flaw was found in the Linux kernel's key management subsystem. A local user can trigger this vulnerability by adding multiple keys with specific hash patterns, causing the kernel to misinterpret internal tree pointers during a nested keyring search. This issue leads to an out-of-bounds memory...

kernel: Uninitialized variable in request_key handling causes kernel crash in error handling path

A flaw was found in the Linux kernel's keyring handling code: the keyrejectandlink function could be forced to free an arbitrary memory block. An attacker could use this flaw to trigger a use-after-free condition on the system, potentially allowing for privilege escalation...

USN-3053-1 linux-lts-vivid vulnerabilities

A missing permission check when settings ACLs was discovered in nfsd. A local user could exploit this flaw to gain access to any file by setting an ACL. CVE-2016-1237 It was discovered that the keyring implementation in the Linux kernel did not ensure a data structure was initialized before...

USN-2829-2 linux-lts-vivid vulnerabilities

It was discovered that the SCTP protocol implementation in the Linux kernel performed an incorrect sequence of protocol-initialization steps. A local attacker could use this to cause a denial of service system crash. CVE-2015-5283 Dmitry Vyukov discovered that the Linux kernel's keyring handler...

kernel: keyrings: find_keyring_by_name() can gain the freed keyring

Race condition in the findkeyringbyname function in security/keys/keyring.c in the Linux kernel 2.6.34-rc5 and earlier allows local users to cause a denial of service memory corruption and system crash or possibly have unspecified other impact via keyctl session commands that trigger access to a...