1392 matches found
FreeBSD <= 6.1 kqueue() NULL pointer dereference
FreeBSD = 6.1 suffers from classical check/use race condition on SMP systems in kevent syscall, leading to kernel mode NULL pointer dereference. It can be triggered by spawning two threads: 1st thread looping on open and close syscalls, and the 2nd thread looping on kevent, trying to add possibly...
Slackware 12.2 / current : kernel (SSA:2009-230-01)
New Linux kernel packages are available for Slackware 12.2 and -current to address a security issue. A kernel bug discovered by Tavis Ormandy and Julien Tinnes of the Google Security Team could allow a local user to fill memory page zero with arbitrary code and then use the kernel sendpage...
Mandriva Linux Security Advisory : kernel (MDVSA-2009:205)
A vulnerability was discovered and corrected in the Linux 2.6 kernel : The Linux kernel 2.6.0 through 2.6.30.4, and 2.4.4 through 2.4.37.4, does not initialize all function pointers for socket operations in protoops structures, which allows local users to trigger a NULL pointer dereference and ga...
CVE-2009-2692
The Linux kernel 2.6.0 through 2.6.30.4, and 2.4.4 through 2.4.37.4, does not initialize all function pointers for socket operations in protoops structures, which allows local users to trigger a NULL pointer dereference and gain privileges by using mmap to map page zero, placing arbitrary code on...
kernel: personality: fix PER_CLEAR_ON_SETID
The personality subsystem in the Linux kernel before 2.6.31-rc3 has a PERCLEARONSETID setting that does not clear the ADDRCOMPATLAYOUT and MMAPPAGEZERO flags when executing a setuid or setgid program, which makes it easier for local users to leverage the details of memory usage to 1 conduct NULL...
python: Multiple integer overflows in python core
Multiple integer overflows in Python 2.5.2 and earlier allow context-dependent attackers to have an unknown impact via vectors related to the 1 stringobject, 2 unicodeobject, 3 bufferobject, 4 longobject, 5 tupleobject, 6 stropmodule, 7 gcmodule, and 8 mmapmodule modules. NOTE: The expandtabs...
CVE-2009-1897
The tunchrpoll function in drivers/net/tun.c in the tun subsystem in the Linux kernel 2.6.30 and 2.6.30.1, when the -fno-delete-null-pointer-checks gcc option is omitted, allows local users to gain privileges via vectors involving a NULL pointer dereference and an mmap of /dev/net/tun, a differen...
FreeBSD 7.07.1 - vfs.usermount Local Privilege Escalation
FreeBSD 7.07.1 - vfs.usermount Local Privilege Escalation / cve-2008-3531.c -- Patroklos Argyroudis, argp at domain census-labs.com Privilege escalation exploit for the FreeBSD-SA-08:08.nmount CVE-2008-3531 vulnerability: http://security.freebsd.org/advisories/FreeBSD-SA-08:08.nmount.asc...
Apple Mac OSX xnu 1228.x - Local Kernel Memory Disclosure
/ xnu-getldt.c Copyright c 2008 by Apple MACOS X xnu include include include include include include include define TMPFILE "/tmp/xnu-getldt" define READSIZE 0x2000000 int main int argc, char argv int fd, n, numdesc; void ptr; printf "Apple MACOS X xnu \n" "http://www.digit-labs.org/ -- Digit-Lab...
PT-2009-2739 · Linux · Linux Kernel
Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 2.6.24.1 Description: The issue allows local users to cause a denial of service or gain privileges via unspecified vectors, related to the vm file structure member, and the mmap region and do munmap functions...
linux/amd64 - flush iptables rules shellcode 84 bytes
linux/amd64 flush iptables rules shellcode 84 bytes. Shellcode exploit for linamd64 platform / /sbin/iptables -F shellcode for AMD64 84 bytes By gat3way The code to load the sc into an executable mmap-ed executable page was shamelessly stolen by hophet too lazy : Thanks Gustavo C. for the...
linux/amd64 flush iptables rules shellcode 84 bytes
No description provided by source. / /sbin/iptables -F shellcode for AMD64 84 bytes By gat3way gat3wayat gat3waydoteu The code to load the sc into an executable mmap-ed executable page was shamelessly stolen by hophet too lazy : Thanks Gustavo C. for the inspiration - x8664 assembly is fun : Here...
Linux Kernel < 2.6.22 ftruncate()/open() Local Exploit
Exploit for linux platform in category local exploits ====================================================== Linux Kernel bug information: http://osvdb.org/49081 !!!This is for educational purposes only!!! To use it, you've got to find a sgid directory you've got permissions to write into obvious...
SuSE 10 Security Update : Python (ZYPP Patch Number 5490)
This update of python fixes several security vulnerabilities. CVE-2008-1679 / CVE-2008-1887 / CVE-2008-3143 / CVE-2008-3142 / CVE-2008-3144 / CVE-2008-2315 / CVE-2008-2316 Note: for SLE10 a non-security bug in mmap was fixed too. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text...
Linux Kernel "do_mremap" Local Proof of Concept
No description provided by source. / Proof-of-concept exploit code for domremap Copyright C 2004 Christophe Devine and Julien Tinnes This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software...
Linux Kernel "mremap()"#2 Local Proof-of-concept
No description provided by source. / Proof-of-concept exploit code for domremap 2 Copyright C 2004 Christophe Devine This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either versi...
Linux Kernel SPARC平台mmap()调用本地拒绝服务漏洞
BUGTRAQ ID: 29397 CVECAN ID: CVE-2008-2137 Linux Kernel是开放源码操作系统Linux所使用的内核。 Linux Kernel内核的实现上存在漏洞，如果没有设置mmap MAPFIXED位的话，Linux Kernel的arch/sparc/kernel/syssparc.c文件中的sparcmmapcheck函数以及arch/sparc64/kernel/syssparc.c文件中的sparc64mmapcheck函数会忽略一些虚拟地址范围，这允许本地攻击者通过恶意的mmap调用导致拒绝服务。 Linux kernel 2.6.25....
Code injection
The 1 sparcmmapcheck function in arch/sparc/kernel/syssparc.c and the 2 sparc64mmapcheck function in arch/sparc64/kernel/syssparc.c, in the Linux kernel 2.4 before 2.4.36.5 and 2.6 before 2.6.25.3, omit some virtual-address range aka span checks when the mmap MAPFIXED bit is not set, which allows...
CVE-2008-2137
The 1 sparcmmapcheck function in arch/sparc/kernel/syssparc.c and the 2 sparc64mmapcheck function in arch/sparc64/kernel/syssparc.c, in the Linux kernel 2.4 before 2.4.36.5 and 2.6 before 2.6.25.3, omit some virtual-address range aka span checks when the mmap MAPFIXED bit is not set, which allows...
CVE-2008-2137
The CVE-2008-2137 entry describes a Linux kernel vulnerability in the SPARC/SPARC64 mmap checks. Affected are Linux kernel 2.4 before 2.4.36.5 and 2.6 before 2.6.25.3, where sparc_mmap_check (arch/sparc/kernel/sys_sparc.c) and sparc64_mmap_check (arch/sparc64/kernel/sys_sparc.c) omit some virtual...