Google Android - Inter-Process munmap with User-Controlled Size in android.graphics.Bitmap

Google Android - Inter-Process munmap with User-Controlled Size in android.graphics.Bitmap Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=928 Bitmap objects can be passed between processes by flattening them to a Parcel in one process and un-flattening them in another. In order...

Google Android - Inter-Process munmap with User-Controlled Size in android.graphics.Bitmap

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=928 Bitmap objects can be passed between processes by flattening them to a Parcel in one process and un-flattening them in another. In order to conserve memory, there exists a code path which allows Bitmaps to be shared between...

FreeBSD Kernel (FreeBSD 10.2 x64) - sendmsg Kernel Heap Overflow (PoC)

FreeBSD Kernel FreeBSD 10.2 x64 - sendmsg Kernel Heap Overflow PoC include include include include include include include include include include void atagetxportvoid; int kprintfconst char fmt, ...; char ostype; void resolvechar name struct kldsymlookup ksym; ksym.version = sizeofksym;...

Linux kernel 2.2 ldd core Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/344/info Due to a rare and subtle bug in the 2.2.0 kernel, a linux machine can be forced to reboot by an unpriviliged local user. The reason for this is because of the invalid ELF core layout and the fact that munmap wipe...

Linux Kernel 'perf_count_sw_cpu_clock' event Denial of Service

No description provided by source. //Vince / Error with overflows and perf::perfcountswcpuclock / / This test will crash Linux 3.0.0 / / compile with gcc -O2 -o ofloswcpuclockcrash ofloswcpuclockcrash.c / / by Vince Weaver vweaver1 at eecs.utk.edu / define GNUSOURCE 1 include stdio.h include...

kernel: mm: use-after-free in madvise_remove()

Multiple race conditions in the madviseremove function in mm/madvise.c in the Linux kernel before 3.4.5 allow local users to cause a denial of service use-after-free and system crash via vectors involving a 1 munmap or 2 close system call...

kernel: mm: use-after-free in madvise_remove()

Multiple race conditions in the madviseremove function in mm/madvise.c in the Linux kernel before 3.4.5 allow local users to cause a denial of service use-after-free and system crash via vectors involving a 1 munmap or 2 close system call...

kernel: mm: use-after-free in madvise_remove()

Multiple race conditions in the madviseremove function in mm/madvise.c in the Linux kernel before 3.4.5 allow local users to cause a denial of service use-after-free and system crash via vectors involving a 1 munmap or 2 close system call...

CVE-2012-3511

Multiple race conditions in the madviseremove function in mm/madvise.c in the Linux kernel before 3.4.5 allow local users to cause a denial of service use-after-free and system crash via vectors involving a 1 munmap or 2 close system call...

DEBIAN-CVE-2012-3511

Multiple race conditions in the madviseremove function in mm/madvise.c in the Linux kernel before 3.4.5 allow local users to cause a denial of service use-after-free and system crash via vectors involving a 1 munmap or 2 close system call...

CVE-2012-3511

Multiple race conditions in the madviseremove function in mm/madvise.c in the Linux kernel before 3.4.5 allow local users to cause a denial of service use-after-free and system crash via vectors involving a 1 munmap or 2 close system call...

CVE-2012-3511

Multiple race conditions in the madviseremove function in mm/madvise.c in the Linux kernel before 3.4.5 allow local users to cause a denial of service use-after-free and system crash via vectors involving a 1 munmap or 2 close system call...

CVE-2012-3511

Multiple race conditions in the madviseremove function in mm/madvise.c in the Linux kernel before 3.4.5 allow local users to cause a denial of service use-after-free and system crash via vectors involving a 1 munmap or 2 close system call...

PT-2012-4775 · Linux +3 · Linux Kernel +3

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 3.4.5 Description: The issue is related to multiple race conditions in the madvise remove function in mm/madvise.c. This can be exploited by local users to cause a denial of service, resulting in a use-after-fre...

UBUNTU-CVE-2012-3511

Multiple race conditions in the madviseremove function in mm/madvise.c in the Linux kernel before 3.4.5 allow local users to cause a denial of service use-after-free and system crash via vectors involving a 1 munmap or 2 close system call...

PT-2009-2739 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 2.6.24.1 Description: The issue allows local users to cause a denial of service or gain privileges via unspecified vectors, related to the vm file structure member, and the mmap region and do munmap functions...

PaX Double-Mirrored VMA munmap Local Root Exploit

Exploit for linux platform in category local exploits ================================================= PaX Double-Mirrored VMA munmap Local Root Exploit ================================================= / PaX double-mirrored VMA munmap local root exploit Copyright C 2005 Christophe Devine This...

PaX - Double-Mirrored VMA munmap Privilege Escalation

/ PaX double-mirrored VMA munmap local root exploit Copyright C 2005 Christophe Devine This exploit has only been tested on Debian 3.0 running Linux 2.4.29 patched with grsecurity-2.1.1-2.4.29-200501231159 $ gcc paxomatic.c $ ./chpax -m a.out $ ./a.out ... usage: ping -LRdfnqrv -c count -i wait -...

security flaw

The domremap function for the mremap system call in Linux 2.2 to 2.2.25, 2.4 to 2.4.24, and 2.6 to 2.6.2, does not properly check the return value from the domunmap function when the maximum number of VMA descriptors is exceeded, which allows local users to gain root privileges, a different...