UBUNTU-CVE-2013-2929

The Linux kernel before 3.12.2 does not properly use the getdumpable function, which allows local users to bypass intended ptrace restrictions or obtain sensitive information from IA64 scratch registers via a crafted application, related to kernel/ptrace.c and arch/ia64/include/asm/processor.h...

Oracle Linux 6 : kernel (ELSA-2013-0567)

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2013-0567 advisory. 2.6.32-358.0.1 - kernel utrace: ensure archptrace/ptracerequest can never race with SIGKILL Oleg Nesterov 912073 912074 CVE-2013-0871 Tenable has extracted the...

Oracle Linux 5 : kernel (ELSA-2009-0326)

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2009-0326 advisory. - net fix icmpsend and icmpv6send host re-lookup code Jiri Pirko 489253 439670 CVE-2009-0778 - net skfpioctl inverted logic flaw Eugene Teo 486539 4865...

Oracle Linux 5 : kernel (ELSA-2013-0621)

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-0621 advisory. - utrace ensure archptrace can never race with SIGKILL Oleg Nesterov 912071 912072 CVE-2013-0871 Tenable has extracted the preceding description block...

Oracle Linux 5 / 6 : Unbreakable Enterprise kernel Security (ELSA-2013-2534)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-2534 advisory. - KVM: add missing void user COPYING CREDITS Documentation Kbuild MAINTAINERS Makefile README REPORTING- BUGS arch block crypto drivers firmware fs...

Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2012-2022)

Description of changes: Avoid bug caused by corrupted Ext4 filesystem. When mounting an ext4 filesystem, the kernel was not checking for zero length extents. This would cause a BUGON assertion failure in the log. NULL pointer dereference in the SCSI subsystem. A NULL dereference may occur if a SC...

Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2013-2513)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-2513 advisory. - wakeupprocess should be never used to wakeup a TASKSTOPPED/TRACED task Oleg Nesterov Orabug: 16405869 CVE-2013-0871 - ptrace: ensure...

Design/Logic Flaw

The vmmaplookup function in sys/vm/vmmap.c in the mmap implementation in the kernel in FreeBSD 9.0 through 9.1-RELEASE-p4 does not properly determine whether a task should have write access to a memory location, which allows local users to bypass filesystem write permissions and consequently gain...

Immunity Canvas: MAPTRACE

Name| maptrace ---|--- CVE| CVE-2013-2171 Exploit Pack| CANVAS Description| maptrace: MMAP/PTRACE privilege escalation Notes| CVE Name: CVE-2013-2171 VENDOR: Intel,FreeBSD Notes: Tested on FreeBSD 9.0-RC3 and FreeBSD 9.0-RELEASE AMD64 To test this exploit from CANVAS use the...

PT-2013-3575

Name of the Vulnerable Software and Affected Versions FreeBSD versions 9.0 through 9.1-RELEASE-p4 Description The issue concerns the vm map lookup function in the kernel's mmap implementation, which fails to properly determine whether a task should have write access to a memory location. This...

CVE-2013-2171: Undefined Security Weakness

The vmmaplookup function in sys/vm/vmmap.c in the mmap implementation in the kernel in FreeBSD 9.0 through 9.1-RELEASE-p4 does not properly determine whether a task should have write access to a memory location, which allows local users to bypass filesystem write permissions and consequently gain...

FreeBSD mmap+ptrace vulnerability

It's possible to modify mmap memory mapped files via ptrace...

Happy Birthday FreeBSD! Now you are 20 years old and your security is the same as 20 years ago... :)

$ uname -a FreeBSD fbsd91x64 9.1-RELEASE FreeBSD 9.1-RELEASE 0 r243825: Tue Dec 4 09:23:10 UTC 2012 [email protected]:/usr/obj/usr/src/sys/GENERIC amd64 $ id uid=1001hunger gid=1002hunger groups=1002hunger $ gcc fbsd9lul.c -o fbsd9lul $ ./fbsd9lul FreeBSD 9.0,1 mmap/ptrace exploit by...

FreeBSD Security Advisory FreeBSD-SA-13:06.mmap [REVISED]

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-13:06.mmap Security Advisory The FreeBSD Project Topic: Privilege escalation via mmap Category: core Module: kernel Announced: 2013-06-18 Credits: Konstantin...

FreeBSD 9.0 9.1 - mmapptrace Local Privilege Escalation

FreeBSD 9.0 9.1 - mmapptrace Local Privilege Escalation / FreeBSD 9.0,1 mmap/ptrace exploit by Hunger Happy Birthday FreeBSD! Now you are 20 years old and your security is the same as 20 years ago... : Greetings to nohup, 2501, boldi, eax, johnnyb, kocka, op, pipacs, prof, sd, sghctoma, snq,...

FreeBSD 9.0 < 9.1 - 'mmap/ptrace' Local Privilege Escalation

/ FreeBSD 9.0,1 mmap/ptrace exploit by Hunger Happy Birthday FreeBSD! Now you are 20 years old and your security is the same as 20 years ago... : Greetings to nohup, 2501, boldi, eax, johnnyb, kocka, op, pipacs, prof, sd, sghctoma, snq, spender, s2crew and others at hekkcamp: I hope we'll meet...

FreeBSD mmap Privilege Escalation Exploit

This exploits performs privilege escalation leveraging the mmap vulnerability in FreeBSD 9.1 as described in FreeBSD-SA-13:06. / FreeBSD privilege escalation CVE-2013-2171 credits Konstantin Belousov & Alan Cox tested on FreeBSD 9.1 ref:...

FreeBSD-SA-13:06.mmap

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-13:06.mmap Security Advisory The FreeBSD Project Topic: Privilege escalation via mmap Category: core Module: kernel Announced: 2013-06-18 Credits: Konstantin...

Unbreakable Enterprise kernel Security update

2.6.32-400.29.1 - KVM: add missing void user COPYING CREDITS Documentation Kbuild MAINTAINERS Makefile README REPORTING-BUGS arch block crypto drivers firmware fs include init ipc kernel lib mm net samples scripts security sound tools uek-rpm usr virt cast to accessok call Heiko Carstens Orabug:...

kernel: race condition with PTRACE_SETREGS

Race condition in the ptrace functionality in the Linux kernel before 3.7.5 allows local users to gain privileges via a PTRACESETREGS ptrace system call in a crafted application, as demonstrated by ptracedeath...