kernel: use-after-free in fs/block_dev.c

A use-after-free flaw was observed in blkdevget, in fs/blockdev.c after a call to blkdevget fails, and its refcount gets freed/released. This problem may cause a denial of service problem with a special user privilege, and may even lead to a confidentiality issue...

Linux TIOCSPGRP Broken Locking Exploit

Linux: Broken locking in TIOCSPGRP leads to corrupted tty-pgrp refcount tiocspgrp, the handler for the TIOCSPGRP ioctl, has the following signature: static int tiocspgrpstruct ttystruct tty, struct ttystruct realtty, pidt user p It receives two ttystruct pointers because, for PTY pairs, userspace...

Linux TIOCSPGRP Broken Locking

Linux: Broken locking in TIOCSPGRP leads to corrupted tty-pgrp refcount tiocspgrp, the handler for the TIOCSPGRP ioctl, has the following signature: static int tiocspgrpstruct ttystruct tty, struct ttystruct realtty, pidt user p It receives two ttystruct pointers because, for PTY pairs, userspace...

CentOS: Security Advisory for bpftool (CESA-2020:5023)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Moderate: Red Hat Security Advisory: kernel security and bug fix update

An update for kernel is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

Moderate: Red Hat Security Advisory: kernel-rt security and bug fix update

An update for kernel-rt is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

kernel: net-sysfs: *_queue_add_kobject refcount issue

A flaw was found in the way the rxqueueaddkobject and netdevqueueaddkobject functions in the Linux kernel handled refcounting of certain objects. This flaw allows a local user who can trigger the error code path to use this vulnerability to disturb the integrity of the system...

CVE-2020-25670

A vulnerability was found in Linux Kernel where refcount leak in llcpsockbind causing use-after-free which might lead to privilege escalations...

UBUNTU-CVE-2020-25670

A vulnerability was found in Linux Kernel where refcount leak in llcpsockbind causing use-after-free which might lead to privilege escalations...

PT-2020-6654 · Linux +5 · Linux Kernel +5

Name of the Vulnerable Software and Affected Versions: Linux Kernel affected versions not specified Description: The issue is related to the use of memory after it has been freed in the llcp sock connect function. This could potentially allow an attacker to escalate their privileges. The problem ...

UBUNTU-CVE-2020-25671

A vulnerability was found in Linux Kernel, where a refcount leak in llcpsockconnect causing use-after-free which might lead to privilege escalations...

python-psutil: Double free because of refcount mishandling

A double free issue has been discovered in python-psutil because of the mishandling of refcounts while converting system data into Python objects in functions like psutildiskpartitions, psutilusers, psutilnetifaddrs, and others. In particular cases, a local attacker may be able to get code...

kernel security and bug fix update

2.6.32-754.35.1.OL6 - Update genkey bug 25599697 2.6.32-754.35.1 - ata libata: fix NULL sdev dereference race in atapiqccomplete Kenneth Yin 1876296 2.6.32-754.34.1 - mm mm: prevent getuserpages from overflowing page refcount Aristeu Rozanski 1705003 - mm mm/hugetlb.c: getuserpages ignores certai...

CVE-2020-25221

A flaw was found in the getgatepage in mm/gup.c in the Linux kernel, where it allows privilege escalation due to incorrect reference counting caused by gate page mishandling of the struct page that backs the vsyscall page. The result is a refcount underflow. This flaw is triggered by any 64-bit...

kernel: use-after-free caused by a malicious USB device in the drivers/usb/class/cdc-acm.c driver

A use-after-free flaw was found in the acmprobe USB subsystem in the Linux kernel. A race condition occurs when a destroy procedure is initiated allowing the refcount to decrement on the interface so early that it is never under counted. A malicious USB device is required for exploit. System...

Unbreakable Enterprise kernel security update

4.14.35-1902.306.2 - rename kABI whitelists to lockedlists Dan Duval Orabug: 31783150 - sched/fair: Fix low cpu usage with high throttling by removing expiration of cpu-local slices Dave Chiluk Orabug: 31350999 CVE-2019-19922 - sched/fair: Fix throttlelist starvation with low CFS quota Phil Auld...

CVE-2020-25221

getgatepage in mm/gup.c in the Linux kernel 5.7.x and 5.8.x before 5.8.7 allows privilege escalation because of incorrect reference counting caused by gate page mishandling of the struct page that backs the vsyscall page. The result is a refcount underflow. This can be triggered by any 64-bit...

UBUNTU-CVE-2020-25221

getgatepage in mm/gup.c in the Linux kernel 5.7.x and 5.8.x before 5.8.7 allows privilege escalation because of incorrect reference counting caused by gate page mishandling of the struct page that backs the vsyscall page. The result is a refcount underflow. This can be triggered by any 64-bit...

CVE-2020-25221: Operation on a Resource after Expiration or Release

getgatepage in mm/gup.c in the Linux kernel 5.7.x and 5.8.x before 5.8.7 allows privilege escalation because of incorrect reference counting caused by gate page mishandling of the struct page that backs the vsyscall page. The result is a refcount underflow. This can be triggered by any 64-bit...

Linux CoW Incorrect Access Grant Exploit

A Linux copy-on-write issue can wrongly grant write access. Linux: CoW can wrongly grant write access because of pinned references or THP bug I've stumbled over two ways in which copy-on-write of anonymous memory after fork is currently broken: Page references through the page refcount and a bug ...