kernel: kernel: DAX hugepages not considered during mremap

A flaw was found in the way mremap handled DAX Huge Pages. This flaw allows a local attacker with access to a DAX enabled storage to escalate their privileges on the system...

Linux cpia2_remap_buffer Kernel Privilege Escalation

The vulnerability of the cpia2remapbuffer function drivers/media/usb/cpia2/cpia2core.c in the Linux kernel is related to integer overflow. Exploiting this vulnerability can allow an attacker to gain access to read and write operations on physical pages in the kernel, thereby enhancing their...

kernel: TLB flush happens too late on mremap

Since Linux kernel version 3.2, the mremap syscall performs TLB flushes after dropping pagetable locks. If a syscall such as ftruncate removes entries from the pagetables of a task that is in the middle of mremap, a stale TLB entry can remain for a short time that permits access to a physical pag...

openSUSE Security Update : containerd / docker / docker-runc / etc (openSUSE-2020-45)

This update for containerd, docker, docker-runc, golang-github-docker-libnetwork fixes the following issues : Security issue fixed : - CVE-2019-16884: Fixed incomplete patch for LSM bypass via malicious Docker image that mount over a /proc directory bsc1152308. Bug fixes : - Update to Docker...

openSUSE: Security Advisory for containerd, docker, docker-runc, go, go1.11, go1.12, golang-github-docker-libnetwork (openSUSE-SU-2020:0045-1)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

SUSE SLED15 / SLES15 Security Update : containerd, docker, docker-runc, golang-github-docker-libnetwork (SUSE-SU-2020:0035-1)

This update for containerd, docker, docker-runc, golang-github-docker-libnetwork fixes the following issues : Security issue fixed : CVE-2019-16884: Fixed incomplete patch for LSM bypass via malicious Docker image that mount over a /proc directory bsc1152308. Bug fixes: Update to Docker 19.03.5-c...

SUSE-SU-2020:0035-1 Security update for containerd, docker, docker-runc, golang-github-docker-libnetwork

This update for containerd, docker, docker-runc, golang-github-docker-libnetwork fixes the following issues: Security issue fixed: - CVE-2019-16884: Fixed incomplete patch for LSM bypass via malicious Docker image that mount over a /proc directory bsc1152308. Bug fixes: - Update to Docker...

CVE-2019-2321

Incorrect length used while validating the qsee log buffer sent from HLOS which could then lead to remap conflict in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT,...

CVE-2019-2321

CVE-2019-2321 describes an incorrect length validation in the QSEE log buffer handling that could cause a remap conflict across a wide range of Qualcomm Snapdragon platforms (listed in the description: includes numerous Snapdragon Auto/Compute/Connectivity families and mobile chipsets such as APQ...

CVE-2019-2321: Buffer Copy without Checking Size of Input

Incorrect length used while validating the qsee log buffer sent from HLOS which could then lead to remap conflict in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT,...

DEBIAN-CVE-2019-18675

The Linux kernel through 5.3.13 has a startoffset+size Integer Overflow in cpia2remapbuffer in drivers/media/usb/cpia2/cpia2core.c because cpia2 has its own mmap implementation. This allows local users with /dev/video0 access to obtain read and write permissions on kernel physical pages, which ca...

kernel: TLB flush happens too late on mremap

Since Linux kernel version 3.2, the mremap syscall performs TLB flushes after dropping pagetable locks. If a syscall such as ftruncate removes entries from the pagetables of a task that is in the middle of mremap, a stale TLB entry can remain for a short time that permits access to a physical pag...

kernel: TLB flush happens too late on mremap

Since Linux kernel version 3.2, the mremap syscall performs TLB flushes after dropping pagetable locks. If a syscall such as ftruncate removes entries from the pagetables of a task that is in the middle of mremap, a stale TLB entry can remain for a short time that permits access to a physical pag...

PT-2019-6271

Name of the Vulnerable Software and Affected Versions sysstat versions prior to 12.1.6 Description The issue is related to a buffer overflow in the remap struct function within the sa common.c component of the sysstat utility. This can be exploited by a remote attacker to cause a denial of servic...

TEEOS.img Heap Buffer Overflow DoS

The vulnerability of the initagent2TAcontext function in the TEEOS.img file with a offset of 0x13949C in the SMC handler of the TEE OS Trusted Core in the microprogramming of the Huawei Mate 9 Pro mobile phone is related to the lack of validation for the remap value passed in the request...

SUSE-SU-2019:1326-1 Security update for sysstat

This update for sysstat fixes the following issues: Security issues fixed: - CVE-2018-19416: Fixed out-of-bounds read during a memmove call inside the remapstruct function bsc1117001. - CVE-2018-19517: Fixed out-of-bounds read during a memset call inside the remapstruct function bsc1117260...

USN-3880-1 linux vulnerabilities

It was discovered that the CIFS client implementation in the Linux kernel did not properly handle setup negotiation during session recovery, leading to a NULL pointer exception. An attacker could use this to create a malicious CIFS server that caused a denial of service client system crash...

PT-2018-3559

Name of the Vulnerable Software and Affected Versions: sysstat version 12.1.1 Description: An issue in the remap struct function, located in sa common.c, is related to an out-of-bounds read during a memset call. This can be exploited by a remote attacker to cause a denial of service...

PT-2018-1929

Name of the Vulnerable Software and Affected Versions sysstat versions 12.1.1 and earlier Description The issue is caused by an out-of-bounds read in the remap struct function in sa common.c due to a memmove call. This can potentially allow an attacker to execute arbitrary code or cause a denial ...

kernel: Denial of service in resv_map_release function in mm/hugetlb.c

The resvmaprelease function in mm/hugetlb.c in the Linux kernel, through 4.15.7, allows local users to cause a denial of service BUG via a crafted application that makes mmap system calls and has a large pgoff argument to the remapfilepages system call...