EulerOS 2.0 SP2 : libseccomp (EulerOS-SA-2019-1856)

According to the version of the libseccomp package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - libseccomp before 2.4.0 did not correctly generate 64-bit syscall argument comparisons using the arithmetic operators LT, GT, LE, GE, which migh...

EulerOS 2.0 SP5 : libseccomp (EulerOS-SA-2019-1794)

According to the version of the libseccomp package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - libseccomp before 2.4.0 did not correctly generate 64-bit syscall argument comparisons using the arithmetic operators LT, GT, LE, GE, which migh...

USN-4095-2 linux-lts-xenial, linux-aws vulnerabilities

USN-4095-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement HWE kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 ESM. Eli Biham and Lior Neumann discovered that the Bluetooth implementation in the Linux...

qemu-kvm security, bug fix, and enhancement update

1.5.3-167.el7 - Reverting kvm-seccomp-set-the-seccomp-filter-to-all-threads.patch bz1618503 - Resolves: bz1618503 qemu-kvm: Qemu: seccomp: blacklist is not applied to all threads rhel-7 1.5.3-166.el7 - kvm-seccomp-set-the-seccomp-filter-to-all-threads.patch bz1618503 - Resolves: bz1618503 qemu-kv...

The vulnerability of the seccomp component in the Linux operating system’s kernel allows a attacker to increase their privileges and execute arbitrary code.

The vulnerability of the seccomp component in the Linux operating system’s kernel is related to access control errors. Exploiting this vulnerability can allow an attacker to enhance their privileges and execute arbitrary code...

Seccomp Tools - Provide Powerful Tools For Seccomp Analysis

Provide powerful tools for seccomp analysis. This project is targeted to but not limited to analyze seccomp sandbox in CTF pwn challenges. Some features might be CTF-specific, but still useful for analyzing seccomp in real-case. Features Dump - Automatically dumps seccomp-bpf from execution files...

Denial Of Service (Dos)

qemu is vulnerable to denial of service. Mishandling of the seccomp policy for threads other than the main thread allows local OS guest users to crash the application...

Important: Red Hat Security Advisory: qemu-kvm-rhev security and bug fix update

An update for qemu-kvm-rhev is now available for Red Hat OpenStack Platform 10.0 Newton, Red Hat OpenStack Platform 13.0 Queens, and Red Hat OpenStack Platform 14.0 Rocky. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring Syste...

USN-4076-1: Linux kernel vulnerabilities

It was discovered that a race condition existed in the Serial Attached SCSI SAS implementation in the Linux kernel. A local attacker could possibly use this to cause a denial of service system crash or execute arbitrary code. CVE-2018-20836 It was discovered that the ext4 file system implementati...

USN-4076-1 linux, linux-aws, linux-kvm, linux-raspi2 vulnerabilities

It was discovered that a race condition existed in the Serial Attached SCSI SAS implementation in the Linux kernel. A local attacker could possibly use this to cause a denial of service system crash or execute arbitrary code. CVE-2018-20836 It was discovered that the ext4 file system implementati...

Privilege Escalation

rkt is vulnerable to privilege escalation attacks. Processes generated with the rkt enter command run with escalated capabilities, without seccomp filtering, and are not limited by cgroups which leads to the privilege escalation vulnerability. Affected component is Process Handler...

Remote Code Execution (RCE)

rkt is vulnerable to remote code execution. Processes run with rkt enter do not have seccomp filtering during stage 2, allowing the attacker to run scripts that access host resources...

CVE-2019-10145

rkt through version 1.30.0 does not isolate processes in containers that are run with rkt enter. Processes run with rkt enter do not have seccomp filtering during stage 2 the actual environment in which the applications run. Compromised containers could exploit this flaw to access host resources...

CVE-2019-10145

rkt through version 1.30.0 does not isolate processes in containers that are run with rkt enter. Processes run with rkt enter do not have seccomp filtering during stage 2 the actual environment in which the applications run. Compromised containers could exploit this flaw to access host resources...

UBUNTU-CVE-2019-10145

rkt through version 1.30.0 does not isolate processes in containers that are run with rkt enter. Processes run with rkt enter do not have seccomp filtering during stage 2 the actual environment in which the applications run. Compromised containers could exploit this flaw to access host resources...

Design/Logic Flaw

rkt through version 1.30.0 does not isolate processes in containers that are run with rkt enter. Processes run with rkt enter do not have seccomp filtering during stage 2 the actual environment in which the applications run. Compromised containers could exploit this flaw to access host resources...

CVE-2019-10145

CVE-2019-10145 affects rkt up to version 1.30.0. The issue: containers started with rkt enter do not isolate processes and lack seccomp filtering during stage 2, allowing a compromised container to access host resources. Documents consistently describe the vulnerability without providing explicit...

CVE-2019-10145

rkt through version 1.30.0 does not isolate processes in containers that are run with rkt enter. Processes run with rkt enter do not have seccomp filtering during stage 2 the actual environment in which the applications run. Compromised containers could exploit this flaw to access host resources...

CVE-2019-12589

In Firejail before 0.9.60, seccomp filters are writable inside the jail, leading to a lack of intended seccomp restrictions for a process that is joined to the jail after a filter has been modified by an attacker...

DEBIAN-CVE-2019-12589

In Firejail before 0.9.60, seccomp filters are writable inside the jail, leading to a lack of intended seccomp restrictions for a process that is joined to the jail after a filter has been modified by an attacker...