kernel: a race between inotify_handle_event() and sys_rename()

A race condition was found in the Linux kernel, present since v3.14-rc1 through v4.12. The race happens between threads of inotifyhandleevent and vfsrename while running the rename operation against the same file. As a result of the race the next slab data or the slab's free list pointer can be...

Important: Red Hat Security Advisory: kernel security and bug fix update

An update for kernel is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

Linux Kernel 4.12 Race Condition Vulnerability

A race condition was found in the Linux kernel versions 3.14-rc1 through 4.12. The race happens between threads of inotifyhandleevent and vfsrename while running the rename operation against the same file. The next slab data or the slab's free list pointer can be corrupted with attacker-controlle...

CVE-2017-7533

A race condition was found in the Linux kernel, present since v3.14-rc1 through v4.12. The race happens between threads of inotifyhandleevent and vfsrename while running the rename operation against the same file. As a result of the race the next slab data or the slab's free list pointer can be...

USN-3361-1: Linux kernel (HWE) vulnerabilities

USN-3358-1 fixed vulnerabilities in the Linux kernel for Ubuntu 17.04. This update provides the corresponding updates for the Linux Hardware Enablement HWE kernel from Ubuntu 17.04 for Ubuntu 16.04 LTS. Please note that this update changes the Linux HWE kernel to the 4.10 based kernel from Ubuntu...

kernel: EXT4 memory corruption / SLAB out-of-bounds read

Mounting a crafted EXT4 image read-only leads to an attacker controlled memory corruption and SLAB-Out-of-Bounds reads...

kernel: EXT4 memory corruption / SLAB out-of-bounds read

Mounting a crafted EXT4 image read-only leads to an attacker controlled memory corruption and SLAB-Out-of-Bounds reads...

kernel: EXT4 memory corruption / SLAB out-of-bounds read

Mounting a crafted EXT4 image read-only leads to an attacker controlled memory corruption and SLAB-Out-of-Bounds reads...

UBUNTU-CVE-2017-7889

The mm subsystem in the Linux kernel through 3.2 does not properly enforce the CONFIGSTRICTDEVMEM protection mechanism, which allows local users to read or write to kernel memory locations in the first megabyte and bypass slab-allocation access restrictions via an application that opens the...

Linux kernel local privilege escalation flaw in n_hdlc（CVE-2017-2636）

This article discloses the exploitation of CVE-2017-2636, which is a race condition in the nhdlc Linux kernel driver drivers/tty/nhdlc.c. The described exploit gains root privileges bypassing Supervisor Mode Execution Protection SMEP. This driver provides HDLC serial line discipline and comes as ...

DEBIAN-CVE-2017-5546

The freelist-randomization feature in mm/slab.c in the Linux kernel 4.8.x and 4.9.x before 4.9.5 allows local users to cause a denial of service duplicate freelist entries and system crash or possibly have unspecified other impact in opportunistic circumstances by leveraging the selection of a...

CVE-2016-10208

Mounting a crafted EXT4 image read-only leads to an attacker controlled memory corruption and SLAB-Out-of-Bounds reads...

UBUNTU-CVE-2017-5546

The freelist-randomization feature in mm/slab.c in the Linux kernel 4.8.x and 4.9.x before 4.9.5 allows local users to cause a denial of service duplicate freelist entries and system crash or possibly have unspecified other impact in opportunistic circumstances by leveraging the selection of a...

kernel: Slab out-of-bounds access in sctp_sf_ootb()

A flaw was found in the Linux kernel's implementation of the SCTP protocol. A remote attacker could trigger an out-of-bounds read with an offset of up to 64kB potentially causing the system to crash...

SUSE SLES12 Security Update : kernel (SUSE-SU-2016:3247-1)

This update for the Linux Kernel 3.12.60-5257 fixes several issues. The following security bugs were fixed : - CVE-2016-8655: A race condition in the afpacket packetsetring function could be used by local attackers to crash the kernel or gain privileges bsc1012759. - CVE-2016-9555: The sctpsfootb...

SUSE SLES12 Security Update : kernel (SUSE-SU-2016:3113-1)

This update for the Linux Kernel 3.12.60-5249 fixes several issues. The following security bugs were fixed : - CVE-2016-8655: A race condition in the afpacket packetsetring function could be used by local attackers to crash the kernel or gain privileges bsc1012759. - CVE-2016-9555: The sctpsfootb...

openSUSE Security Update : the Linux Kernel (openSUSE-2016-1436)

The openSUSE 13.1 kernel was updated to receive various critical security fixes. The following security bugs were fixed : - CVE-2016-8655: A race condition in the afpacket packetsetring function could be used by local attackers to crash the kernel or gain privileges bsc1012754. - CVE-2016-8632: T...

openSUSE Security Update : the Linux Kernel (openSUSE-2016-1426)

The openSUSE Leap 42.2 kernel was updated to 4.4.36 to receive various security and bugfixes. The following security bugs were fixed : - CVE-2015-1350: The VFS subsystem in the Linux kernel 3.x provides an incomplete set of requirements for setattr operations that underspecifies removing extended...

SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2016:3039-1)

The SUSE Linux Enterprise 12 SP1 kernel was updated to receive various critical security fixes. The following security bugs were fixed : - CVE-2016-8655: A race condition in the afpacket packetsetring function could be used by local attackers to crash the kernel or gain privileges bsc1012754. -...

Linux af_packet.c race condition (local root) (CVE-2016-8655)

To create AFPACKET sockets you need CAPNETRAW in your network namespace, which can be acquired by unprivileged processes on systems where unprivileged namespaces are enabled Ubuntu, Fedora, etc. It can be triggered from within containers to compromise the host kernel. On Android, processes with...