OESA-2022-1941 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: A flaw was found in the sctpmakestrresetreq function in net/sctp/smmakechunk.c in the SCTP network protocol in the Linux kernel with a local user privilege access. In this flaw, an attempt to use more buffer than is allocated...

kernel: mptcp: fix deadlock in __mptcp_push_pending()

A vulnerability was found in the Linux kernel's mptcp component in the mptcppushpending function, where a deadlock can occur when calling mptcpflushjoinlist with the subflow socket lock held. This happens if the synchronization function mptcpsockoptsyncall is invoked, causing the system to hang d...

PT-2021-8006 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.12.0-rc1-00026-g73d464503354 Description: The issue is related to a potential deadlock between the hci dev-lock and socket lock in the Linux kernel's Bluetooth functionality. This deadlock can occur due to a...

There is a vulnerability in the linux kernel versions higher than 5.2 (if kernel compiled with config params CONFIG_BPF_SYSCALL=y CONFIG_BPF=y CONFIG_CGROUPS=y CONFIG_CGROUP_BPF=y CONFIG_HARDENED_USERCOPY not set and BPF hook to getsockopt is registered). As result of BPF execution the local user can trigger bug in __cgroup_bpf_run_filter_getsockopt() function that can lead to heap overflow (because of non-hardened usercopy). The impact of attack could be deny of service or possibly privileges escalation.

...

PT-2021-13832 · Linux +5 · Linux Kernel +5

Name of the Vulnerable Software and Affected Versions: linux kernel versions higher than 5.2 Description: The issue arises from a vulnerability in the linux kernel when compiled with specific config parameters, including CONFIG BPF SYSCALL=y, CONFIG BPF=y, CONFIG CGROUPS=y, CONFIG CGROUP BPF=y, a...

kernel: xdp_umem_reg in net/xdp/xdp_umem.c has an out-of-bounds write which could result in crash and data coruption

An out-of-bounds OOB memory access flaw was found in the Network XDP the eXpress Data Path module in the Linux kernel's xdpumemreg function in net/xdp/xdpumem.c. When a user with special user privilege of CAPNETADMIN or root calls setsockopt to register umem ring on XDP socket, passing the headro...

FreeBSD : FreeBSD -- IPv6 socket option race condition and use after free (c11ee146-c266-11ea-8659-901b0ef719ab)

The IPV62292PKTOPTIONS set handler was missing synchronization, so racing accesses could modify freed memory. Impact : A malicious user application could trigger memory corruption, leading to privilege escalation. C Tenable Network Security, Inc. The descriptive text and package checks in this...

Race condition

In FreeBSD 12.1-STABLE before r359565, 12.1-RELEASE before p7, 11.4-STABLE before r362975, 11.4-RELEASE before p1, and 11.3-RELEASE before p11, missing synchronization in the IPV62292PKTOPTIONS socket option set handler contained a race condition allowing a malicious application to modify memory...

Arbitrary Memory Read

The Linux kernel is vulnerable to arbitrary memory read. A flaw in the IPv6 socket option handling allows a local user to read arbitrary kernel memory...

CVE-2017-18509

An issue was discovered in net/ipv6/ip6mr.c in the Linux kernel before 4.11. By setting a specific socket option, an attacker can control a pointer in kernel land and cause an inetcsklistenstop general protection fault, or potentially execute arbitrary code under certain circumstances. The issue...

DEBIAN-CVE-2017-18509

An issue was discovered in net/ipv6/ip6mr.c in the Linux kernel before 4.11. By setting a specific socket option, an attacker can control a pointer in kernel land and cause an inetcsklistenstop general protection fault, or potentially execute arbitrary code under certain circumstances. The issue...

UBUNTU-CVE-2017-18509

An issue was discovered in net/ipv6/ip6mr.c in the Linux kernel before 4.11. By setting a specific socket option, an attacker can control a pointer in kernel land and cause an inetcsklistenstop general protection fault, or potentially execute arbitrary code under certain circumstances. The issue...

The vulnerability in the implementation of the XFRM dump policy (net/xfrm/xfrm_user.c) in the Linux operating system allows a perpetrator to increase their privileges or cause service failures.

The vulnerability of the XFRM dump policy implementation net/xfrm/xfrmuser.c in the Linux operating system is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to increase their privileges or cause a service failure the use of resources after they...

CVE-2017-17712

A flaw was found in the Linux kernel's implementation of rawsendmsg allowing a local attacker to panic the kernel or possibly leak kernel addresses. A local attacker, with the privilege of creating raw sockets, can abuse a possible race condition when setting the socket option to allow the kernel...

MacOS/iOS kernel double free due to incorrect API usage in flow divert socket option handling(CVE-2017-13867)

SOFLOWDIVERTTOKEN is a socket option on the SOLSOCKETlayer. It's implemented by flowdiverttokensetstruct socket so, struct sockopt sopt in flowdivert.c. The relevant code is: error = sooptgetmsopt, &token; if error goto done; error = sooptmcopyinsopt, token; if error goto done; ... done: if token...

macOS / iOS - Kernel Double Free due to Incorrect API Usage in Flow Divert Socket Option Handling

Exploit for multiple platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1373 SOFLOWDIVERTTOKEN is a socket option on the SOLSOCKET layer. It's implemented by flowdiverttokensetstruct socket so, struct sockopt sopt in flowdivert.c. The relevant code is...

Apple macOS/iOS - Kernel Double Free due to Incorrect API Usage in Flow Divert Socket Option Handling

/ Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1373 SOFLOWDIVERTTOKEN is a socket option on the SOLSOCKET layer. It's implemented by flowdiverttokensetstruct socket so, struct sockopt sopt in flowdivert.c. The relevant code is: error = sooptgetmsopt, &token; if error goto don...

USN-3385-2: Linux kernel (Xenial HWE) vulnerabilities

USN-3385-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement HWE kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS. Andrey Konovalov discovered a race condition in the UDP Fragmentation Offload UFO code...

USN-3384-2: Linux kernel (HWE) vulnerabilities

USN-3384-1 fixed vulnerabilities in the Linux kernel for Ubuntu 17.04. This update provides the corresponding updates for the Linux Hardware Enablement HWE kernel from Ubuntu 17.04 for Ubuntu 16.04 LTS. Andrey Konovalov discovered a race condition in the UDP Fragmentation Offload UFO code in the...

USN-3385-1: Linux kernel vulnerabilities

Andrey Konovalov discovered a race condition in the UDP Fragmentation Offload UFO code in the Linux kernel. A local attacker could use this to cause a denial of service or execute arbitrary code. CVE-2017-1000112 Andrey Konovalov discovered a race condition in AFPACKET socket option handling code...