1235 matches found
webhook-cve-2022-0811
webhook-cve-2022-0811 This is a really simple webhook that just blocks pod creation if malicious sysctl values are configured. Build go test CGOENABLED=0 GOOS=linux GOARCH=amd64 GO111MODULE=on go build Build image an deploy in Minikube Start minikube: minikube start minikube addons enable registr...
POC-2020-8558
概述 CVE-2020-8558 是一个 Kubernetes 漏洞，它之所以被公布，是因为 kube-proxy 意外地 让绑定到 localhost 的主机服务对网络上的其他节点可用。我特意强调"意外地"，是因为这个漏洞源于设计缺陷（疏忽），而非实现缺陷（bug）。代码确实做了它声称要做的事，但我们所有人都未能认识到这一决定的安全影响。 为了让主机进程能够通过 127.0.0.1（localhost）地址访问 NodePort 服务，kube-proxy 会设置 net.ipv4.conf.all.routelocalnet=1 这个 sysctl...
CVE-2026-97420
A flaw was found in the Linux kernel's BPF Berkeley Packet Filter subsystem. When a BPF program modifies a system control sysctl parameter, the kernel fails to append a null-terminating byte to the replacement buffer. Downstream kernel parsers expecting a properly terminated string may read past...
SUSE CVE-2026-97420
In the Linux kernel, the following vulnerability has been resolved: bpf: NUL-terminate replaced sysctl value When writing to sysctls, procsyscallhandler guarantees that the buffer passed to proc handlers is NUL-terminated. If bpfsysctlsetnewvalue replaces the pending sysctl value, it can hand a...
CVE-2026-97420
In the Linux kernel, the following vulnerability has been resolved: bpf: NUL-terminate replaced sysctl value When writing to sysctls, procsyscallhandler guarantees that the buffer passed to proc handlers is NUL-terminated. If bpfsysctlsetnewvalue replaces the pending sysctl value, it can hand a...
AZL-103875 CVE-2026-97420 affecting package kernel 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: bpf: NUL-terminate replaced sysctl value When writing to sysctls, procsyscallhandler guarantees that the buffer passed to proc handlers is NUL-terminated. If bpfsysctlsetnewvalue replaces the pending sysctl value, it can hand a...
UBUNTU-CVE-2026-97420
In the Linux kernel, the following vulnerability has been resolved: bpf: NUL-terminate replaced sysctl value When writing to sysctls, procsyscallhandler guarantees that the buffer passed to proc handlers is NUL-terminated. If bpfsysctlsetnewvalue replaces the pending sysctl value, it can hand a...
CVE-2026-97420 bpf: NUL-terminate replaced sysctl value
In the Linux kernel, the following vulnerability has been resolved: bpf: NUL-terminate replaced sysctl value When writing to sysctls, procsyscallhandler guarantees that the buffer passed to proc handlers is NUL-terminated. If bpfsysctlsetnewvalue replaces the pending sysctl value, it can hand a...
CVE-2026-97420
The Linux kernel contains a vulnerability in the BPF subsystem where the function bpf_sysctl_set_new_value() fails to append a NUL terminator when replacing a pending sysctl value. This oversight occurs because the helper only copies buf_len bytes, potentially leading to out-of-bounds access in d...
EUVD-2026-86033
In the Linux kernel, the following vulnerability has been resolved: bpf: NUL-terminate replaced sysctl value When writing to sysctls, procsyscallhandler guarantees that the buffer passed to proc handlers is NUL-terminated. If bpfsysctlsetnewvalue replaces the pending sysctl value, it can hand a...
CVE-2026-97420 bpf: NUL-terminate replaced sysctl value
In the Linux kernel, the following vulnerability has been resolved: bpf: NUL-terminate replaced sysctl value When writing to sysctls, procsyscallhandler guarantees that the buffer passed to proc handlers is NUL-terminated. If bpfsysctlsetnewvalue replaces the pending sysctl value, it can hand a...
CVE-2026-97420
In the Linux kernel, the following vulnerability has been resolved: bpf: NUL-terminate replaced sysctl value When writing to sysctls, procsyscallhandler guarantees that the buffer passed to proc handlers is NUL-terminated. If bpfsysctlsetnewvalue replaces the pending sysctl value, it can hand a...
Linux Distros Unpatched Vulnerability : CVE-2026-97420
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: NUL-terminate replaced sysctl value When writing to sysctls, procsyscallhandler guarantees that the buffer passed to proc handlers is NUL-terminated. If...
PT-2026-98054
In the Linux kernel, the following vulnerability has been resolved: bpf: NUL-terminate replaced sysctl value When writing to sysctls, proc sys call handler guarantees that the buffer passed to proc handlers is NUL-terminated. If bpf sysctl set new value replaces the pending sysctl value, it can...
CVE-2026-97420: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: bpf: NUL-terminate replaced sysctl value When writing to sysctls, procsyscallhandler guarantees that the buffer passed to proc handlers is NUL-terminated. If bpfsysctlsetnewvalue replaces the pending sysctl value, it can hand a...
Astra Linux – Vulnerability in Linux 5.10, Linux
In the Linux kernel, the following vulnerability has been resolved: TCP: Fixed a data race around the sysctltcpprobeinterval variable. When reading sysctltcpprobeinterval, it can be changed concurrently. Therefore, we need to add READONCE to its reader function...
Astra Linux – Vulnerability in Linux 5.10, Linux
In the Linux kernel, the following vulnerability has been resolved: TCP: Fixed a data race around sysctltcpearlyretrans. When reading sysctltcpearlyretrans, it can be changed concurrently. Therefore, we need to add READONCE to its reader function...
Astra Linux – Vulnerability in Linux 5.10, Linux
In the Linux kernel, the following vulnerability has been resolved: TCP: Fixed issues related to data races around sysctltcprecovery. When reading sysctltcprecovery, it can be changed concurrently. Therefore, we need to add READONCE to its readers...
Astra Linux – Vulnerability in Linux 5.10, Linux
In the Linux kernel, the following vulnerability has been resolved: arm64: The issue was fixed in the concurrently setting of insnemulation sysctls. The emulationprochandler function changes table-data for procdointvecminmax. However, it may cause an OOPs error if called concurrently with itself:...
Astra Linux – Vulnerability in Linux 5.10, Linux
In the Linux kernel, the following vulnerability has been resolved: TCP: Fixed a data race around sysctltcpmtuprobefloor. When reading sysctltcpmtuprobefloor, it can be changed concurrently. Therefore, we need to add READONCE to its reader...