kernel security and bug fix update

3.10.0-1160.59.1.OL7 - Update Oracle Linux certificates Ilya Okomin - Oracle Linux RHCK Module Signing Key was compiled into kernel [email protected] - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and shim-x64 = 15-2.0.9 - Update oraclekernel-sig-key...

Use After Free

A vulnerability was found in the vmwgfx driver that allows unprivileged users to gain access to files opened by other processes on the system through a dangling 'file' pointer. Exploiting this vulnerability requires an attacker to have access to either /dev/dri/card0 or /dev/dri/rendererD128 and ...

kernel: failing usercopy allows for use-after-free exploitation

A use-after-free flaw was found in the Linux kernel’s vmwexecbufcopyfenceuser function in drivers/gpu/drm/vmwgfx/vmwgfxexecbuf.c in vmwgfx. This flaw allows a local attacker with user privileges to cause a privilege escalation problem...

kernel: failing usercopy allows for use-after-free exploitation

A use-after-free flaw was found in the Linux kernel’s vmwexecbufcopyfenceuser function in drivers/gpu/drm/vmwgfx/vmwgfxexecbuf.c in vmwgfx. This flaw allows a local attacker with user privileges to cause a privilege escalation problem...

kernel: failing usercopy allows for use-after-free exploitation

A use-after-free flaw was found in the Linux kernel’s vmwexecbufcopyfenceuser function in drivers/gpu/drm/vmwgfx/vmwgfxexecbuf.c in vmwgfx. This flaw allows a local attacker with user privileges to cause a privilege escalation problem...

Ubuntu 20.04 LTS : Linux kernel vulnerabilities (USN-5295-2)

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5295-2 advisory. It was discovered that the Packet network protocol implementation in the Linux kernel contained a double- free vulnerability. A local attacker could use...

Ubuntu 18.04 LTS / 20.04 LTS : Linux kernel (GKE) vulnerabilities (USN-5297-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5297-1 advisory. Szymon Heidrich discovered that the USB Gadget subsystem in the Linux kernel did not properly restrict the size of control requests for certa...

Ubuntu 18.04 LTS / 20.04 LTS : Linux kernel vulnerabilities (USN-5294-2)

The remote Ubuntu 18.04 LTS / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5294-2 advisory. It was discovered that the Packet network protocol implementation in the Linux kernel contained a double- free vulnerability. A local attacke...

GSD-2022-1000239 drm/vmwgfx: Fix stale file descriptors on failed usercopy

drm/vmwgfx: Fix stale file descriptors on failed usercopy This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.18 by commit...

GSD-2022-1000180 drm/vmwgfx: Fix stale file descriptors on failed usercopy

drm/vmwgfx: Fix stale file descriptors on failed usercopy This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.95 by commit...

GSD-2022-1000146 drm/vmwgfx: Fix stale file descriptors on failed usercopy

drm/vmwgfx: Fix stale file descriptors on failed usercopy This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.175 by commit...

GSD-2022-1000119 drm/vmwgfx: Fix stale file descriptors on failed usercopy

drm/vmwgfx: Fix stale file descriptors on failed usercopy This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.227 by commit...

GSD-2022-1000095 drm/vmwgfx: Fix stale file descriptors on failed usercopy

drm/vmwgfx: Fix stale file descriptors on failed usercopy This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.264 by commit...

Ubuntu 20.04 LTS : Linux kernel vulnerabilities (USN-5294-1)

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5294-1 advisory. It was discovered that the Packet network protocol implementation in the Linux kernel contained a double- free vulnerability. A local attacker could use...

OESA-2022-1517 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: A double free bug in packetsetring in net/packet/afpacket.c can be exploited by a local user through crafted syscalls to escalate privileges or deny service. We recommend upgrading kernel past the effected versions or rebuilding...

Vulnerability of the vmw_execbuf_copy_fence_user() function (drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c) in the vmwgfx module of Linux kernel, allowing an attacker to increase their privileges

The vulnerability of the vmwexecbufcopyfenceuser function drivers/gpu/drm/vmwgfx/vmwgfxexecbuf.c in the vmwgfx module of Linux operating systems is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to increase their privileges...

Updated kernel-linus packages fix security vulnerabilities

This kernel-linus update is based on upstream 5.15.18 and fixes at least the following security issues: A random memory access flaw was found in the Linux kernels GPU i915 kernel driver functionality in the way a user may run malicious code on the GPU. This flaw allows a local user to crash the...

UBUNTU-CVE-2022-22942

The vmwgfx driver contains a local privilege escalation vulnerability that allows unprivileged users to gain access to files opened by other processes on the system through a dangling 'file' pointer...

CVE-2022-22942

The vmwgfx driver contains a local privilege escalation vulnerability that allows unprivileged users to gain access to files opened by other processes on the system through a dangling 'file' pointer...

vmwgfx Driver File Descriptor Handling Priv Esc

If the vmwgfx driver fails to copy the 'fencerep' object to userland, it tries to recover by deallocating the already populated file descriptor. This is wrong, as the fd gets released via putunusedfd which shouldn't be used, as the fd table slot was already populated via the previous call to...