CVE-2013-7267

CVE-2013-7267 (Linux kernel) : Affected component is the atalk_recvmsg function in net/appletalk/ddp.c, vulnerable before 3.12.4. The bug updates a length value without ensuring the associated data structure is initialized, enabling local attackers to leak kernel memory via recvfrom, recvmmsg, or...

CVE-2014-5206

CVE-2014-5206 : In Linux kernel versions up to 3.16.1, the do_remount function in fs/namespace.c fails to preserve the MNT_LOCK_READONLY flag across remounts of bind mounts. This allows a local user to bypass the intended read-only restriction by using a mount -o remount within a user namespace, ...

CVE-2014-3182

CVE-2014-3182 affects the Linux kernel up to version 3.16.1, where an array index error in the logi_dj_raw_event function of drivers/hid/hid-logitech-dj.c can be exploited by a physically proximate attacker using a malformed REPORT_TYPE_NOTIF_DEVICE_UNPAIRED value to execute arbitrary code or cau...

CVE-2014-3631

The CVE-2014-3631 issue affects the Linux kernel before 3.16.3, specifically the assoc_array_gc path in lib/assoc_array.c. A bug in the garbage collection allows a local attacker to trigger a NULL pointer dereference, leading to a denial of service (system crash). Affected component: kernel garba...

CVE-2014-2039

CVE-2014-2039 affects the Linux kernel on s390 where arch/s390/kernel/head64.S mishandles attempts to use the linkage stack, enabling local users to crash the system (denial of service) by executing a crafted instruction. The linked Nessus/MiracleUnity/EulerOS advisories confirm the issue exists ...

CVE-2014-3186

CVE-2014-3186 : A buffer overflow in the PicoLCD HID device driver’s picoLCD_raw_event (Linux kernel driver, hid-picolcd_core.c) up to kernel 3.16.3 allows physically proximate attackers to crash the system or potentially execute arbitrary code by sending a crafted large HID report, as used in An...

CVE-2014-3535

CVE-2014-3535 affects the Linux kernel prior to 2.6.36, specifically the include/linux/netdevice.h logging macros. The root cause is incorrect use of macros for netdev_printk, enabling a remote attacker to trigger a NULL pointer dereference and system crash by sending invalid packets to a VxLAN i...

CVE-2013-7269

The CVE-2013-7269 vulnerability affects the Linux kernel (affected area: net/netrom/af_netrom.c) before 3.12.4. The issue arises when nr_recvmsg updates a length value without ensuring the associated data structure is initialized, enabling local attackers to read kernel memory via recvfrom, recvm...

CVE-2014-4322

CVE-2014-4322 affects the Linux kernel 3.x QSEECOM driver. The qseecom.c ioctl logic does not validate certain offset, length, and base values, enabling a crafted application to escalate privileges or trigger memory corruption. Affected component: drivers/misc/qseecom.c in the QSEECOM driver used...

CVE-2014-7843

The CVE-2014-7843 entry affects the Linux kernel on ARM64 and is caused by the __clear_user function in arch/arm64/lib/clear_user.S. It allows local attackers to trigger a denial of service (system crash) by reading one byte beyond a /dev/zero page boundary in kernels prior to 3.17.4. Public refe...

CVE-2013-7271

The CVE-2013-7271 issue affects the Linux kernel up to versions before 3.12.4. The vulnerability exists in x25_recvmsg (net/x25/af_x25.c), where a length value is updated without ensuring the associated data structure is initialized, enabling local attackers to disclose kernel memory content via ...

CVE-2014-7283

The vulnerability CVE-2014-7283 affects the Linux kernel xfs implementation: xfs_da3_fixhashpath in fs/xfs/xfs_da_btree.c fails to compare btree hash values correctly, before 3.14.2. This can allow local users to trigger filesystem corruption and OOPs/panic via operations on directories with hash...

CVE-2013-7268

The CVE-2013-7268 vulnerability affects the Linux kernel up to version 3.12.3, where ipx_recvmsg in net/ipx/af_ipx.c writes a length value without confirming the associated data structure is initialized. This can allow local attackers to read kernel memory via recvfrom/recvmmsg/recvmsg. The issue...

CVE-2014-2673

CVE-2014-2673 : Linux kernel TM implementation on PowerPC has a flaw in arch_dup_task_struct interacting with clone/fork. In kernels before 3.13.7, this can allow a local user to trigger a denial of service (Program Check and system crash) by executing instructions while the processor is in Trans...

CVE-2011-2909

Summary (CVE-2011-2909): The Linux kernel (do_devinfo_ioctl in drivers/staging/comedi/comedi_fops.c) before 3.1 allows local users to leak sensitive kernel memory content through a copy of a short string. This is described as an information leak in the kernel staging area. Impact is local confide...

CVE-2014-5045

CVE-2014-5045 – Linux kernel mountpoint_last bug (pre-3.15.8) Affected: Linux kernel versions prior to 3.15.8.Root cause: The mountpoint_last function in fs/namei.c does not properly maintain a reference count when unmount is used in conjunction with a symlink.Impact: Local users could cause deni...

CVE-2014-8480

CVE-2014-8480 affects the Linux kernel KVM subsystem: the instruction decoder in arch/x86/kvm/emulate.c lacks intended decoder-table flags for certain RIP-relative instructions. This can allow a guest OS user to trigger a NULL pointer dereference and crash the host OS (denial of service). The vul...

CVE-2014-7284

CVE-2014-7284 affects the Linux kernel’s net_get_random_once in net/core/utils.c for 3.13.x and 3.14.x before 3.14.5 on certain Intel CPUs. The issue is that the slow-path to seed randomness is not executed, increasing predictability of TCP sequence numbers, TCP/UDP port numbers, and IP ID values...

CVE-2014-8481

CVE-2014-8481 affects the Linux kernel KVM arch/x86/kvm/emulate.c; the instruction decoder mishandles invalid instructions, allowing guest OS users to trigger a NULL pointer dereference and host crash via a crafted application that either fetches an invalid instruction or uses too many bytes. Roo...

CVE-2014-4157

CVE-2014-4157 affects the Linux kernel on MIPS up to 3.14.8. The fast system-call path does not configure _TIF_SECCOMP checks, letting local attackers bypass PR_SET_SECCOMP restrictions by running a crafted app without trace/audit. Impact: partial confidentiality, integrity, and availability (loc...

CVE-2014-7207

CVE-2014-7207 affects the Linux kernel IPv6 implementation (3.2.x–3.2.63). The issue stems from improper validation in ipv6_select_ident function calls, permitting local users to trigger a NULL pointer dereference and system crash via tun or macvtap device access. Connected advisories confirm Deb...

CVE-2014-6417

CVE-2014-6417 affects net/ceph/auth_x.c in Ceph usage within the Linux kernel prior to 3.16.3. The issue arises from not handling kmalloc failure, enabling a remote attacker to cause a denial of service (system crash) or potentially other impact via a long unencrypted auth ticket. Public advisori...

CVE-2013-7348

CVE-2013-7348 describes a double free vulnerability in the Linux kernel’s ioctx_alloc (fs/aio.c) prior to 3.12.4. An error path in aio_setup_ring can lead to a use-after-free like condition that enables a local attacker to trigger a system crash (DoS) or potentially other impact. The cited public...

CVE-2014-6418

Summary of CVE-2014-6418 — firmware/driver component: In Ceph usage within the Linux kernel, net/ceph/auth_x.c handles auth replies and, prior to kernel 3.16.3, fails to properly validate them. This can be triggered by crafted data arriving from a Ceph Monitor IP address, potentially causing a de...

CVE-2014-4323

The CVE-2014-4323 issue affects the Linux kernel 3.x MDP display driver (mdp_lut_hw_update in drivers/video/msm/mdp.c) used in Qualcomm QuIC Android MSM contributions. The vulnerability stems from insufficient validation of certain start and length values in an ioctl call, enabling privilege esca...

CVE-2014-0102

CVE-2014-0102 affects the Linux kernel up to version 3.13.6. The vulnerability is in the function keyring_detect_cycle_iterator (security/keys/keyring.c), which does not correctly determine whether keyrings are identical. This can allow local users to cause a denial of service (OOPS) by issuing c...

CVE-2014-3183

CVE-2014-3183 is a heap-based buffer overflow in the Linux kernel driver HID Logitech DJ (logi-dj_ll_raw_request in drivers/hid/hid-logitech-dj.c) exposed when a device reports a large LED report. Affected kernel versions are earlier than 3.16.2. This allows physically proximate attackers to caus...

CVE-2014-2739

The CVE-2014-2739 issue affects Linux kernel 3.14.x–3.14.1, specifically the cma_req_handler in drivers/infiniband/core/cma.c. The root cause is an incorrect pointer dereference when resolving a RoCE address already resolved in a different module, which can lead to a denial of service via crafted...

CVE-2014-2889

CVE-2014-2889 describes an off-by-one error in the Linux kernel's x86 BPF JIT path. Specifically, in arch/x86/net/bpf_jit_comp.c (function bpf_jit_compile) for kernel versions prior to 3.1.8, if BPF JIT is enabled an off-by-one condition can allow a local user to trigger a denial of service (syst...