Vulnerabilidades do Linux Linux Kernel

CVE-2021-34866 Alta · 7.8 CWE-843 25/01/2022

This vulnerability allows local attackers to escalate privileges on affected installations of...

This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel 5.14-rc3. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of eBPF programs. The issue results from the lack of proper validation of user-supplied eBPF programs, which can result in a type confusion condition. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the kernel. Was ZDI-CAN-14689.

CVE-2021-4001 Média · 4.1 CWE-367 21/01/2022

A race condition was found in the Linux kernel's ebpf verifier between bpf_map_update_elem and...

A race condition was found in the Linux kernel's ebpf verifier between bpf_map_update_elem and bpf_map_freeze due to a missing lock in kernel/bpf/syscall.c. In this flaw, a local user with a special privilege (cap_sys_admin or cap_bpf) can modify the frozen mapped address space. This flaw affects kernel versions prior to 5.16 rc2.

CVE-2021-0920 Média · 6.4 KEV Alta · 47 CWE-362 15/12/2021

Android Kernel Race Condition Vulnerability

In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-196926917References: Upstream kernel

CVE-2021-43975 Média · 6.7 CWE-787 17/11/2021

Out-of-bounds Write em Linux Linux Kernel

In the Linux kernel through 5.15.2, hw_atl_utils_fw_rpc_wait in drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c allows an attacker (who can introduce a crafted device) to trigger an out-of-bounds write via a crafted length value.

CVE-2021-38202 Alta · 7.5 CWE-125 08/08/2021

fs/nfsd/trace.h in the Linux kernel before 5.13.4 might allow remote attackers to cause a denial...

fs/nfsd/trace.h in the Linux kernel before 5.13.4 might allow remote attackers to cause a denial of service (out-of-bounds read in strlen) by sending NFS traffic when the trace event framework is being used for nfsd.

CVE-2021-38206 Média · 5.5 CWE-476 08/08/2021

The mac80211 subsystem in the Linux kernel before 5.12.13, when a device supporting only 5 GHz is...

The mac80211 subsystem in the Linux kernel before 5.12.13, when a device supporting only 5 GHz is used, allows attackers to cause a denial of service (NULL pointer dereference in the radiotap parser) by injecting a frame with 802.11a rates.

CVE-2021-38199 Média · 6.5 08/08/2021

fs/nfs/nfs4client.c in the Linux kernel before 5.13.4 has incorrect connection-setup ordering,...

fs/nfs/nfs4client.c in the Linux kernel before 5.13.4 has incorrect connection-setup ordering, which allows operators of remote NFSv4 servers to cause a denial of service (hanging of mounts) by arranging for those servers to be unreachable during trunking detection.

CVE-2021-38198 Média · 5.5 08/08/2021

arch/x86/kvm/mmu/paging_tmpl.h in the Linux kernel before 5.12.11 incorrectly computes the access...

arch/x86/kvm/mmu/paging_tmpl.h in the Linux kernel before 5.12.11 incorrectly computes the access permissions of a shadow page, leading to a missing guest protection page fault.

CVE-2021-38166 Alta · 7.8 CWE-190 07/08/2021

In kernel/bpf/hashtab.c in the Linux kernel through 5.13.8, there is an integer overflow and out...

In kernel/bpf/hashtab.c in the Linux kernel through 5.13.8, there is an integer overflow and out-of-bounds write when many elements are placed in a single bucket. NOTE: exploitation might be impractical without the CAP_SYS_ADMIN capability.

CVE-2021-3655 Baixa · 3.3 CWE-20 05/08/2021

Improper Input Validation em Linux Linux Kernel

A vulnerability was found in the Linux kernel in versions prior to v5.14-rc1. Missing size validations on inbound SCTP packets may allow the kernel to read uninitialized memory.

CVE-2021-34556 Média · 5.5 CWE-203 02/08/2021

In the Linux kernel through 5.13.7, an unprivileged BPF program can obtain sensitive information...

In the Linux kernel through 5.13.7, an unprivileged BPF program can obtain sensitive information from kernel memory via a Speculative Store Bypass side-channel attack because the protection mechanism neglects the possibility of uninitialized memory locations on the BPF stack.

CVE-2021-35477 Média · 5.5 CWE-203 02/08/2021

In the Linux kernel through 5.13.7, an unprivileged BPF program can obtain sensitive information...

In the Linux kernel through 5.13.7, an unprivileged BPF program can obtain sensitive information from kernel memory via a Speculative Store Bypass side-channel attack because a certain preempting store operation does not necessarily occur before a store operation that has an attacker-controlled value.

CVE-2021-37159 Média · 6.4 CWE-415 21/07/2021

Double Free em Linux Linux Kernel

hso_free_net_device in drivers/net/usb/hso.c in the Linux kernel through 5.13.4 calls unregister_netdev without checking for the NETREG_REGISTERED state, leading to a use-after-free and a double free.

CVE-2021-22555 Alta · 7.8 KEV Urgente · 76 Exploit público CWE-787 07/07/2021

Escrita fora dos limites em heap no kernel Linux (x_tables)

Uma escrita fora dos limites em heap afetando o Linux desde v2.6.19-rc1 foi descoberta em net/netfilter/x_tables.c. Isso permite que um atacante obtenha privilégios ou cause um DoS (por meio de corrupção de memória heap) através de user name space

CVE-2020-28097 Média · 5.9 CWE-125 24/06/2021

The vgacon subsystem in the Linux kernel before 5.8.10 mishandles software scrollback. There is a...

The vgacon subsystem in the Linux kernel before 5.8.10 mishandles software scrollback. There is a vgacon_scrolldelta out-of-bounds read, aka CID-973c096f6a85.

CVE-2021-33624 Média · 4.7 CWE-843 23/06/2021

In kernel/bpf/verifier.c in the Linux kernel before 5.12.13, a branch can be mispredicted (e.g.,...

In kernel/bpf/verifier.c in the Linux kernel before 5.12.13, a branch can be mispredicted (e.g., because of type confusion) and consequently an unprivileged BPF program can read arbitrary memory locations via a side-channel attack, aka CID-9183671af6db.

CVE-2021-34693 Média · 5.5 CWE-909 14/06/2021

net/can/bcm.c in the Linux kernel through 5.12.10 allows local users to obtain sensitive...

net/can/bcm.c in the Linux kernel through 5.12.10 allows local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized.

CVE-2020-24588 Baixa · 3.5 CWE-327 11/05/2021

The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired...

The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that the A-MSDU flag in the plaintext QoS header field is authenticated. Against devices that support receiving non-SSP A-MSDU frames (which is mandatory as part of 802.11n), an adversary can abuse this to inject arbitrary network packets.

CVE-2020-36311 Média · 5.5 06/04/2021

An issue was discovered in the Linux kernel before 5.9. arch/x86/kvm/svm/sev.c allows…

An issue was discovered in the Linux kernel before 5.9. arch/x86/kvm/svm/sev.c allows attackers to cause a denial of service (soft lockup) by triggering destruction of a large SEV VM (which requires unregistering many encrypted regions), aka CID-7be74942f184.

CVE-2021-28972 Média · 6.7 CWE-120 22/03/2021

Classic Buffer Overflow em Linux Linux Kernel

In drivers/pci/hotplug/rpadlpar_sysfs.c in the Linux kernel through 5.11.8, the RPA PCI Hotplug driver has a user-tolerable buffer overflow when writing a new device name to the driver from userspace, allowing userspace to write data to the kernel stack frame directly. This occurs because add_slot_store and remove_slot_store mishandle drc_name '\0' termination, aka CID-cc7a0bb058b8.

CVE-2020-27171 Média · 6.0 CWE-193 20/03/2021

An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c has an…

An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c has an off-by-one error (with a resultant integer underflow) affecting out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory, aka CID-10d2bb2e6b1d.

CVE-2020-27170 Média · 4.7 CWE-203 20/03/2021

Observable Discrepancy em Linux Linux Kernel

An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c performs undesirable out-of-bounds speculation on pointer arithmetic, leading to side-channel attacks that defeat Spectre mitigations and obtain sensitive information from kernel memory, aka CID-f232326f6966. This affects pointer types that do not define a ptr_limit.

CVE-2020-25639 Média · 4.4 CWE-476 04/03/2021

NULL Pointer Dereference em Linux Linux Kernel

A NULL pointer dereference flaw was found in the Linux kernel's GPU Nouveau driver functionality in versions prior to 5.12-rc1 in the way the user calls ioctl DRM_IOCTL_NOUVEAU_CHANNEL_ALLOC. This flaw allows a local user to crash the system.

CVE-2020-29374 Baixa · 3.6 CWE-362 28/11/2020

Race Condition em Linux Linux Kernel

An issue was discovered in the Linux kernel before 5.7.3, related to mm/gup.c and mm/huge_memory.c. The get_user_pages (aka gup) implementation, when used for a copy-on-write page, does not properly consider the semantics of read operations and therefore can grant unintended write access, aka CID-17839856fd58.

CVE-2020-14390 Média · 5.6 CWE-787 18/09/2020

Out-of-bounds Write em Linux Linux Kernel

A flaw was found in the Linux kernel in versions before 5.9-rc6. When changing screen size, an out-of-bounds memory write can occur leading to memory corruption or a denial of service. Due to the nature of the flaw, privilege escalation cannot be fully ruled out.