Linux kernel vulnerabilities

The tpacket_rcv function in the Linux kernel before version 4.13 mishandles vnet headers, which might allow local users to cause a denial of service through buffer overflow and disk and memory corruption.

The driver_override implementation in the Linux kernel before version 4.12.1 allows local users to gain privileges by leveraging a race condition between a read operation and a store operation involving different overrides.

The sanity_check_ckpt function in the Linux kernel before version 4.12.4 does not validate the blkoff and segno arrays, allowing local users to gain privileges via unspecified vectors.

The sanity_check_raw_super function in the Linux kernel before version 4.11.1 does not validate the segment count, allowing local users to gain privileges via unspecified vectors.

A race condition in the Linux kernel before version 4.10.15 in fs/timerfd.c allows local users to gain privileges or cause a denial of service through simultaneous file-descriptor operations.

The mq_notify function in the Linux kernel through version 4.11.9 does not set the sock pointer to NULL upon entry into the retry logic. This may lead to use-after-free vulnerabilities or other unspecified impacts.

The offset2lib patch in the Linux Kernel contains a vulnerability that allows a PIE binary to be execve()'d with 1GB of arguments or environmental strings, leading to the stack occupying the address 0x80000000. The PIE binary is mapped above 0x40000000, nullifying the protection of the offset2lib patch.

The Linux Kernel imposes a size restriction on the arguments and environmental strings passed through RLIMIT_STACK/RLIM_INFINITY, but does not take the argument and environment pointers into account, allowing attackers to bypass this limitation. This affects Linux Kernel versions 4.11.5 and earlier.

An issue was discovered in the size of the stack guard page on Linux. A 4k stack guard page is not sufficiently large and can be 'jumped' over, affecting Linux Kernel versions 4.11.5 and earlier.

The tcp_v6_syn_recv_sock function in the Linux kernel through version 4.11.1 mishandles inheritance, allowing local users to cause a denial of service or possibly have unspecified other impact via crafted system calls.

The dccp_v6_request_recv_sock function in the Linux kernel through version 4.11.1 mishandles inheritance, allowing local users to cause a denial of service or possibly have unspecified other impact via crafted system calls.

The sctp_v6_create_accept_sk function in the Linux kernel through version 4.11.1 mishandles inheritance, allowing local users to cause a denial of service or possibly have unspecified other impact via crafted system calls.

The IPv6 fragmentation implementation in the Linux kernel through version 4.11.1 does not consider that the nexthdr field may be associated with an invalid option. This allows local users to cause a denial of service (out-of-bounds read and BUG) or possibly have unspecified other impact via crafted socket and send system calls.

The ipxitf_ioctl function in the Linux kernel through version 4.11.1 mishandles reference counts, allowing local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via a failed SIOCGIFADDR ioctl call for an IPX interface.

The inet_csk_clone_lock function in the Linux kernel up to version 4.10.15 allows attackers to cause a denial of service (double free) or possibly have unspecified other impact by leveraging the accept system call.

The Linux kernel before version 3.19 has a flaw in counter grouping handling, allowing local users to gain elevated privileges via a crafted application.

The regulator_ena_gpio_free function in the Linux kernel before version 3.19 allows local users to gain privileges or cause a denial of service (use-after-free) via a crafted application.

The packet_set_ring function in the Linux kernel through version 4.10.6 does not properly validate certain block-size data, potentially leading to denial of service or privilege escalation by local users.

A race condition in the Linux kernel up to version 4.10.2 in kernel/ucount.c allows local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via crafted system calls.

The ip_cmsg_recv_checksum function in the Linux kernel before version 4.10.1 has incorrect expectations about skb data layout, allowing local users to cause a denial of service (buffer over-read) or potentially have unspecified other impact via crafted system calls.

A race condition in the Linux kernel before version 4.9.13 in net/packet/af_packet.c allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via a multithreaded application making PACKET_FANOUT setsockopt system calls.

The LLC subsystem in the Linux kernel before version 4.9.13 does not ensure that a certain destructor exists in required circumstances, allowing local users to cause a denial of service (BUG_ON) or possibly have unspecified other impact via crafted system calls.

The do_shmat function in the Linux kernel through version 4.9.12 does not restrict the address calculated by a certain rounding operation, allowing local users to map page zero. This enables bypassing a protection mechanism for the mmap system call.

The tcp_splice_read function in the Linux kernel before version 4.9.11 allows remote attackers to cause a denial of service through the use of a TCP packet with the URG flag, leading to an infinite loop and soft lockup.

The dccp_rcv_state_process function in the Linux kernel through version 4.9.11 mishandles DCCP_PKT_REQUEST packet data structures in the LISTEN state, allowing local users to obtain root privileges or cause a denial of service (double free) via an application making an IPV6_RECVPKTINFO setsockopt system call.

A race condition in the Linux kernel before version 4.9.7 in kernel/events/core.c allows local users to gain privileges via a crafted application making concurrent perf_event_open system calls to move a software group into a hardware context.

The TCP stack in the Linux kernel 3.x does not properly implement a SYN cookie protection mechanism for the case of a fast network connection, allowing remote attackers to cause a denial of service (CPU consumption) by sending many TCP SYN packets.

The ipv4_pktinfo_prepare function in the Linux kernel through version 4.9.9 allows attackers to cause a system crash via crafted system calls or possibly IPv4 traffic with invalid IP options.

The aio_mount function in the Linux kernel before version 4.7.7 does not properly restrict execute access, allowing local users to bypass intended SELinux W^X policy restrictions and gain privileges via an io_setup system call.

A race condition in the ip4_datagram_release_cb function in the Linux kernel before version 3.15.2 allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging incorrect expectations about locking during multithreaded access to internal data structures for IPv4 UDP sockets.

The freelist-randomization feature in mm/slab.c in the Linux kernel 4.8.x and 4.9.x before 4.9.5 allows local users to cause a denial of service (duplicate freelist entries and system crash) or possibly have unspecified other impact in opportunistic circumstances by leveraging the selection of a large value for a random number.

The Linux kernel through version 4.9.3 has a vulnerability that allows local users to obtain sensitive information from kernel memory or cause a denial of service (use-after-free) via a crafted application leveraging instruction emulation for fxrstor, fxsave, sgdt, and sidt.

A race condition in the netlink_dump function in the Linux kernel before version 4.6.3 allows local users to cause a denial of service (double free) or possibly have unspecified other impact via a crafted application that makes sendmsg system calls, leading to an unexpected free operation.

The sock_setsockopt function in the Linux kernel before version 4.8.14 mishandles negative values of sk_sndbuf and sk_rcvbuf. This can lead to system crashes or memory corruption by local users leveraging the CAP_NET_ADMIN capability.

The blk_rq_map_user_iov function in the Linux kernel before version 4.8.14 does not properly restrict the type of iterator, allowing local users to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging access to a /dev/sg device.

The sock_setsockopt function in the Linux kernel before version 3.5 mishandles negative values of sk_sndbuf and sk_rcvbuf. This allows local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact.

In the Linux kernel before version 4.0, a vulnerability allows local users to bypass the 'strict page permissions' protection mechanism and modify the system-call table, potentially gaining elevated privileges.

In the Linux kernel before version 4.4, there is a vulnerability that allows local users to gain elevated privileges via crafted F_OFD_GETLK, F_OFD_SETLK, or F_OFD_SETLKW commands in an fcntl64 system call.

The icmp6_send function in the Linux kernel up to version 4.8.12 omits a certain check of the dst data structure, allowing remote attackers to cause a denial of service (panic) via a fragmented IPv6 packet.

In the Linux kernel before version 4.8.7, there is an issue with mishandling unsuccessful crypto registration in conjunction with successful key-type registration. This can lead to denial of service (NULL pointer dereference and panic) or possibly other unspecified impacts via a crafted application using the big_key data type.

The tipc_msg_build function in the Linux kernel through version 4.8.11 does not validate the relationship between the minimum fragment length and the maximum packet size, which can lead to a heap-based buffer overflow.

A use-after-free vulnerability in the ffs_user_copy_worker function in the Linux kernel before version 4.5.3 allows local users to gain privileges by accessing an I/O data structure after a certain callback call.

A race condition in the get_task_ioprio function in the Linux kernel before version 4.6.6 allows local users to gain privileges or cause a denial of service (use-after-free) via a crafted ioprio_get system call.

A use-after-free vulnerability in the disk_seqf_stop function in the Linux kernel before version 4.7.1 allows local users to gain privileges by leveraging the execution of a certain stop operation even if the corresponding start operation had failed.

A race condition in the Linux kernel before version 4.4 in kernel/events/core.c allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging incorrect handling of an swevent data structure during a CPU unplug operation.

A double free vulnerability in the sg_common_write function in the Linux kernel before version 4.4 allows local users to gain privileges or cause a denial of service by detaching a device during an SG_IO ioctl call.

The __ext4_journal_stop function in the Linux kernel before version 4.3.3 allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging improper access to a certain error field.

In the Linux kernel before version 4.1.4, there is an issue with mishandling anonymous pages, allowing local users to gain privileges or cause a denial of service via a crafted application that triggers writing to page zero.

The apparmor_setprocattr function in the Linux kernel before version 4.6.5 does not validate the buffer size, allowing local users to gain privileges by triggering an AppArmor setprocattr hook.

The Linux kernel in version 4.7-rc6 has a vulnerability that allows local users to cause a denial of service (panic) or potentially have unspecified other impact via certain IPv6 socket operations.