Linux kernel vulnerabilities

The IPv6 stack in the Linux kernel before version 4.3.3 mishandles options data, allowing local users to gain privileges or cause a denial of service via a crafted sendmsg system call.

The trace_writeback_dirty_page implementation in the Linux kernel before version 4.4 improperly interacts with mm/migrate.c, allowing local users to cause a denial of service through NULL pointer dereference and system crash.

The rds_inc_info_copy function in the Linux kernel through version 4.6.3 does not initialize a certain structure member, allowing remote attackers to obtain sensitive information from kernel stack memory by reading an RDS message.

The ecryptfs_privileged_open function in the Linux kernel before version 4.6.3 allows local users to gain privileges or cause a denial of service via crafted mmap calls for /proc pathnames, leading to recursive pagefault handling.

Integer overflow in lib/asn1_decoder.c in the Linux kernel before 4.6 allows local users to gain privileges via crafted ASN.1 data.

The tipc_nl_publ_dump function in the Linux kernel through version 4.6 does not verify socket existence, allowing local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a dumpit operation.

Use-after-free vulnerability in mm/percpu.c in the Linux kernel through 4.6 allows local users to cause a denial of service (BUG) or possibly have unspecified other impact via crafted use of the mmap and bpf system calls.

The x25_negotiate_facilities function in the Linux kernel before version 4.5.5 does not properly initialize a certain data structure, allowing attackers to obtain sensitive information from kernel stack memory via an X.25 Call Request.

The replace_map_fd_with_map_ptr function in the Linux kernel before version 4.5.5 does not properly maintain an fd data structure, allowing local users to gain privileges or cause a denial of service (use-after-free) via crafted BPF instructions referencing an incorrect file descriptor.

The llc_cmsg_rcv function in the Linux kernel before version 4.5.5 does not initialize a certain data structure, allowing attackers to obtain sensitive information from kernel stack memory by reading a message.

The tcp_cwnd_reduction function in the Linux kernel before version 4.3.5 allows remote attackers to cause a denial of service via a divide-by-zero error, leading to system crashes.

Integer overflow in the aio_setup_single_vector function in Linux kernel 4.0 allows local users to cause denial of service or possibly have unspecified other impact via a large AIO iovec.

The Linux kernel 3.19 before 3.19.3 does not validate certain range data for sendto and recvfrom system calls, allowing local users to gain privileges by leveraging a subsystem that uses the copy_from_iter function in the iov_iter interface.

Integer overflow in fs/aio.c in the Linux kernel before 3.4.1 allows local users to cause a denial of service or possibly have unspecified other impact via a large AIO iovec.

The netlink_sendmsg function in the Linux kernel before version 3.5.5 does not validate the dst_pid field, allowing local users to spoof Netlink messages.

The redirect_target function in the Linux kernel before version 2.6.0 allows remote attackers to cause a denial of service by sending packets to an interface with a 0.0.0.0 IP address, leading to a NULL pointer dereference.

The arch_pick_mmap_layout function in the Linux kernel up to version 4.5.2 does not properly randomize the legacy base address, making it easier for local users to bypass restrictions on the ADDR_NO_RANDOMIZE flag and the ASLR protection mechanism for setuid or setgid programs.

A race condition in the Linux kernel before version 4.4.1 in arch/x86/mm/tlb.c allows local users to gain privileges by triggering access to a paging structure by a different CPU.

The __switch_to function in the Linux kernel does not properly context-switch IOPL on 64-bit PV Xen guests, allowing local guest OS users to gain privileges, cause a denial of service (guest OS crash), or obtain sensitive information by leveraging I/O port access.

The join_session_keyring function in the Linux kernel before version 4.4.1 mishandles object references in an error case, allowing local users to gain privileges or cause a denial of service (integer overflow and use-after-free) via crafted keyctl commands.

The Linux kernel through version 4.4.1 mishandles uid and gid mappings, allowing local users to gain privileges by establishing a user namespace and using the ptrace system call.

The udp_recvmsg and udpv6_recvmsg functions in the Linux kernel before version 4.0.6 do not properly consider yielding a processor, allowing remote attackers to cause a denial of service (system hang) via incorrect checksums within a UDP packet flood.

In the Linux kernel before version 4.1.6 on the x86_64 platform, there is a flaw in handling IRET faults during NMI processing that occurred during userspace execution. This may allow local users to gain privileges by triggering an NMI.

The pipe_read and pipe_write implementations in the Linux kernel before version 3.16 do not properly consider the side effects of failed __copy_to_user_inatomic and __copy_from_user_inatomic calls. This can lead to system crashes or potential privilege escalation by local users via a crafted application.

The __driver_rfc4106_decrypt function in the Linux kernel before version 3.19.3 improperly determines the memory locations used for encrypted data, which can lead to buffer overflow and system crash or potentially arbitrary code execution.

The pmd_none_or_trans_huge_or_clear_bad function in the Linux kernel before version 3.13 on NUMA systems improperly determines whether a Page Middle Directory (PMD) entry is a transparent huge-table entry, potentially leading to system crashes.

The implementation of certain splice_write file operations in the Linux kernel before version 3.16 does not enforce a restriction on the maximum size of a single file, allowing local users to cause a denial of service (system crash) or possibly have unspecified other impacts via a crafted splice system call.

The Linux kernel before version 3.17.5 has an issue with handling faults related to the Stack Segment (SS) segment register, allowing local users to gain privileges by triggering an IRET instruction that leads to access to a GS Base address from the wrong space.

The Linux kernel up to version 3.17.2 has an issue with handling private syscall numbers in the ftrace subsystem, allowing local users to gain privileges or cause a denial of service via a crafted application.

The Linux kernel before version 2.6.36 has a flaw in include/linux/netdevice.h that incorrectly uses macros for netdev_printk and its related logging implementation. This allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) by sending invalid packets to a VxLAN interface.

The do_remount function in the Linux kernel up to version 3.16.1 does not maintain the MNT_LOCK_READONLY bit across a remount of a bind mount, allowing local users to bypass an intended read-only restriction.

The sctp_sf_do_5_1D_ce function in the Linux kernel through version 3.13.6 does not validate certain auth_enable and auth_capable fields before making an sctp_sf_authenticate call. This allows remote attackers to cause a denial of service via an SCTP handshake with a modified INIT chunk and a crafted AUTH chunk before a COOKIE_ECHO chunk.

Buffer overflow in the complete_emulated_mmio function in the Linux kernel before version 3.13.6 allows guest OS users to execute arbitrary code on the host OS. It leverages a loop that triggers an invalid memory copy affecting certain cancel_work_item data.

In the Linux kernel, a race condition was fixed in the OA TC6 network driver between reference pointers for TX packets. The issue involves managing two skb pointers for packets enqueued from the network stack.

A vulnerability has been identified in the Linux kernel related to a heap buffer overflow in the __ioam6_fill_trace_data() function. This issue occurs on the receive path, where the function incorrectly assesses the amount of data to write based on a trusted field from the incoming packet.

In the Linux kernel, in the Bluetooth subsystem (MGMT), possible deadlocks were fixed that could occur due to hci_cmd_sync_dequeue, causing threads to block for extended periods.

A NULL pointer dereference vulnerability was found in the Linux kernel's ALSA driver for the TASCAM US-144MKII device. A malicious USB device can have a configuration with interface number 1 but missing interface 0, leading to a system crash.

In the Linux kernel's drm/amdgpu/mes driver, a use-after-free issue exists. The fix removes the fence fallback timer to eliminate random errors.

In the Linux kernel, an overflow in the ring-buffer's __rb_map_vma function was fixed, which occurred when calculating the number of pages (nr_pages). A check was added before the calculation to avoid the issue.

In the Linux kernel, a page fault occurs in the vfio/xe driver when resetting VF devices that do not support migration. The fix reorganizes initialization to decouple migration from reset.

A vulnerability was found in the Linux kernel's KVM for AMD SEV. It fails to reject attempts to synchronize vCPU state with an already encrypted VMSA after the VM has been launched.

In the Linux kernel, a double accounting race was fixed in Btrfs when btrfs_run_delalloc_range() fails. The issue occurs when block size is smaller than page size and can lead to kernel crash.

In the Linux kernel's btrfs filesystem, a use-after-free of the block device file occurs in __btrfs_free_extra_devids(). The issue may arise when mounting two btrfs images with the same fsid.

In the Linux kernel, a vulnerability in the mshv_vtl component occurs when registering VTL0 memory via MSHV_ADD_VTL0_MEMORY, where the computed vmemmap_shift may exceed MAX_FOLIO_ORDER, leading to incorrect behavior.

In the Linux kernel, RCU protection was added for the conventional zones bitmap of a disk (conv_zones_bitmap) in the block layer. This prevents invalid memory references during disk revalidation.

A vulnerability in the virtio-gpu module of the Linux kernel involves an incorrect overflow check when allocating 2D images. This flaw can lead to a buffer overflow, potentially enabling privilege escalation or system crash.

In the Linux kernel, a vulnerability was found in the F2FS filesystem involving uninitialized value access in the f2fs_sanity_check_node_footer function. The issue was reported by syzbot and may lead to unpredictable system behavior.

In the Linux kernel, the drm/amdgpu driver changed the handling of the vm->task_info object. The object is now dynamically allocated and reference-counted, improving safety and stability.

In the Linux kernel, the bnge driver has a vulnerability where a return statement is missing after auxiliary_device_uninit() in the error path. After auxiliary_device_add() fails, execution continues, potentially leading to use-after-free.

In the Linux kernel, a proper folio cleanup was fixed in Btrfs when cow_file_range() fails. The issue involved improper handling of dirty pages.