Linux kernel vulnerabilities

The Linux kernel through version 4.14.8 has a vulnerability that allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging incorrect BPF_RSH signed bounds calculations.

The Linux kernel through version 4.14.8 has a vulnerability that allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging mishandling of 32-bit ALU ops.

The Linux kernel up to version 4.14.8 has a vulnerability that allows local users to cause a denial of service (memory corruption) by mishandling register truncation.

The raw_sendmsg() function in the Linux kernel through version 4.14.6 has a race condition in inet->hdrincl, leading to uninitialized stack pointer usage. This allows a local user to execute code and gain privileges.

The Linux Kernel 2.6.32 and later are affected by a denial of service. Flooding the diagnostic port 0x80 can trigger an exception leading to a kernel panic.

The Linux kernel version 3.3-rc1 and later is affected by a vulnerability related to the processing of incoming L2CAP commands - ConfigRequest and ConfigResponse messages. This info leak is a result of uninitialized stack variables that may be returned to an attacker in their uninitialized state.

The bnep_add_connection function in the Linux kernel before version 3.19 does not ensure that an l2cap socket is available, allowing local users to gain privileges via a crafted application.

The dccp_disconnect function in the Linux kernel through version 4.14.3 allows local users to gain privileges or cause a denial of service (use-after-free) via an AF_UNSPEC connect system call during the DCCP_LISTEN state.

Linux Kernel versions 2.6.38 through 4.14 have a problematic use of pmd_mkdirty() in touch_pmd(), which may lead to overwriting read-only huge pages. Although not as severe as the original 'Dirty cow' vulnerability, it allows for overwriting pages like zero huge page.

The mm_init function in the Linux kernel before version 4.12.10 does not clear the ->exe_file member of a new process's mm_struct, allowing a local attacker to achieve a use-after-free or possibly have unspecified other impact by running a specially crafted program.

The XFRM dump policy implementation in the Linux kernel before version 4.13.11 allows local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages.

The sctp_do_peeloff function in the Linux kernel before version 4.14 does not check whether the intended netns is used in a peel-off action, which can lead to denial of service (use-after-free and system crash) or other unspecified impacts via crafted system calls.

In the Linux kernel before version 4.13.6, a vulnerability allows local users to gain privileges via crafted system calls. The issue arises from a race condition that leads to mishandling of packet_fanout data structures, resulting in a use-after-free error.

A vulnerability in the Linux kernel related to memory corruption that occurs when switching the path from UFO to non-UFO. The issue arises when UFO packet lengths exceed MTU, leading to negative values in calculations and writing out-of-bounds.

The Linux kernel has a heap out-of-bounds vulnerability in AF_PACKET sockets. This issue is analogous to the previously disclosed CVE-2016-8655, where a socket option changing socket state may race with safety checks.

The prepare_vmcs02 function in the Linux kernel up to version 4.13.3 does not ensure that the 'CR8-load exiting' and 'CR8-store exiting' controls exist when L1 omits the 'use TPR shadow' control, allowing KVM L2 guest OS users to gain read and write access to the hardware CR8 register.

The tpacket_rcv function in the Linux kernel before version 4.13 mishandles vnet headers, which might allow local users to cause a denial of service through buffer overflow and disk and memory corruption.

The driver_override implementation in the Linux kernel before version 4.12.1 allows local users to gain privileges by leveraging a race condition between a read operation and a store operation involving different overrides.

The sanity_check_ckpt function in the Linux kernel before version 4.12.4 does not validate the blkoff and segno arrays, allowing local users to gain privileges via unspecified vectors.

The sanity_check_raw_super function in the Linux kernel before version 4.11.1 does not validate the segment count, allowing local users to gain privileges via unspecified vectors.

A race condition in the Linux kernel before version 4.10.15 in fs/timerfd.c allows local users to gain privileges or cause a denial of service through simultaneous file-descriptor operations.

The mq_notify function in the Linux kernel through version 4.11.9 does not set the sock pointer to NULL upon entry into the retry logic. This may lead to use-after-free vulnerabilities or other unspecified impacts.

The offset2lib patch in the Linux Kernel contains a vulnerability that allows a PIE binary to be execve()'d with 1GB of arguments or environmental strings, leading to the stack occupying the address 0x80000000. The PIE binary is mapped above 0x40000000, nullifying the protection of the offset2lib patch.

The Linux Kernel imposes a size restriction on the arguments and environmental strings passed through RLIMIT_STACK/RLIM_INFINITY, but does not take the argument and environment pointers into account, allowing attackers to bypass this limitation. This affects Linux Kernel versions 4.11.5 and earlier.

An issue was discovered in the size of the stack guard page on Linux. A 4k stack guard page is not sufficiently large and can be 'jumped' over, affecting Linux Kernel versions 4.11.5 and earlier.

The tcp_v6_syn_recv_sock function in the Linux kernel through version 4.11.1 mishandles inheritance, allowing local users to cause a denial of service or possibly have unspecified other impact via crafted system calls.

The dccp_v6_request_recv_sock function in the Linux kernel through version 4.11.1 mishandles inheritance, allowing local users to cause a denial of service or possibly have unspecified other impact via crafted system calls.

The sctp_v6_create_accept_sk function in the Linux kernel through version 4.11.1 mishandles inheritance, allowing local users to cause a denial of service or possibly have unspecified other impact via crafted system calls.

The IPv6 fragmentation implementation in the Linux kernel through version 4.11.1 does not consider that the nexthdr field may be associated with an invalid option. This allows local users to cause a denial of service (out-of-bounds read and BUG) or possibly have unspecified other impact via crafted socket and send system calls.

The ipxitf_ioctl function in the Linux kernel through version 4.11.1 mishandles reference counts, allowing local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via a failed SIOCGIFADDR ioctl call for an IPX interface.

The inet_csk_clone_lock function in the Linux kernel up to version 4.10.15 allows attackers to cause a denial of service (double free) or possibly have unspecified other impact by leveraging the accept system call.

The Linux kernel before version 3.19 has a flaw in counter grouping handling, allowing local users to gain elevated privileges via a crafted application.

The regulator_ena_gpio_free function in the Linux kernel before version 3.19 allows local users to gain privileges or cause a denial of service (use-after-free) via a crafted application.

The packet_set_ring function in the Linux kernel through version 4.10.6 does not properly validate certain block-size data, potentially leading to denial of service or privilege escalation by local users.

A race condition in the Linux kernel up to version 4.10.2 in kernel/ucount.c allows local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via crafted system calls.

The ip_cmsg_recv_checksum function in the Linux kernel before version 4.10.1 has incorrect expectations about skb data layout, allowing local users to cause a denial of service (buffer over-read) or potentially have unspecified other impact via crafted system calls.

A race condition in the Linux kernel before version 4.9.13 in net/packet/af_packet.c allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via a multithreaded application making PACKET_FANOUT setsockopt system calls.

The LLC subsystem in the Linux kernel before version 4.9.13 does not ensure that a certain destructor exists in required circumstances, allowing local users to cause a denial of service (BUG_ON) or possibly have unspecified other impact via crafted system calls.

The do_shmat function in the Linux kernel through version 4.9.12 does not restrict the address calculated by a certain rounding operation, allowing local users to map page zero. This enables bypassing a protection mechanism for the mmap system call.

The tcp_splice_read function in the Linux kernel before version 4.9.11 allows remote attackers to cause a denial of service through the use of a TCP packet with the URG flag, leading to an infinite loop and soft lockup.

The dccp_rcv_state_process function in the Linux kernel through version 4.9.11 mishandles DCCP_PKT_REQUEST packet data structures in the LISTEN state, allowing local users to obtain root privileges or cause a denial of service (double free) via an application making an IPV6_RECVPKTINFO setsockopt system call.

A race condition in the Linux kernel before version 4.9.7 in kernel/events/core.c allows local users to gain privileges via a crafted application making concurrent perf_event_open system calls to move a software group into a hardware context.

The TCP stack in the Linux kernel 3.x does not properly implement a SYN cookie protection mechanism for the case of a fast network connection, allowing remote attackers to cause a denial of service (CPU consumption) by sending many TCP SYN packets.

The ipv4_pktinfo_prepare function in the Linux kernel through version 4.9.9 allows attackers to cause a system crash via crafted system calls or possibly IPv4 traffic with invalid IP options.

The aio_mount function in the Linux kernel before version 4.7.7 does not properly restrict execute access, allowing local users to bypass intended SELinux W^X policy restrictions and gain privileges via an io_setup system call.

A race condition in the ip4_datagram_release_cb function in the Linux kernel before version 3.15.2 allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging incorrect expectations about locking during multithreaded access to internal data structures for IPv4 UDP sockets.

The freelist-randomization feature in mm/slab.c in the Linux kernel 4.8.x and 4.9.x before 4.9.5 allows local users to cause a denial of service (duplicate freelist entries and system crash) or possibly have unspecified other impact in opportunistic circumstances by leveraging the selection of a large value for a random number.

The Linux kernel through version 4.9.3 has a vulnerability that allows local users to obtain sensitive information from kernel memory or cause a denial of service (use-after-free) via a crafted application leveraging instruction emulation for fxrstor, fxsave, sgdt, and sidt.

A race condition in the netlink_dump function in the Linux kernel before version 4.6.3 allows local users to cause a denial of service (double free) or possibly have unspecified other impact via a crafted application that makes sendmsg system calls, leading to an unexpected free operation.

The sock_setsockopt function in the Linux kernel before version 4.8.14 mishandles negative values of sk_sndbuf and sk_rcvbuf. This can lead to system crashes or memory corruption by local users leveraging the CAP_NET_ADMIN capability.