Linux kernel vulnerabilities

The blk_rq_map_user_iov function in the Linux kernel before version 4.8.14 does not properly restrict the type of iterator, allowing local users to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging access to a /dev/sg device.

The sock_setsockopt function in the Linux kernel before version 3.5 mishandles negative values of sk_sndbuf and sk_rcvbuf. This allows local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact.

In the Linux kernel before version 4.0, a vulnerability allows local users to bypass the 'strict page permissions' protection mechanism and modify the system-call table, potentially gaining elevated privileges.

In the Linux kernel before version 4.4, there is a vulnerability that allows local users to gain elevated privileges via crafted F_OFD_GETLK, F_OFD_SETLK, or F_OFD_SETLKW commands in an fcntl64 system call.

The icmp6_send function in the Linux kernel up to version 4.8.12 omits a certain check of the dst data structure, allowing remote attackers to cause a denial of service (panic) via a fragmented IPv6 packet.

In the Linux kernel before version 4.8.7, there is an issue with mishandling unsuccessful crypto registration in conjunction with successful key-type registration. This can lead to denial of service (NULL pointer dereference and panic) or possibly other unspecified impacts via a crafted application using the big_key data type.

The tipc_msg_build function in the Linux kernel through version 4.8.11 does not validate the relationship between the minimum fragment length and the maximum packet size, which can lead to a heap-based buffer overflow.

A use-after-free vulnerability in the ffs_user_copy_worker function in the Linux kernel before version 4.5.3 allows local users to gain privileges by accessing an I/O data structure after a certain callback call.

A race condition in the get_task_ioprio function in the Linux kernel before version 4.6.6 allows local users to gain privileges or cause a denial of service (use-after-free) via a crafted ioprio_get system call.

A use-after-free vulnerability in the disk_seqf_stop function in the Linux kernel before version 4.7.1 allows local users to gain privileges by leveraging the execution of a certain stop operation even if the corresponding start operation had failed.

A race condition in the Linux kernel before version 4.4 in kernel/events/core.c allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging incorrect handling of an swevent data structure during a CPU unplug operation.

A double free vulnerability in the sg_common_write function in the Linux kernel before version 4.4 allows local users to gain privileges or cause a denial of service by detaching a device during an SG_IO ioctl call.

The __ext4_journal_stop function in the Linux kernel before version 4.3.3 allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging improper access to a certain error field.

In the Linux kernel before version 4.1.4, there is an issue with mishandling anonymous pages, allowing local users to gain privileges or cause a denial of service via a crafted application that triggers writing to page zero.

The apparmor_setprocattr function in the Linux kernel before version 4.6.5 does not validate the buffer size, allowing local users to gain privileges by triggering an AppArmor setprocattr hook.

The Linux kernel in version 4.7-rc6 has a vulnerability that allows local users to cause a denial of service (panic) or potentially have unspecified other impact via certain IPv6 socket operations.

The IPv6 stack in the Linux kernel before version 4.3.3 mishandles options data, allowing local users to gain privileges or cause a denial of service via a crafted sendmsg system call.

The trace_writeback_dirty_page implementation in the Linux kernel before version 4.4 improperly interacts with mm/migrate.c, allowing local users to cause a denial of service through NULL pointer dereference and system crash.

The rds_inc_info_copy function in the Linux kernel through version 4.6.3 does not initialize a certain structure member, allowing remote attackers to obtain sensitive information from kernel stack memory by reading an RDS message.

The ecryptfs_privileged_open function in the Linux kernel before version 4.6.3 allows local users to gain privileges or cause a denial of service via crafted mmap calls for /proc pathnames, leading to recursive pagefault handling.

Integer overflow in lib/asn1_decoder.c in the Linux kernel before 4.6 allows local users to gain privileges via crafted ASN.1 data.

The tipc_nl_publ_dump function in the Linux kernel through version 4.6 does not verify socket existence, allowing local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a dumpit operation.

Use-after-free vulnerability in mm/percpu.c in the Linux kernel through 4.6 allows local users to cause a denial of service (BUG) or possibly have unspecified other impact via crafted use of the mmap and bpf system calls.

The x25_negotiate_facilities function in the Linux kernel before version 4.5.5 does not properly initialize a certain data structure, allowing attackers to obtain sensitive information from kernel stack memory via an X.25 Call Request.

The replace_map_fd_with_map_ptr function in the Linux kernel before version 4.5.5 does not properly maintain an fd data structure, allowing local users to gain privileges or cause a denial of service (use-after-free) via crafted BPF instructions referencing an incorrect file descriptor.

The llc_cmsg_rcv function in the Linux kernel before version 4.5.5 does not initialize a certain data structure, allowing attackers to obtain sensitive information from kernel stack memory by reading a message.

The tcp_cwnd_reduction function in the Linux kernel before version 4.3.5 allows remote attackers to cause a denial of service via a divide-by-zero error, leading to system crashes.

Integer overflow in the aio_setup_single_vector function in Linux kernel 4.0 allows local users to cause denial of service or possibly have unspecified other impact via a large AIO iovec.

The Linux kernel 3.19 before 3.19.3 does not validate certain range data for sendto and recvfrom system calls, allowing local users to gain privileges by leveraging a subsystem that uses the copy_from_iter function in the iov_iter interface.

Integer overflow in fs/aio.c in the Linux kernel before 3.4.1 allows local users to cause a denial of service or possibly have unspecified other impact via a large AIO iovec.

The netlink_sendmsg function in the Linux kernel before version 3.5.5 does not validate the dst_pid field, allowing local users to spoof Netlink messages.

The redirect_target function in the Linux kernel before version 2.6.0 allows remote attackers to cause a denial of service by sending packets to an interface with a 0.0.0.0 IP address, leading to a NULL pointer dereference.

The arch_pick_mmap_layout function in the Linux kernel up to version 4.5.2 does not properly randomize the legacy base address, making it easier for local users to bypass restrictions on the ADDR_NO_RANDOMIZE flag and the ASLR protection mechanism for setuid or setgid programs.

A race condition in the Linux kernel before version 4.4.1 in arch/x86/mm/tlb.c allows local users to gain privileges by triggering access to a paging structure by a different CPU.

The __switch_to function in the Linux kernel does not properly context-switch IOPL on 64-bit PV Xen guests, allowing local guest OS users to gain privileges, cause a denial of service (guest OS crash), or obtain sensitive information by leveraging I/O port access.

The join_session_keyring function in the Linux kernel before version 4.4.1 mishandles object references in an error case, allowing local users to gain privileges or cause a denial of service (integer overflow and use-after-free) via crafted keyctl commands.

The Linux kernel through version 4.4.1 mishandles uid and gid mappings, allowing local users to gain privileges by establishing a user namespace and using the ptrace system call.

The udp_recvmsg and udpv6_recvmsg functions in the Linux kernel before version 4.0.6 do not properly consider yielding a processor, allowing remote attackers to cause a denial of service (system hang) via incorrect checksums within a UDP packet flood.

In the Linux kernel before version 4.1.6 on the x86_64 platform, there is a flaw in handling IRET faults during NMI processing that occurred during userspace execution. This may allow local users to gain privileges by triggering an NMI.

The pipe_read and pipe_write implementations in the Linux kernel before version 3.16 do not properly consider the side effects of failed __copy_to_user_inatomic and __copy_from_user_inatomic calls. This can lead to system crashes or potential privilege escalation by local users via a crafted application.

The __driver_rfc4106_decrypt function in the Linux kernel before version 3.19.3 improperly determines the memory locations used for encrypted data, which can lead to buffer overflow and system crash or potentially arbitrary code execution.

The pmd_none_or_trans_huge_or_clear_bad function in the Linux kernel before version 3.13 on NUMA systems improperly determines whether a Page Middle Directory (PMD) entry is a transparent huge-table entry, potentially leading to system crashes.

The implementation of certain splice_write file operations in the Linux kernel before version 3.16 does not enforce a restriction on the maximum size of a single file, allowing local users to cause a denial of service (system crash) or possibly have unspecified other impacts via a crafted splice system call.

The Linux kernel before version 3.17.5 has an issue with handling faults related to the Stack Segment (SS) segment register, allowing local users to gain privileges by triggering an IRET instruction that leads to access to a GS Base address from the wrong space.

The Linux kernel up to version 3.17.2 has an issue with handling private syscall numbers in the ftrace subsystem, allowing local users to gain privileges or cause a denial of service via a crafted application.

The Linux kernel before version 2.6.36 has a flaw in include/linux/netdevice.h that incorrectly uses macros for netdev_printk and its related logging implementation. This allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) by sending invalid packets to a VxLAN interface.

The do_remount function in the Linux kernel up to version 3.16.1 does not maintain the MNT_LOCK_READONLY bit across a remount of a bind mount, allowing local users to bypass an intended read-only restriction.

The sctp_sf_do_5_1D_ce function in the Linux kernel through version 3.13.6 does not validate certain auth_enable and auth_capable fields before making an sctp_sf_authenticate call. This allows remote attackers to cause a denial of service via an SCTP handshake with a modified INIT chunk and a crafted AUTH chunk before a COOKIE_ECHO chunk.

Buffer overflow in the complete_emulated_mmio function in the Linux kernel before version 3.13.6 allows guest OS users to execute arbitrary code on the host OS. It leverages a loop that triggers an invalid memory copy affecting certain cancel_work_item data.

A vulnerability in the Linux kernel has been fixed that could lead to a divide-by-zero error in the tcf_skbedit_hash() function. This issue was addressed by adding support for SKBEDIT_F_TXQ_SKBHASH.