LOW2.1
Уязвимость ядра Linux, позволяющая нарушителю получить доступ к защищаемой информации
CVSS 2.0LOW 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:P/I:N/A:NReferences
ALT-PU-2015-1849-2Package update kernel-image-std-def in branch sisyphus
Severity:
Closed issues (77)
HIGH7.8
Уязвимость ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании или оказать другое воздействие
CVSS 3.xHIGH 7.8
CVSS:3.x/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HCVSS 2.0HIGH 7.2
CVSS:2.0/AV:L/AC:L/Au:N/C:C/I:C/A:CReferences
HIGH7.8
Уязвимость ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании или оказать другое воздействие
CVSS 3.xHIGH 7.8
CVSS:3.x/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVSS 2.0MEDIUM 6.8
CVSS:2.0/AV:L/AC:L/Au:S/C:C/I:C/A:CReferences
CRITICAL9.8
Уязвимость ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании или оказать другое воздействие
CVSS 3.xCRITICAL 9.8
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVSS 2.0CRITICAL 10.0
CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:CReferences
MEDIUM4.6
Уязвимость операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании или оказать другое воздействие
CVSS 2.0MEDIUM 4.6
CVSS:2.0/AV:L/AC:L/Au:N/C:P/I:P/A:PReferences
CRITICAL9.8
Уязвимость компонента kernel/events/core.c ядра операционной системы Android, позволяющая нарушителю повысить свои привилегии
CVSS 3.xCRITICAL 9.8
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVSS 2.0CRITICAL 10.0
CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:CReferences
HIGH7.6
Уязвимость компонента drivers/regulator/core.c ядра операционной системы Android, позволяющая нарушителю вызвать отказ в обслуживании или повысить свои привилегии
CVSS 2.0HIGH 7.6
CVSS:2.0/AV:N/AC:H/Au:N/C:C/I:C/A:CReferences
HIGH7.5
Уязвимость реализации TCP-стека операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании
CVSS 3.xHIGH 7.5
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVSS 2.0HIGH 7.8
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:CReferences
MEDIUM4.9
Уязвимость функции ping_unhash (net/ipv4/ping.c) ядра операционной системы Linux, позволяющая нарушителю повысить свои привилегии или вызвать отказ в обслуживании
CVSS 2.0MEDIUM 4.9
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:CReferences
MEDIUM4.7
Уязвимость функци skcipher_recvmsg (crypto/algif_skcipher.c) ядра операционных систем Linux, позволяющая нарушителю вызвать отказ в обслуживании
CVSS 3.xMEDIUM 4.7
CVSS:3.x/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:HCVSS 2.0MEDIUM 4.9
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:CReferences
MEDIUM6.8
Уязвимость функции conn_info_{min,max}_age_set() в модуле net/bluetooth/hci_debugfs.c. реализации протокола HCI драйвера bluetooth ядра операционной системы Linux, позволяющая нарушителю оказать воздействие на целостность защищаемой информации и вызвать отказ в обслуживании
CVSS 3.xMEDIUM 6.8
CVSS:3.x/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:HCVSS 2.0MEDIUM 6.8
CVSS:2.0/AV:A/AC:H/Au:N/C:C/I:C/A:CReferences
MEDIUM5.3
Уязвимость функции {conn,adv}_{min,max}_interval_set() реализации протокола HCI драйвера bluetooth ядра операционной системы Linux, позволяющая нарушителю оказать воздействие на целостность защищаемой информации и вызвать отказ в обслуживании
CVSS 3.xMEDIUM 5.3
CVSS:3.x/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HCVSS 2.0MEDIUM 4.6
CVSS:2.0/AV:A/AC:H/Au:N/C:N/I:N/A:CReferences
MEDIUM4.8
Уязвимость в функциях sniff_{min,max}_interval_set(), реализации протокола HCI драйвера bluetooth ядра операционной системы Linux, позволяющая нарушителю оказать воздействие на целостность защищаемой информации и вызвать отказ в обслуживании
CVSS 3.xMEDIUM 4.8
CVSS:3.x/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:HCVSS 2.0MEDIUM 4.6
CVSS:2.0/AV:A/AC:H/Au:N/C:N/I:N/A:CReferences
CRITICAL9.8
The vfe31_proc_general function in drivers/media/video/msm/vfe/msm_vfe31.c in the MSM-VFE31 driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not validate a certain id value, which allows attackers to gain privileges or cause a denial of service (memory corruption) via an application that makes a crafted ioctl call.
CVSS 2.0HIGH 7.2
CVSS:2.0/AV:L/AC:L/Au:N/C:C/I:C/A:CCVSS 3.xCRITICAL 9.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HMEDIUM6.1
fs/namespace.c in the Linux kernel before 4.0.2 processes MNT_DETACH umount2 system calls without verifying that the MNT_LOCKED flag is unset, which allows local users to bypass intended access restrictions and navigate to filesystem locations beneath a mount by calling umount2 within a user namespace.
CVSS 2.0LOW 3.6
CVSS:2.0/AV:L/AC:L/Au:N/C:P/I:P/A:NCVSS 3.xMEDIUM 6.1
CVSS:3.x/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:NReferences
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ce07d891a0891d3c0d0c2d73d577490486b809e1
- http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00054.html
- http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00056.html
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00000.html
- http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.0.2
- http://www.openwall.com/lists/oss-security/2015/04/17/4
- http://www.securityfocus.com/bid/74226
- http://www.spinics.net/lists/linux-containers/msg30786.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1226751
- https://github.com/torvalds/linux/commit/ce07d891a0891d3c0d0c2d73d577490486b809e1
- https://groups.google.com/forum/message/raw?msg=linux.kernel/HnegnbXk0Vs/RClojwJzAFEJ
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ce07d891a0891d3c0d0c2d73d577490486b809e1
- http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00054.html
- http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00056.html
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00000.html
- http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.0.2
- http://www.openwall.com/lists/oss-security/2015/04/17/4
- http://www.securityfocus.com/bid/74226
- http://www.spinics.net/lists/linux-containers/msg30786.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1226751
- https://github.com/torvalds/linux/commit/ce07d891a0891d3c0d0c2d73d577490486b809e1
- https://groups.google.com/forum/message/raw?msg=linux.kernel/HnegnbXk0Vs/RClojwJzAFEJ
HIGH7.0
The regulator_ena_gpio_free function in drivers/regulator/core.c in the Linux kernel before 3.19 allows local users to gain privileges or cause a denial of service (use-after-free) via a crafted application.
CVSS 2.0HIGH 7.6
CVSS:2.0/AV:N/AC:H/Au:N/C:C/I:C/A:CCVSS 3.xHIGH 7.0
CVSS:3.x/CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HReferences
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=60a2362f769cf549dc466134efe71c8bf9fbaaba
- http://www.debian.org/security/2017/dsa-3945
- http://www.securityfocus.com/bid/98195
- https://github.com/torvalds/linux/commit/60a2362f769cf549dc466134efe71c8bf9fbaaba
- https://source.android.com/security/bulletin/2017-05-01
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=60a2362f769cf549dc466134efe71c8bf9fbaaba
- http://www.debian.org/security/2017/dsa-3945
- http://www.securityfocus.com/bid/98195
- https://github.com/torvalds/linux/commit/60a2362f769cf549dc466134efe71c8bf9fbaaba
- https://source.android.com/security/bulletin/2017-05-01
MEDIUM4.9
The ext4_zero_range function in fs/ext4/extents.c in the Linux kernel before 4.1 allows local users to cause a denial of service (BUG) via a crafted fallocate zero-range request.
CVSS 2.0MEDIUM 4.9
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:CReferences
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=0f2af21aae11972fa924374ddcf52e88347cf5a8
- http://rhn.redhat.com/errata/RHSA-2015-1778.html
- http://rhn.redhat.com/errata/RHSA-2015-1787.html
- http://www.openwall.com/lists/oss-security/2015/02/23/14
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- http://www.securityfocus.com/bid/75139
- http://www.securitytracker.com/id/1034454
- http://www.spinics.net/lists/linux-ext4/msg47193.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1193907
- https://github.com/torvalds/linux/commit/0f2af21aae11972fa924374ddcf52e88347cf5a8
- https://support.f5.com/csp/article/K05211147
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=0f2af21aae11972fa924374ddcf52e88347cf5a8
- http://rhn.redhat.com/errata/RHSA-2015-1778.html
- http://rhn.redhat.com/errata/RHSA-2015-1787.html
- http://www.openwall.com/lists/oss-security/2015/02/23/14
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- http://www.securityfocus.com/bid/75139
- http://www.securitytracker.com/id/1034454
- http://www.spinics.net/lists/linux-ext4/msg47193.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1193907
- https://github.com/torvalds/linux/commit/0f2af21aae11972fa924374ddcf52e88347cf5a8
- https://support.f5.com/csp/article/K05211147
HIGH7.8
Use-after-free vulnerability in the msm_set_crop function in drivers/media/video/msm/msm_camera.c in the MSM-Camera driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to gain privileges or cause a denial of service (memory corruption) via an application that makes a crafted ioctl call.
CVSS 2.0HIGH 7.2
CVSS:2.0/AV:L/AC:L/Au:N/C:C/I:C/A:CCVSS 3.xHIGH 7.8
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HReferences
- http://www.securityfocus.com/bid/92379
- https://www.codeaurora.org/projects/security-advisories/multiple-issues-camera-drivers-cve-2014-9410-cve-2015-0568
- http://www.securityfocus.com/bid/92379
- https://www.codeaurora.org/projects/security-advisories/multiple-issues-camera-drivers-cve-2014-9410-cve-2015-0568
HIGH7.0
Multiple race conditions in drivers/char/adsprpc.c and drivers/char/adsprpc_compat.c in the ADSPRPC driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allow attackers to cause a denial of service (zero-value write) or possibly have unspecified other impact via a COMPAT_FASTRPC_IOCTL_INVOKE_FD ioctl call.
CVSS 2.0MEDIUM 4.4
CVSS:2.0/AV:L/AC:M/Au:N/C:P/I:P/A:PCVSS 3.xHIGH 7.0
CVSS:3.x/CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HReferences
- http://source.android.com/security/bulletin/2016-10-01.html
- http://www.securityfocus.com/bid/93312
- https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=34ad3d34fbff11b8e1210b9da0dac937fb956b61
- https://source.codeaurora.org/quic/la/kernel/msm/commit/?id=8fb32c3a8147b82e2bb159b3f70d803c9e68899b
- https://www.codeaurora.org/race-condition-leading-arbitrary-null-write-adsp-using-ioctl-compatfastrpcioctlinvokefd-cve-2015
- http://source.android.com/security/bulletin/2016-10-01.html
- http://www.securityfocus.com/bid/93312
- https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=34ad3d34fbff11b8e1210b9da0dac937fb956b61
- https://source.codeaurora.org/quic/la/kernel/msm/commit/?id=8fb32c3a8147b82e2bb159b3f70d803c9e68899b
- https://www.codeaurora.org/race-condition-leading-arbitrary-null-write-adsp-using-ioctl-compatfastrpcioctlinvokefd-cve-2015
CRITICAL9.8
drivers/media/platform/msm/broadcast/tsc.c in the TSC driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to cause a denial of service (invalid pointer dereference) or possibly have unspecified other impact via a crafted application that makes a TSC_GET_CARD_STATUS ioctl call.
CVSS 2.0HIGH 7.5
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:PCVSS 3.xCRITICAL 9.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HReferences
- https://us.codeaurora.org/cgit/quic/la//kernel/msm-3.10/commit/?id=e20f20aaed6b6d2fd1667bad9be9ef35103a51df
- https://www.codeaurora.org/issues-tsc-tspp2-and-buspm-drivers-cve-2015-0573-cve-2016-2441-cve-2016-2442
- https://us.codeaurora.org/cgit/quic/la//kernel/msm-3.10/commit/?id=e20f20aaed6b6d2fd1667bad9be9ef35103a51df
- https://www.codeaurora.org/issues-tsc-tspp2-and-buspm-drivers-cve-2015-0573-cve-2016-2441-cve-2016-2442
HIGH7.8
The overlayfs implementation in the linux (aka Linux kernel) package before 3.19.0-21.21 in Ubuntu through 15.04 does not properly check permissions for file creation in the upper filesystem directory, which allows local users to obtain root access by leveraging a configuration in which overlayfs is permitted in an arbitrary mount namespace.
CVSS 2.0HIGH 7.2
CVSS:2.0/AV:L/AC:L/Au:N/C:C/I:C/A:CCVSS 3.xHIGH 7.8
CVSS:3.x/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HReferences
- http://seclists.org/oss-sec/2015/q2/717
- http://www.exploit-db.com/exploits/40688/
- http://www.securityfocus.com/bid/75206
- https://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-1328.html
- https://security-tracker.debian.org/tracker/CVE-2015-1328
- https://www.exploit-db.com/exploits/37292/
- http://seclists.org/oss-sec/2015/q2/717
- http://www.exploit-db.com/exploits/40688/
- http://www.securityfocus.com/bid/75206
- https://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-1328.html
- https://security-tracker.debian.org/tracker/CVE-2015-1328
- https://www.exploit-db.com/exploits/37292/
MEDIUM4.9
Memory leak in the __key_link_end function in security/keys/keyring.c in the Linux kernel before 4.1.4 allows local users to cause a denial of service (memory consumption) via many add_key system calls that refer to existing keys.
CVSS 2.0MEDIUM 4.9
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:CReferences
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ca4da5dd1f99fe9c59f1709fb43e818b18ad20e0
- http://rhn.redhat.com/errata/RHSA-2015-1778.html
- http://rhn.redhat.com/errata/RHSA-2015-1787.html
- http://www.debian.org/security/2015/dsa-3329
- http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.4
- http://www.openwall.com/lists/oss-security/2015/07/27/7
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- http://www.securityfocus.com/bid/76050
- http://www.ubuntu.com/usn/USN-2687-1
- http://www.ubuntu.com/usn/USN-2688-1
- http://www.ubuntu.com/usn/USN-2689-1
- http://www.ubuntu.com/usn/USN-2690-1
- http://www.ubuntu.com/usn/USN-2691-1
- https://bugzilla.redhat.com/show_bug.cgi?id=1245658
- https://github.com/torvalds/linux/commit/ca4da5dd1f99fe9c59f1709fb43e818b18ad20e0
- https://support.f5.com/csp/article/K05211147
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ca4da5dd1f99fe9c59f1709fb43e818b18ad20e0
- http://rhn.redhat.com/errata/RHSA-2015-1778.html
- http://rhn.redhat.com/errata/RHSA-2015-1787.html
- http://www.debian.org/security/2015/dsa-3329
- http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.4
- http://www.openwall.com/lists/oss-security/2015/07/27/7
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- http://www.securityfocus.com/bid/76050
- http://www.ubuntu.com/usn/USN-2687-1
- http://www.ubuntu.com/usn/USN-2688-1
- http://www.ubuntu.com/usn/USN-2689-1
- http://www.ubuntu.com/usn/USN-2690-1
- http://www.ubuntu.com/usn/USN-2691-1
- https://bugzilla.redhat.com/show_bug.cgi?id=1245658
- https://github.com/torvalds/linux/commit/ca4da5dd1f99fe9c59f1709fb43e818b18ad20e0
- https://support.f5.com/csp/article/K05211147
MEDIUM5.5
The VFS subsystem in the Linux kernel 3.x provides an incomplete set of requirements for setattr operations that underspecifies removing extended privilege attributes, which allows local users to cause a denial of service (capability stripping) via a failed invocation of a system call, as demonstrated by using chown to remove a capability from the ping or Wireshark dumpcap program.
CVSS 2.0LOW 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:PCVSS 3.xMEDIUM 5.5
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HReferences
- http://marc.info/?l=linux-kernel&m=142153722930533&w=2
- http://www.openwall.com/lists/oss-security/2015/01/24/5
- http://www.securityfocus.com/bid/76075
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=770492
- https://bugzilla.redhat.com/show_bug.cgi?id=1185139
- http://marc.info/?l=linux-kernel&m=142153722930533&w=2
- http://www.openwall.com/lists/oss-security/2015/01/24/5
- http://www.securityfocus.com/bid/76075
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=770492
- https://bugzilla.redhat.com/show_bug.cgi?id=1185139
MEDIUM4.9
Xen 3.3.x through 4.5.x and the Linux kernel through 3.19.1 do not properly restrict access to PCI command registers, which might allow local guest OS users to cause a denial of service (non-maskable interrupt and host crash) by disabling the (1) memory or (2) I/O decoding for a PCI Express device and then accessing the device, which triggers an Unsupported Request (UR) response.
CVSS 2.0MEDIUM 4.9
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:CReferences
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=af6fc858a35b90e89ea7a7ee58e66628c55c776b
- http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155804.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155854.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155908.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152747.html
- http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00001.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00004.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00018.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00021.html
- http://www.debian.org/security/2015/dsa-3237
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.securityfocus.com/bid/73014
- http://www.securitytracker.com/id/1031806
- http://www.securitytracker.com/id/1031902
- http://www.ubuntu.com/usn/USN-2631-1
- http://www.ubuntu.com/usn/USN-2632-1
- http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-423503.htm
- http://xenbits.xen.org/xsa/advisory-120.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1196266
- https://github.com/torvalds/linux/commit/af6fc858a35b90e89ea7a7ee58e66628c55c776b
- https://seclists.org/bugtraq/2019/Aug/18
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=af6fc858a35b90e89ea7a7ee58e66628c55c776b
- http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155804.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155854.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155908.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152747.html
- http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00001.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00004.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00018.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00021.html
- http://www.debian.org/security/2015/dsa-3237
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.securityfocus.com/bid/73014
- http://www.securitytracker.com/id/1031806
- http://www.securitytracker.com/id/1031902
- http://www.ubuntu.com/usn/USN-2631-1
- http://www.ubuntu.com/usn/USN-2632-1
- http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-423503.htm
- http://xenbits.xen.org/xsa/advisory-120.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1196266
- https://github.com/torvalds/linux/commit/af6fc858a35b90e89ea7a7ee58e66628c55c776b
- https://seclists.org/bugtraq/2019/Aug/18
MEDIUM5.5
The xsave/xrstor implementation in arch/x86/include/asm/xsave.h in the Linux kernel before 3.19.2 creates certain .altinstr_replacement pointers and consequently does not provide any protection against instruction faulting, which allows local users to cause a denial of service (panic) by triggering a fault, as demonstrated by an unaligned memory operand or a non-canonical address memory operand.
CVSS 2.0MEDIUM 4.9
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:CCVSS 3.xMEDIUM 5.5
CVSS:3.x/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HReferences
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=06c8173eb92bbfc03a0fe8bb64315857d0badd06
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.19.2
- http://www.openwall.com/lists/oss-security/2015/03/22/1
- https://bugzilla.redhat.com/show_bug.cgi?id=1204729
- https://github.com/torvalds/linux/commit/06c8173eb92bbfc03a0fe8bb64315857d0badd06
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=06c8173eb92bbfc03a0fe8bb64315857d0badd06
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.19.2
- http://www.openwall.com/lists/oss-security/2015/03/22/1
- https://bugzilla.redhat.com/show_bug.cgi?id=1204729
- https://github.com/torvalds/linux/commit/06c8173eb92bbfc03a0fe8bb64315857d0badd06
LOW1.9
arch/x86/kernel/entry_64.S in the Linux kernel before 3.19.2 does not prevent the TS_COMPAT flag from reaching a user-mode task, which might allow local users to bypass the seccomp or audit protection mechanism via a crafted application that uses the (1) fork or (2) close system call, as demonstrated by an attack against seccomp before 3.16.
CVSS 2.0LOW 1.9
CVSS:2.0/AV:L/AC:M/Au:N/C:N/I:P/A:NReferences
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=956421fbb74c3a6261903f3836c0740187cf038b
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00004.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00018.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00021.html
- http://rhn.redhat.com/errata/RHSA-2015-1137.html
- http://rhn.redhat.com/errata/RHSA-2015-1138.html
- http://rhn.redhat.com/errata/RHSA-2015-1221.html
- http://www.debian.org/security/2015/dsa-3237
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.19.2
- http://www.openwall.com/lists/oss-security/2015/04/02/1
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.securitytracker.com/id/1032413
- http://www.ubuntu.com/usn/USN-2631-1
- http://www.ubuntu.com/usn/USN-2632-1
- https://bugzilla.redhat.com/show_bug.cgi?id=1208598
- https://github.com/torvalds/linux/commit/956421fbb74c3a6261903f3836c0740187cf038b
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=956421fbb74c3a6261903f3836c0740187cf038b
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00004.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00018.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00021.html
- http://rhn.redhat.com/errata/RHSA-2015-1137.html
- http://rhn.redhat.com/errata/RHSA-2015-1138.html
- http://rhn.redhat.com/errata/RHSA-2015-1221.html
- http://www.debian.org/security/2015/dsa-3237
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.19.2
- http://www.openwall.com/lists/oss-security/2015/04/02/1
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.securitytracker.com/id/1032413
- http://www.ubuntu.com/usn/USN-2631-1
- http://www.ubuntu.com/usn/USN-2632-1
- https://bugzilla.redhat.com/show_bug.cgi?id=1208598
- https://github.com/torvalds/linux/commit/956421fbb74c3a6261903f3836c0740187cf038b
LOW3.3
The ndisc_router_discovery function in net/ipv6/ndisc.c in the Neighbor Discovery (ND) protocol implementation in the IPv6 stack in the Linux kernel before 3.19.6 allows remote attackers to reconfigure a hop-limit setting via a small hop_limit value in a Router Advertisement (RA) message.
CVSS 2.0LOW 3.3
CVSS:2.0/AV:A/AC:L/Au:N/C:N/I:N/A:PReferences
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=6fd99094de2b83d1d4c8457f2c83483b2828e75a
- http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155804.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155854.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155908.html
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00023.html
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00011.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00004.html
- http://rhn.redhat.com/errata/RHSA-2015-1221.html
- http://rhn.redhat.com/errata/RHSA-2015-1534.html
- http://rhn.redhat.com/errata/RHSA-2015-1564.html
- http://www.debian.org/security/2015/dsa-3237
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.19.6
- http://www.openwall.com/lists/oss-security/2015/04/04/2
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.securityfocus.com/bid/74315
- http://www.securitytracker.com/id/1032417
- https://bugzilla.redhat.com/show_bug.cgi?id=1203712
- https://github.com/torvalds/linux/commit/6fd99094de2b83d1d4c8457f2c83483b2828e75a
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=6fd99094de2b83d1d4c8457f2c83483b2828e75a
- http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155804.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155854.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155908.html
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00023.html
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00011.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00004.html
- http://rhn.redhat.com/errata/RHSA-2015-1221.html
- http://rhn.redhat.com/errata/RHSA-2015-1534.html
- http://rhn.redhat.com/errata/RHSA-2015-1564.html
- http://www.debian.org/security/2015/dsa-3237
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.19.6
- http://www.openwall.com/lists/oss-security/2015/04/04/2
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.securityfocus.com/bid/74315
- http://www.securitytracker.com/id/1032417
- https://bugzilla.redhat.com/show_bug.cgi?id=1203712
- https://github.com/torvalds/linux/commit/6fd99094de2b83d1d4c8457f2c83483b2828e75a
MEDIUM4.9
Race condition in net/sctp/socket.c in the Linux kernel before 4.1.2 allows local users to cause a denial of service (list corruption and panic) via a rapid series of system calls related to sockets, as demonstrated by setsockopt calls.
CVSS 2.0MEDIUM 4.9
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:CReferences
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=2d45a02d0166caf2627fe91897c6ffc3b19514c4
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00049.html
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00011.html
- http://rhn.redhat.com/errata/RHSA-2015-1778.html
- http://rhn.redhat.com/errata/RHSA-2015-1787.html
- http://www.debian.org/security/2015/dsa-3329
- http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.2
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- http://www.securityfocus.com/bid/76082
- http://www.securitytracker.com/id/1033169
- http://www.ubuntu.com/usn/USN-2713-1
- http://www.ubuntu.com/usn/USN-2714-1
- http://www.ubuntu.com/usn/USN-2715-1
- http://www.ubuntu.com/usn/USN-2716-1
- http://www.ubuntu.com/usn/USN-2717-1
- http://www.ubuntu.com/usn/USN-2718-1
- http://www.ubuntu.com/usn/USN-2719-1
- https://bugzilla.redhat.com/show_bug.cgi?id=1226442
- https://github.com/torvalds/linux/commit/2d45a02d0166caf2627fe91897c6ffc3b19514c4
- https://support.f5.com/csp/article/K05211147
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=2d45a02d0166caf2627fe91897c6ffc3b19514c4
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00049.html
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00011.html
- http://rhn.redhat.com/errata/RHSA-2015-1778.html
- http://rhn.redhat.com/errata/RHSA-2015-1787.html
- http://www.debian.org/security/2015/dsa-3329
- http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.2
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- http://www.securityfocus.com/bid/76082
- http://www.securitytracker.com/id/1033169
- http://www.ubuntu.com/usn/USN-2713-1
- http://www.ubuntu.com/usn/USN-2714-1
- http://www.ubuntu.com/usn/USN-2715-1
- http://www.ubuntu.com/usn/USN-2716-1
- http://www.ubuntu.com/usn/USN-2717-1
- http://www.ubuntu.com/usn/USN-2718-1
- http://www.ubuntu.com/usn/USN-2719-1
- https://bugzilla.redhat.com/show_bug.cgi?id=1226442
- https://github.com/torvalds/linux/commit/2d45a02d0166caf2627fe91897c6ffc3b19514c4
- https://support.f5.com/csp/article/K05211147
HIGH7.8
mm/memory.c in the Linux kernel before 4.1.4 mishandles anonymous pages, which allows local users to gain privileges or cause a denial of service (page tainting) via a crafted application that triggers writing to page zero.
CVSS 2.0HIGH 7.2
CVSS:2.0/AV:L/AC:L/Au:N/C:C/I:C/A:CCVSS 3.xHIGH 7.8
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HReferences
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6b7339f4c31ad69c8e9c0b2859276e22cf72176d
- http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.4
- http://www.securityfocus.com/bid/93591
- https://bugzilla.redhat.com/show_bug.cgi?id=1333830
- https://github.com/torvalds/linux/commit/6b7339f4c31ad69c8e9c0b2859276e22cf72176d
- https://security-tracker.debian.org/tracker/CVE-2015-3288
- https://source.android.com/security/bulletin/2017-01-01.html
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6b7339f4c31ad69c8e9c0b2859276e22cf72176d
- http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.4
- http://www.securityfocus.com/bid/93591
- https://bugzilla.redhat.com/show_bug.cgi?id=1333830
- https://github.com/torvalds/linux/commit/6b7339f4c31ad69c8e9c0b2859276e22cf72176d
- https://security-tracker.debian.org/tracker/CVE-2015-3288
- https://source.android.com/security/bulletin/2017-01-01.html
LOW2.1
arch/x86/entry/entry_64.S in the Linux kernel before 4.1.6 on the x86_64 platform does not properly determine when nested NMI processing is occurring, which allows local users to cause a denial of service (skipped NMI) by modifying the rsp register, issuing a syscall instruction, and triggering an NMI.
CVSS 2.0LOW 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:PReferences
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=810bc075f78ff2c221536eb3008eac6a492dba2d
- http://www.debian.org/security/2015/dsa-3313
- http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.6
- http://www.openwall.com/lists/oss-security/2015/07/22/7
- http://www.securityfocus.com/bid/76003
- http://www.ubuntu.com/usn/USN-2687-1
- http://www.ubuntu.com/usn/USN-2688-1
- http://www.ubuntu.com/usn/USN-2689-1
- http://www.ubuntu.com/usn/USN-2690-1
- http://www.ubuntu.com/usn/USN-2691-1
- https://bugzilla.redhat.com/show_bug.cgi?id=1243489
- https://github.com/torvalds/linux/commit/810bc075f78ff2c221536eb3008eac6a492dba2d
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=810bc075f78ff2c221536eb3008eac6a492dba2d
- http://www.debian.org/security/2015/dsa-3313
- http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.6
- http://www.openwall.com/lists/oss-security/2015/07/22/7
- http://www.securityfocus.com/bid/76003
- http://www.ubuntu.com/usn/USN-2687-1
- http://www.ubuntu.com/usn/USN-2688-1
- http://www.ubuntu.com/usn/USN-2689-1
- http://www.ubuntu.com/usn/USN-2690-1
- http://www.ubuntu.com/usn/USN-2691-1
- https://bugzilla.redhat.com/show_bug.cgi?id=1243489
- https://github.com/torvalds/linux/commit/810bc075f78ff2c221536eb3008eac6a492dba2d
MEDIUM6.2
Race condition in the prepare_binprm function in fs/exec.c in the Linux kernel before 3.19.6 allows local users to gain privileges by executing a setuid program at a time instant when a chown to root is in progress, and the ownership is changed but the setuid bit is not yet stripped.
CVSS 2.0MEDIUM 6.2
CVSS:2.0/AV:L/AC:H/Au:N/C:C/I:C/A:CReferences
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=8b01fc86b9f425899f8a3a8fc1c47d73c2c20543
- http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157897.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158804.html
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00011.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00007.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00008.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00009.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00011.html
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00038.html
- http://rhn.redhat.com/errata/RHSA-2015-1272.html
- http://www.debian.org/security/2015/dsa-3237
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.19.6
- http://www.openwall.com/lists/oss-security/2015/04/20/5
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- http://www.securitytracker.com/id/1032412
- https://bugzilla.redhat.com/show_bug.cgi?id=1214030
- https://github.com/torvalds/linux/commit/8b01fc86b9f425899f8a3a8fc1c47d73c2c20543
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=8b01fc86b9f425899f8a3a8fc1c47d73c2c20543
- http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157897.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158804.html
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00011.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00007.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00008.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00009.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00011.html
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00038.html
- http://rhn.redhat.com/errata/RHSA-2015-1272.html
- http://www.debian.org/security/2015/dsa-3237
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.19.6
- http://www.openwall.com/lists/oss-security/2015/04/20/5
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- http://www.securitytracker.com/id/1032412
- https://bugzilla.redhat.com/show_bug.cgi?id=1214030
- https://github.com/torvalds/linux/commit/8b01fc86b9f425899f8a3a8fc1c47d73c2c20543
MEDIUM4.9
The ping_unhash function in net/ipv4/ping.c in the Linux kernel before 4.0.3 does not initialize a certain list data structure during an unhash operation, which allows local users to gain privileges or cause a denial of service (use-after-free and system crash) by leveraging the ability to make a SOCK_DGRAM socket system call for the IPPROTO_ICMP or IPPROTO_ICMPV6 protocol, and then making a connect system call after a disconnect.
CVSS 2.0MEDIUM 4.9
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:CReferences
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=a134f083e79fb4c3d0a925691e732c56911b4326
- http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157788.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157897.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158804.html
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00023.html
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00011.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00004.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00007.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00008.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00009.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00011.html
- http://rhn.redhat.com/errata/RHSA-2015-1221.html
- http://rhn.redhat.com/errata/RHSA-2015-1534.html
- http://rhn.redhat.com/errata/RHSA-2015-1564.html
- http://rhn.redhat.com/errata/RHSA-2015-1583.html
- http://rhn.redhat.com/errata/RHSA-2015-1643.html
- http://www.debian.org/security/2015/dsa-3290
- http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.0.3
- http://www.openwall.com/lists/oss-security/2015/05/02/5
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.securityfocus.com/bid/74450
- http://www.securitytracker.com/id/1033186
- http://www.ubuntu.com/usn/USN-2631-1
- http://www.ubuntu.com/usn/USN-2632-1
- http://www.ubuntu.com/usn/USN-2633-1
- http://www.ubuntu.com/usn/USN-2634-1
- https://bugzilla.redhat.com/show_bug.cgi?id=1218074
- https://github.com/torvalds/linux/commit/a134f083e79fb4c3d0a925691e732c56911b4326
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=a134f083e79fb4c3d0a925691e732c56911b4326
- http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157788.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157897.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158804.html
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00023.html
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00011.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00004.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00007.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00008.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00009.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00011.html
- http://rhn.redhat.com/errata/RHSA-2015-1221.html
- http://rhn.redhat.com/errata/RHSA-2015-1534.html
- http://rhn.redhat.com/errata/RHSA-2015-1564.html
- http://rhn.redhat.com/errata/RHSA-2015-1583.html
- http://rhn.redhat.com/errata/RHSA-2015-1643.html
- http://www.debian.org/security/2015/dsa-3290
- http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.0.3
- http://www.openwall.com/lists/oss-security/2015/05/02/5
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.securityfocus.com/bid/74450
- http://www.securitytracker.com/id/1033186
- http://www.ubuntu.com/usn/USN-2631-1
- http://www.ubuntu.com/usn/USN-2632-1
- http://www.ubuntu.com/usn/USN-2633-1
- http://www.ubuntu.com/usn/USN-2634-1
- https://bugzilla.redhat.com/show_bug.cgi?id=1218074
- https://github.com/torvalds/linux/commit/a134f083e79fb4c3d0a925691e732c56911b4326
CRITICAL9.0
Integer signedness error in the oz_hcd_get_desc_cnf function in drivers/staging/ozwpan/ozhcd.c in the OZWPAN driver in the Linux kernel through 4.0.5 allows remote attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a crafted packet.
CVSS 2.0CRITICAL 9.0
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:CReferences
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b1bb5b49373b61bf9d2c73a4d30058ba6f069e4c
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00011.html
- http://openwall.com/lists/oss-security/2015/06/05/7
- http://www.securityfocus.com/bid/74672
- http://www.ubuntu.com/usn/USN-2665-1
- http://www.ubuntu.com/usn/USN-2667-1
- https://github.com/torvalds/linux/commit/b1bb5b49373b61bf9d2c73a4d30058ba6f069e4c
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b1bb5b49373b61bf9d2c73a4d30058ba6f069e4c
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00011.html
- http://openwall.com/lists/oss-security/2015/06/05/7
- http://www.securityfocus.com/bid/74672
- http://www.ubuntu.com/usn/USN-2665-1
- http://www.ubuntu.com/usn/USN-2667-1
- https://github.com/torvalds/linux/commit/b1bb5b49373b61bf9d2c73a4d30058ba6f069e4c
HIGH7.2
Array index error in the tcm_vhost_make_tpg function in drivers/vhost/scsi.c in the Linux kernel before 4.0 might allow guest OS users to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted VHOST_SCSI_SET_ENDPOINT ioctl call. NOTE: the affected function was renamed to vhost_scsi_make_tpg before the vulnerability was announced.
CVSS 2.0HIGH 7.2
CVSS:2.0/AV:L/AC:L/Au:N/C:C/I:C/A:CReferences
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=59c816c1f24df0204e01851431d3bab3eb76719c
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00049.html
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00011.html
- http://www.openwall.com/lists/oss-security/2015/05/13/4
- http://www.securityfocus.com/bid/74664
- http://www.securitytracker.com/id/1033729
- http://www.ubuntu.com/usn/USN-2633-1
- http://www.ubuntu.com/usn/USN-2634-1
- https://bugzilla.redhat.com/show_bug.cgi?id=1189864
- https://github.com/torvalds/linux/commit/59c816c1f24df0204e01851431d3bab3eb76719c
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=59c816c1f24df0204e01851431d3bab3eb76719c
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00049.html
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00011.html
- http://www.openwall.com/lists/oss-security/2015/05/13/4
- http://www.securityfocus.com/bid/74664
- http://www.securitytracker.com/id/1033729
- http://www.ubuntu.com/usn/USN-2633-1
- http://www.ubuntu.com/usn/USN-2634-1
- https://bugzilla.redhat.com/show_bug.cgi?id=1189864
- https://github.com/torvalds/linux/commit/59c816c1f24df0204e01851431d3bab3eb76719c
MEDIUM4.7
The udf_read_inode function in fs/udf/inode.c in the Linux kernel before 3.19.1 does not validate certain length values, which allows local users to cause a denial of service (incorrect data representation or integer overflow, and OOPS) via a crafted UDF filesystem.
CVSS 2.0MEDIUM 4.7
CVSS:2.0/AV:L/AC:M/Au:N/C:N/I:N/A:CReferences
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=23b133bdc452aa441fcb9b82cbf6dd05cfd342d0
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00049.html
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00011.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00018.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00021.html
- http://www.debian.org/security/2015/dsa-3290
- http://www.debian.org/security/2015/dsa-3313
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.19.1
- http://www.openwall.com/lists/oss-security/2015/06/02/6
- http://www.securityfocus.com/bid/74963
- http://www.securitytracker.com/id/1033187
- http://www.ubuntu.com/usn/USN-2631-1
- http://www.ubuntu.com/usn/USN-2632-1
- https://bugzilla.redhat.com/show_bug.cgi?id=1228204
- https://github.com/torvalds/linux/commit/23b133bdc452aa441fcb9b82cbf6dd05cfd342d0
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=23b133bdc452aa441fcb9b82cbf6dd05cfd342d0
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00049.html
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00011.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00018.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00021.html
- http://www.debian.org/security/2015/dsa-3290
- http://www.debian.org/security/2015/dsa-3313
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.19.1
- http://www.openwall.com/lists/oss-security/2015/06/02/6
- http://www.securityfocus.com/bid/74963
- http://www.securitytracker.com/id/1033187
- http://www.ubuntu.com/usn/USN-2631-1
- http://www.ubuntu.com/usn/USN-2632-1
- https://bugzilla.redhat.com/show_bug.cgi?id=1228204
- https://github.com/torvalds/linux/commit/23b133bdc452aa441fcb9b82cbf6dd05cfd342d0
MEDIUM5.5
fs/namespace.c in the Linux kernel before 4.0.2 does not properly support mount connectivity, which allows local users to read arbitrary files by leveraging user-namespace root access for deletion of a file or directory.
CVSS 2.0LOW 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:P/A:NCVSS 3.xMEDIUM 5.5
CVSS:3.x/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NReferences
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e0c9c0afd2fc958ffa34b697972721d81df8a56f
- http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.0.2
- http://www.openwall.com/lists/oss-security/2015/06/04/5
- https://bugzilla.redhat.com/show_bug.cgi?id=1249442
- https://github.com/torvalds/linux/commit/e0c9c0afd2fc958ffa34b697972721d81df8a56f
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e0c9c0afd2fc958ffa34b697972721d81df8a56f
- http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.0.2
- http://www.openwall.com/lists/oss-security/2015/06/04/5
- https://bugzilla.redhat.com/show_bug.cgi?id=1249442
- https://github.com/torvalds/linux/commit/e0c9c0afd2fc958ffa34b697972721d81df8a56f
MEDIUM5.5
The collect_mounts function in fs/namespace.c in the Linux kernel before 4.0.5 does not properly consider that it may execute after a path has been unmounted, which allows local users to cause a denial of service (system crash) by leveraging user-namespace root access for an MNT_DETACH umount2 system call.
CVSS 2.0MEDIUM 4.9
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:CCVSS 3.xMEDIUM 5.5
CVSS:3.x/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HReferences
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=cd4a40174b71acd021877341684d8bb1dc8ea4ae
- http://openwall.com/lists/oss-security/2015/05/29/10
- http://openwall.com/lists/oss-security/2015/05/29/5
- http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.0.5
- http://www.openwall.com/lists/oss-security/2015/06/04/5
- https://bugzilla.redhat.com/show_bug.cgi?id=1248486
- https://github.com/torvalds/linux/commit/cd4a40174b71acd021877341684d8bb1dc8ea4ae
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=cd4a40174b71acd021877341684d8bb1dc8ea4ae
- http://openwall.com/lists/oss-security/2015/05/29/10
- http://openwall.com/lists/oss-security/2015/05/29/5
- http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.0.5
- http://www.openwall.com/lists/oss-security/2015/06/04/5
- https://bugzilla.redhat.com/show_bug.cgi?id=1248486
- https://github.com/torvalds/linux/commit/cd4a40174b71acd021877341684d8bb1dc8ea4ae
MEDIUM5.5
The fs_pin implementation in the Linux kernel before 4.0.5 does not ensure the internal consistency of a certain list data structure, which allows local users to cause a denial of service (system crash) by leveraging user-namespace root access for an MNT_DETACH umount2 system call, related to fs/fs_pin.c and include/linux/fs_pin.h.
CVSS 2.0MEDIUM 4.9
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:CCVSS 3.xMEDIUM 5.5
CVSS:3.x/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HReferences
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=820f9f147dcce2602eefd9b575bbbd9ea14f0953
- http://openwall.com/lists/oss-security/2015/05/29/10
- http://openwall.com/lists/oss-security/2015/05/29/5
- http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.0.5
- http://www.openwall.com/lists/oss-security/2015/06/04/5
- https://bugzilla.redhat.com/show_bug.cgi?id=1249849
- https://github.com/torvalds/linux/commit/820f9f147dcce2602eefd9b575bbbd9ea14f0953
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=820f9f147dcce2602eefd9b575bbbd9ea14f0953
- http://openwall.com/lists/oss-security/2015/05/29/10
- http://openwall.com/lists/oss-security/2015/05/29/5
- http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.0.5
- http://www.openwall.com/lists/oss-security/2015/06/04/5
- https://bugzilla.redhat.com/show_bug.cgi?id=1249849
- https://github.com/torvalds/linux/commit/820f9f147dcce2602eefd9b575bbbd9ea14f0953
MEDIUM4.9
The kvm_apic_has_events function in arch/x86/kvm/lapic.h in the Linux kernel through 4.1.3 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by leveraging /dev/kvm access for an ioctl call.
CVSS 2.0MEDIUM 4.9
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:CReferences
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ce40cd3fc7fa40a6119e5fe6c0f2bc0eb4541009
- http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160829.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-June/161144.html
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00049.html
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00011.html
- http://www.debian.org/security/2015/dsa-3329
- http://www.openwall.com/lists/oss-security/2015/06/21/1
- http://www.securityfocus.com/bid/75142
- http://www.securitytracker.com/id/1032798
- http://www.ubuntu.com/usn/USN-2680-1
- http://www.ubuntu.com/usn/USN-2681-1
- http://www.ubuntu.com/usn/USN-2682-1
- http://www.ubuntu.com/usn/USN-2683-1
- http://www.ubuntu.com/usn/USN-2684-1
- https://bugzilla.redhat.com/show_bug.cgi?id=1230770
- https://github.com/torvalds/linux/commit/ce40cd3fc7fa40a6119e5fe6c0f2bc0eb4541009
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ce40cd3fc7fa40a6119e5fe6c0f2bc0eb4541009
- http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160829.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-June/161144.html
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00049.html
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00011.html
- http://www.debian.org/security/2015/dsa-3329
- http://www.openwall.com/lists/oss-security/2015/06/21/1
- http://www.securityfocus.com/bid/75142
- http://www.securitytracker.com/id/1032798
- http://www.ubuntu.com/usn/USN-2680-1
- http://www.ubuntu.com/usn/USN-2681-1
- http://www.ubuntu.com/usn/USN-2682-1
- http://www.ubuntu.com/usn/USN-2683-1
- http://www.ubuntu.com/usn/USN-2684-1
- https://bugzilla.redhat.com/show_bug.cgi?id=1230770
- https://github.com/torvalds/linux/commit/ce40cd3fc7fa40a6119e5fe6c0f2bc0eb4541009
MEDIUM4.9
The bpf_int_jit_compile function in arch/x86/net/bpf_jit_comp.c in the Linux kernel before 4.0.6 allows local users to cause a denial of service (system crash) by creating a packet filter and then loading crafted BPF instructions that trigger late convergence by the JIT compiler.
CVSS 2.0MEDIUM 4.9
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:CReferences
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=3f7352bf21f8fd7ba3e2fcef9488756f188e12be
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00023.html
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00011.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00004.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00007.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00008.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00009.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00010.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00011.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00018.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00021.html
- http://rhn.redhat.com/errata/RHSA-2015-1778.html
- http://www.debian.org/security/2015/dsa-3329
- http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.0.6
- http://www.openwall.com/lists/oss-security/2015/06/23/2
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- http://www.securityfocus.com/bid/75356
- http://www.securitytracker.com/id/1033046
- http://www.ubuntu.com/usn/USN-2679-1
- http://www.ubuntu.com/usn/USN-2680-1
- http://www.ubuntu.com/usn/USN-2681-1
- http://www.ubuntu.com/usn/USN-2683-1
- http://www.ubuntu.com/usn/USN-2684-1
- https://bugzilla.redhat.com/show_bug.cgi?id=1233615
- https://github.com/torvalds/linux/commit/3f7352bf21f8fd7ba3e2fcef9488756f188e12be
- https://support.f5.com/csp/article/K05211147
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=3f7352bf21f8fd7ba3e2fcef9488756f188e12be
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00023.html
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00011.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00004.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00007.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00008.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00009.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00010.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00011.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00018.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00021.html
- http://rhn.redhat.com/errata/RHSA-2015-1778.html
- http://www.debian.org/security/2015/dsa-3329
- http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.0.6
- http://www.openwall.com/lists/oss-security/2015/06/23/2
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- http://www.securityfocus.com/bid/75356
- http://www.securitytracker.com/id/1033046
- http://www.ubuntu.com/usn/USN-2679-1
- http://www.ubuntu.com/usn/USN-2680-1
- http://www.ubuntu.com/usn/USN-2681-1
- http://www.ubuntu.com/usn/USN-2683-1
- http://www.ubuntu.com/usn/USN-2684-1
- https://bugzilla.redhat.com/show_bug.cgi?id=1233615
- https://github.com/torvalds/linux/commit/3f7352bf21f8fd7ba3e2fcef9488756f188e12be
- https://support.f5.com/csp/article/K05211147
MEDIUM5.0
The (1) udp_recvmsg and (2) udpv6_recvmsg functions in the Linux kernel before 4.0.6 provide inappropriate -EAGAIN return values, which allows remote attackers to cause a denial of service (EPOLLET epoll application read outage) via an incorrect checksum in a UDP packet, a different vulnerability than CVE-2015-5364.
CVSS 2.0MEDIUM 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:PReferences
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=beb39db59d14990e401e235faf66a6b9b31240b0
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00023.html
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00049.html
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00011.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00004.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00007.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00008.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00009.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00010.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00011.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00018.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00021.html
- http://rhn.redhat.com/errata/RHSA-2015-1623.html
- http://rhn.redhat.com/errata/RHSA-2015-1778.html
- http://rhn.redhat.com/errata/RHSA-2015-1787.html
- http://rhn.redhat.com/errata/RHSA-2016-0045.html
- http://rhn.redhat.com/errata/RHSA-2016-1096.html
- http://rhn.redhat.com/errata/RHSA-2016-1100.html
- http://www.debian.org/security/2015/dsa-3313
- http://www.debian.org/security/2015/dsa-3329
- http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.0.6
- http://www.openwall.com/lists/oss-security/2015/06/30/13
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- http://www.securityfocus.com/bid/75510
- http://www.securitytracker.com/id/1032794
- http://www.ubuntu.com/usn/USN-2680-1
- http://www.ubuntu.com/usn/USN-2681-1
- http://www.ubuntu.com/usn/USN-2682-1
- http://www.ubuntu.com/usn/USN-2683-1
- http://www.ubuntu.com/usn/USN-2684-1
- http://www.ubuntu.com/usn/USN-2713-1
- http://www.ubuntu.com/usn/USN-2714-1
- https://access.redhat.com/errata/RHSA-2016:1225
- https://bugzilla.redhat.com/show_bug.cgi?id=1239029
- https://github.com/torvalds/linux/commit/beb39db59d14990e401e235faf66a6b9b31240b0
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=beb39db59d14990e401e235faf66a6b9b31240b0
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00023.html
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00049.html
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00011.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00004.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00007.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00008.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00009.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00010.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00011.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00018.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00021.html
- http://rhn.redhat.com/errata/RHSA-2015-1623.html
- http://rhn.redhat.com/errata/RHSA-2015-1778.html
- http://rhn.redhat.com/errata/RHSA-2015-1787.html
- http://rhn.redhat.com/errata/RHSA-2016-0045.html
- http://rhn.redhat.com/errata/RHSA-2016-1096.html
- http://rhn.redhat.com/errata/RHSA-2016-1100.html
- http://www.debian.org/security/2015/dsa-3313
- http://www.debian.org/security/2015/dsa-3329
- http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.0.6
- http://www.openwall.com/lists/oss-security/2015/06/30/13
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- http://www.securityfocus.com/bid/75510
- http://www.securitytracker.com/id/1032794
- http://www.ubuntu.com/usn/USN-2680-1
- http://www.ubuntu.com/usn/USN-2681-1
- http://www.ubuntu.com/usn/USN-2682-1
- http://www.ubuntu.com/usn/USN-2683-1
- http://www.ubuntu.com/usn/USN-2684-1
- http://www.ubuntu.com/usn/USN-2713-1
- http://www.ubuntu.com/usn/USN-2714-1
- https://access.redhat.com/errata/RHSA-2016:1225
- https://bugzilla.redhat.com/show_bug.cgi?id=1239029
- https://github.com/torvalds/linux/commit/beb39db59d14990e401e235faf66a6b9b31240b0
LOW2.1
The get_bitmap_file function in drivers/md/md.c in the Linux kernel before 4.1.6 does not initialize a certain bitmap data structure, which allows local users to obtain sensitive information from kernel memory via a GET_BITMAP_FILE ioctl call.
CVSS 2.0LOW 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:P/I:N/A:NReferences
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b6878d9e03043695dbf3fa1caa6dfc09db225b16
- http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163661.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163711.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-August/164137.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-August/164193.html
- http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00009.html
- http://www.debian.org/security/2015/dsa-3329
- http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.6
- http://www.openwall.com/lists/oss-security/2015/07/28/2
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.securityfocus.com/bid/76066
- http://www.securitytracker.com/id/1033211
- http://www.ubuntu.com/usn/USN-2731-1
- http://www.ubuntu.com/usn/USN-2732-1
- http://www.ubuntu.com/usn/USN-2748-1
- http://www.ubuntu.com/usn/USN-2749-1
- http://www.ubuntu.com/usn/USN-2751-1
- http://www.ubuntu.com/usn/USN-2752-1
- http://www.ubuntu.com/usn/USN-2777-1
- https://bugzilla.redhat.com/show_bug.cgi?id=1249011
- https://github.com/torvalds/linux/commit/b6878d9e03043695dbf3fa1caa6dfc09db225b16
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b6878d9e03043695dbf3fa1caa6dfc09db225b16
- http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163661.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163711.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-August/164137.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-August/164193.html
- http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00009.html
- http://www.debian.org/security/2015/dsa-3329
- http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.6
- http://www.openwall.com/lists/oss-security/2015/07/28/2
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.securityfocus.com/bid/76066
- http://www.securitytracker.com/id/1033211
- http://www.ubuntu.com/usn/USN-2731-1
- http://www.ubuntu.com/usn/USN-2732-1
- http://www.ubuntu.com/usn/USN-2748-1
- http://www.ubuntu.com/usn/USN-2749-1
- http://www.ubuntu.com/usn/USN-2751-1
- http://www.ubuntu.com/usn/USN-2752-1
- http://www.ubuntu.com/usn/USN-2777-1
- https://bugzilla.redhat.com/show_bug.cgi?id=1249011
- https://github.com/torvalds/linux/commit/b6878d9e03043695dbf3fa1caa6dfc09db225b16
MEDIUM4.6
Use-after-free vulnerability in the path_openat function in fs/namei.c in the Linux kernel 3.x and 4.x before 4.0.4 allows local users to cause a denial of service or possibly have unspecified other impact via O_TMPFILE filesystem operations that leverage a duplicate cleanup operation.
CVSS 2.0MEDIUM 4.6
CVSS:2.0/AV:L/AC:L/Au:N/C:P/I:P/A:PReferences
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f15133df088ecadd141ea1907f2c96df67c729f0
- http://twitter.com/grsecurity/statuses/597127122910490624
- http://www.debian.org/security/2015/dsa-3329
- http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.0.4
- http://www.openwall.com/lists/oss-security/2015/08/01/5
- http://www.securityfocus.com/bid/76142
- http://www.ubuntu.com/usn/USN-2680-1
- http://www.ubuntu.com/usn/USN-2681-1
- https://bugzilla.redhat.com/show_bug.cgi?id=1250047
- https://github.com/torvalds/linux/commit/f15133df088ecadd141ea1907f2c96df67c729f0
- https://source.android.com/security/bulletin/2017-01-01.html
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f15133df088ecadd141ea1907f2c96df67c729f0
- http://twitter.com/grsecurity/statuses/597127122910490624
- http://www.debian.org/security/2015/dsa-3329
- http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.0.4
- http://www.openwall.com/lists/oss-security/2015/08/01/5
- http://www.securityfocus.com/bid/76142
- http://www.ubuntu.com/usn/USN-2680-1
- http://www.ubuntu.com/usn/USN-2681-1
- https://bugzilla.redhat.com/show_bug.cgi?id=1250047
- https://github.com/torvalds/linux/commit/f15133df088ecadd141ea1907f2c96df67c729f0
- https://source.android.com/security/bulletin/2017-01-01.html
MEDIUM4.6
Integer overflow in the sg_start_req function in drivers/scsi/sg.c in the Linux kernel 2.6.x through 4.x before 4.1 allows local users to cause a denial of service or possibly have unspecified other impact via a large iov_count value in a write request.
CVSS 2.0MEDIUM 4.6
CVSS:2.0/AV:L/AC:L/Au:N/C:P/I:P/A:PReferences
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=451a2886b6bf90e2fb378f7c46c655450fb96e81
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=fdc81f45e9f57858da6351836507fbcf1b7583ee
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00004.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00018.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00021.html
- http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00026.html
- http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00027.html
- http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00028.html
- http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00029.html
- http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00030.html
- http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00031.html
- http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00032.html
- http://www.debian.org/security/2015/dsa-3329
- http://www.openwall.com/lists/oss-security/2015/08/01/6
- http://www.securityfocus.com/bid/76145
- http://www.securitytracker.com/id/1033521
- http://www.ubuntu.com/usn/USN-2733-1
- http://www.ubuntu.com/usn/USN-2734-1
- http://www.ubuntu.com/usn/USN-2737-1
- http://www.ubuntu.com/usn/USN-2738-1
- http://www.ubuntu.com/usn/USN-2750-1
- http://www.ubuntu.com/usn/USN-2759-1
- http://www.ubuntu.com/usn/USN-2760-1
- https://bugzilla.redhat.com/show_bug.cgi?id=1250030
- https://github.com/torvalds/linux/commit/451a2886b6bf90e2fb378f7c46c655450fb96e81
- https://github.com/torvalds/linux/commit/fdc81f45e9f57858da6351836507fbcf1b7583ee
- https://source.android.com/security/bulletin/2017-07-01
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=451a2886b6bf90e2fb378f7c46c655450fb96e81
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=fdc81f45e9f57858da6351836507fbcf1b7583ee
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00004.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00018.html
- http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00021.html
- http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00026.html
- http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00027.html
- http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00028.html
- http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00029.html
- http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00030.html
- http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00031.html
- http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00032.html
- http://www.debian.org/security/2015/dsa-3329
- http://www.openwall.com/lists/oss-security/2015/08/01/6
- http://www.securityfocus.com/bid/76145
- http://www.securitytracker.com/id/1033521
- http://www.ubuntu.com/usn/USN-2733-1
- http://www.ubuntu.com/usn/USN-2734-1
- http://www.ubuntu.com/usn/USN-2737-1
- http://www.ubuntu.com/usn/USN-2738-1
- http://www.ubuntu.com/usn/USN-2750-1
- http://www.ubuntu.com/usn/USN-2759-1
- http://www.ubuntu.com/usn/USN-2760-1
- https://bugzilla.redhat.com/show_bug.cgi?id=1250030
- https://github.com/torvalds/linux/commit/451a2886b6bf90e2fb378f7c46c655450fb96e81
- https://github.com/torvalds/linux/commit/fdc81f45e9f57858da6351836507fbcf1b7583ee
- https://source.android.com/security/bulletin/2017-07-01
LOW2.1
The vhost_dev_ioctl function in drivers/vhost/vhost.c in the Linux kernel before 4.1.5 allows local users to cause a denial of service (memory consumption) via a VHOST_SET_LOG_FD ioctl call that triggers permanent file-descriptor allocation.
CVSS 2.0LOW 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:PReferences
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=7932c0bd7740f4cd2aa168d3ce0199e7af7d72d5
- http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00009.html
- http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00035.html
- http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00013.html
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00038.html
- http://www.debian.org/security/2015/dsa-3364
- http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.5
- http://www.openwall.com/lists/oss-security/2015/08/18/3
- http://www.securityfocus.com/bid/76400
- http://www.securitytracker.com/id/1033666
- http://www.ubuntu.com/usn/USN-2748-1
- http://www.ubuntu.com/usn/USN-2749-1
- http://www.ubuntu.com/usn/USN-2751-1
- http://www.ubuntu.com/usn/USN-2752-1
- http://www.ubuntu.com/usn/USN-2759-1
- http://www.ubuntu.com/usn/USN-2760-1
- http://www.ubuntu.com/usn/USN-2777-1
- https://bugzilla.redhat.com/show_bug.cgi?id=1251839
- https://github.com/torvalds/linux/commit/7932c0bd7740f4cd2aa168d3ce0199e7af7d72d5
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=7932c0bd7740f4cd2aa168d3ce0199e7af7d72d5
- http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00009.html
- http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00035.html
- http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00013.html
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00038.html
- http://www.debian.org/security/2015/dsa-3364
- http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.5
- http://www.openwall.com/lists/oss-security/2015/08/18/3
- http://www.securityfocus.com/bid/76400
- http://www.securitytracker.com/id/1033666
- http://www.ubuntu.com/usn/USN-2748-1
- http://www.ubuntu.com/usn/USN-2749-1
- http://www.ubuntu.com/usn/USN-2751-1
- http://www.ubuntu.com/usn/USN-2752-1
- http://www.ubuntu.com/usn/USN-2759-1
- http://www.ubuntu.com/usn/USN-2760-1
- http://www.ubuntu.com/usn/USN-2777-1
- https://bugzilla.redhat.com/show_bug.cgi?id=1251839
- https://github.com/torvalds/linux/commit/7932c0bd7740f4cd2aa168d3ce0199e7af7d72d5
MEDIUM4.9
The perf_callchain_user_64 function in arch/powerpc/perf/callchain.c in the Linux kernel before 4.0.2 on ppc64 platforms allows local users to cause a denial of service (infinite loop) via a deep 64-bit userspace backtrace.
CVSS 2.0MEDIUM 4.9
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:CReferences
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=9a5cbce421a283e6aea3c4007f141735bf9da8c3
- http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.0.2
- http://www.openwall.com/lists/oss-security/2015/08/18/4
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- http://www.securityfocus.com/bid/76401
- http://www.securitytracker.com/id/1033728
- http://www.ubuntu.com/usn/USN-2759-1
- http://www.ubuntu.com/usn/USN-2760-1
- https://bugzilla.redhat.com/show_bug.cgi?id=1218454
- https://github.com/torvalds/linux/commit/9a5cbce421a283e6aea3c4007f141735bf9da8c3
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=9a5cbce421a283e6aea3c4007f141735bf9da8c3
- http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.0.2
- http://www.openwall.com/lists/oss-security/2015/08/18/4
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- http://www.securityfocus.com/bid/76401
- http://www.securitytracker.com/id/1033728
- http://www.ubuntu.com/usn/USN-2759-1
- http://www.ubuntu.com/usn/USN-2760-1
- https://bugzilla.redhat.com/show_bug.cgi?id=1218454
- https://github.com/torvalds/linux/commit/9a5cbce421a283e6aea3c4007f141735bf9da8c3
HIGH7.8
The skb_copy_and_csum_datagram_iovec function in net/core/datagram.c in the Linux kernel 3.14.54 and 3.18.22 does not accept a length argument, which allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact via a write system call followed by a recvmsg system call.
CVSS 2.0HIGH 7.2
CVSS:2.0/AV:L/AC:L/Au:N/C:C/I:C/A:CCVSS 3.xHIGH 7.8
CVSS:3.x/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HReferences
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00003.html
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00008.html
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00009.html
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00018.html
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00021.html
- http://patchwork.ozlabs.org/patch/530642/
- http://www.openwall.com/lists/oss-security/2015/10/27/11
- http://www.securityfocus.com/bid/77326
- https://bugzilla.redhat.com/show_bug.cgi?id=1276588
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00003.html
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00008.html
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00009.html
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00018.html
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00021.html
- http://patchwork.ozlabs.org/patch/530642/
- http://www.openwall.com/lists/oss-security/2015/10/27/11
- http://www.securityfocus.com/bid/77326
- https://bugzilla.redhat.com/show_bug.cgi?id=1276588
MEDIUM5.0
net/ipv6/addrconf.c in the IPv6 stack in the Linux kernel before 4.0 does not validate attempted changes to the MTU value, which allows context-dependent attackers to cause a denial of service (packet loss) via a value that is (1) smaller than the minimum compliant value or (2) larger than the MTU of an interface, as demonstrated by a Router Advertisement (RA) message that is not validated by a daemon, a different vulnerability than CVE-2015-0272. NOTE: the scope of CVE-2015-0272 is limited to the NetworkManager product.
CVSS 2.0MEDIUM 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:PReferences
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=77751427a1ff25b27d47a4c36b12c3c8667855ac
- http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00005.html
- http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00018.html
- http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00026.html
- http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00031.html
- http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00013.html
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00038.html
- http://rhn.redhat.com/errata/RHSA-2016-0855.html
- http://www.debian.org/security/2015/dsa-3364
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
- http://www.securityfocus.com/bid/85274
- https://bugs.launchpad.net/bugs/1500810
- https://bugzilla.novell.com/show_bug.cgi?id=944296
- https://bugzilla.redhat.com/show_bug.cgi?id=1192132
- https://github.com/torvalds/linux/commit/77751427a1ff25b27d47a4c36b12c3c8667855ac
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=77751427a1ff25b27d47a4c36b12c3c8667855ac
- http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00005.html
- http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00018.html
- http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00026.html
- http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00031.html
- http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00013.html
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00038.html
- http://rhn.redhat.com/errata/RHSA-2016-0855.html
- http://www.debian.org/security/2015/dsa-3364
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
- http://www.securityfocus.com/bid/85274
- https://bugs.launchpad.net/bugs/1500810
- https://bugzilla.novell.com/show_bug.cgi?id=944296
- https://bugzilla.redhat.com/show_bug.cgi?id=1192132
- https://github.com/torvalds/linux/commit/77751427a1ff25b27d47a4c36b12c3c8667855ac
MEDIUM5.5
arch/arm64/mm/dma-mapping.c in the Linux kernel before 4.0.3, as used in the ION subsystem in Android and other products, does not initialize certain data structures, which allows local users to obtain sensitive information from kernel memory by triggering a dma_mmap call.
CVSS 2.0MEDIUM 4.3
CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:N/A:NCVSS 3.xMEDIUM 5.5
CVSS:3.x/CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NReferences
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6829e274a623187c24f7cfc0e3d35f25d087fcc5
- http://source.android.com/security/bulletin/2016-10-01.html
- http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.0.3
- http://www.securityfocus.com/bid/93318
- https://github.com/torvalds/linux/commit/6829e274a623187c24f7cfc0e3d35f25d087fcc5
- https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=6e2c437a2d0a85d90d3db85a7471f99764f7bbf8
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6829e274a623187c24f7cfc0e3d35f25d087fcc5
- http://source.android.com/security/bulletin/2016-10-01.html
- http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.0.3
- http://www.securityfocus.com/bid/93318
- https://github.com/torvalds/linux/commit/6829e274a623187c24f7cfc0e3d35f25d087fcc5
- https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=6e2c437a2d0a85d90d3db85a7471f99764f7bbf8
HIGH7.3
arch/arm64/kernel/perf_event.c in the Linux kernel before 4.1 on arm64 platforms allows local users to gain privileges or cause a denial of service (invalid pointer dereference) via vectors involving events that are mishandled during a span of multiple HW PMUs.
CVSS 2.0MEDIUM 6.9
CVSS:2.0/AV:L/AC:M/Au:N/C:C/I:C/A:CCVSS 3.xHIGH 7.3
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:HReferences
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8fff105e13041e49b82f92eef034f363a6b1c071
- http://source.android.com/security/bulletin/2016-10-01.html
- http://www.securityfocus.com/bid/93314
- https://github.com/torvalds/linux/commit/8fff105e13041e49b82f92eef034f363a6b1c071
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8fff105e13041e49b82f92eef034f363a6b1c071
- http://source.android.com/security/bulletin/2016-10-01.html
- http://www.securityfocus.com/bid/93314
- https://github.com/torvalds/linux/commit/8fff105e13041e49b82f92eef034f363a6b1c071
HIGH7.8
arch/arm64/kernel/sys.c in the Linux kernel before 4.0 allows local users to bypass the "strict page permissions" protection mechanism and modify the system-call table, and consequently gain privileges, by leveraging write access.
CVSS 2.0CRITICAL 9.3
CVSS:2.0/AV:N/AC:M/Au:N/C:C/I:C/A:CCVSS 3.xHIGH 7.8
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HReferences
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=c623b33b4e9599c6ac5076f7db7369eb9869aa04
- http://source.android.com/security/bulletin/2016-12-01.html
- http://www.securityfocus.com/bid/94680
- https://github.com/torvalds/linux/commit/c623b33b4e9599c6ac5076f7db7369eb9869aa04
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=c623b33b4e9599c6ac5076f7db7369eb9869aa04
- http://source.android.com/security/bulletin/2016-12-01.html
- http://www.securityfocus.com/bid/94680
- https://github.com/torvalds/linux/commit/c623b33b4e9599c6ac5076f7db7369eb9869aa04
HIGH7.8
kernel/events/core.c in the Linux kernel before 3.19 mishandles counter grouping, which allows local users to gain privileges via a crafted application, related to the perf_pmu_register and perf_event_open functions.
CVSS 2.0CRITICAL 9.3
CVSS:2.0/AV:N/AC:M/Au:N/C:C/I:C/A:CCVSS 3.xHIGH 7.8
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HReferences
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=c3c87e770458aa004bd7ed3f29945ff436fd6511
- http://www.securityfocus.com/bid/98166
- https://github.com/torvalds/linux/commit/c3c87e770458aa004bd7ed3f29945ff436fd6511
- https://source.android.com/security/bulletin/2017-05-01
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=c3c87e770458aa004bd7ed3f29945ff436fd6511
- http://www.securityfocus.com/bid/98166
- https://github.com/torvalds/linux/commit/c3c87e770458aa004bd7ed3f29945ff436fd6511
- https://source.android.com/security/bulletin/2017-05-01
MEDIUM5.5
In the Linux kernel before 4.1.4, a buffer overflow occurs when checking userspace params in drivers/media/dvb-frontends/cx24116.c. The maximum size for a DiSEqC command is 6, according to the userspace API. However, the code allows larger values such as 23.
CVSS 2.0MEDIUM 4.9
CVSS:2.0/AV:L/AC:L/Au:N/C:C/I:N/A:NCVSS 3.xMEDIUM 5.5
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NReferences
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=1fa2337a315a2448c5434f41e00d56b01a22283c
- https://github.com/torvalds/linux/commit/1fa2337a315a2448c5434f41e00d56b01a22283c
- https://mirrors.edge.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.4
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=1fa2337a315a2448c5434f41e00d56b01a22283c
- https://github.com/torvalds/linux/commit/1fa2337a315a2448c5434f41e00d56b01a22283c
- https://mirrors.edge.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.4
MEDIUM4.0
The pagemap_open function in fs/proc/task_mmu.c in the Linux kernel before 3.19.3, as used in Android 6.0.1 before 2016-03-01, allows local users to obtain sensitive physical-address information by reading a pagemap file, aka Android internal bug 25739721.
CVSS 2.0LOW 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:P/I:N/A:NCVSS 3.xMEDIUM 4.0
CVSS:3.x/CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NReferences
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ab676b7d6fbf4b294bf198fb27ade5b0e865c7ce
- http://googleprojectzero.blogspot.com/2015/03/exploiting-dram-rowhammer-bug-to-gain.html
- http://source.android.com/security/bulletin/2016-03-01.html
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.19.3
- http://www.securityfocus.com/bid/84265
- https://github.com/torvalds/linux/commit/ab676b7d6fbf4b294bf198fb27ade5b0e865c7ce
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ab676b7d6fbf4b294bf198fb27ade5b0e865c7ce
- http://googleprojectzero.blogspot.com/2015/03/exploiting-dram-rowhammer-bug-to-gain.html
- http://source.android.com/security/bulletin/2016-03-01.html
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.19.3
- http://www.securityfocus.com/bid/84265
- https://github.com/torvalds/linux/commit/ab676b7d6fbf4b294bf198fb27ade5b0e865c7ce
HIGH7.0
The msm_ipc_router_bind_control_port function in net/ipc_router/ipc_router_core.c in the IPC router kernel module for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not verify that a port is a client port, which allows attackers to gain privileges or cause a denial of service (race condition and list corruption) by making many BIND_CONTROL_PORT ioctl calls.
CVSS 2.0MEDIUM 4.4
CVSS:2.0/AV:L/AC:M/Au:N/C:P/I:P/A:PCVSS 3.xHIGH 7.0
CVSS:3.x/CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HReferences
- http://source.android.com/security/bulletin/2016-10-01.html
- http://www.securityfocus.com/bid/90230
- http://www.securitytracker.com/id/1035765
- https://us.codeaurora.org/cgit/quic/la/kernel/msm-3.18/commit/?id=9e8bdd63f7011dff5523ea435433834b3702398d
- https://www.codeaurora.org/projects/security-advisories/linux-ipc-router-binding-any-port-control-port-cve-2016-2059
- http://source.android.com/security/bulletin/2016-10-01.html
- http://www.securityfocus.com/bid/90230
- http://www.securitytracker.com/id/1035765
- https://us.codeaurora.org/cgit/quic/la/kernel/msm-3.18/commit/?id=9e8bdd63f7011dff5523ea435433834b3702398d
- https://www.codeaurora.org/projects/security-advisories/linux-ipc-router-binding-any-port-control-port-cve-2016-2059
HIGH7.8
Integer signedness error in the MSM V4L2 video driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to gain privileges or cause a denial of service (array overflow and memory corruption) via a crafted application that triggers an msm_isp_axi_create_stream call.
CVSS 2.0MEDIUM 6.8
CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:PCVSS 3.xHIGH 7.8
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HReferences
- http://source.android.com/security/bulletin/2016-06-01.html
- https://us.codeaurora.org/cgit/quic/la//kernel/msm-3.18/commit/id=79db14ca9f791a14be9376a0340ad3b9b9a4d603
- https://www.codeaurora.org/array-overflow-msm-v4l2-video-driver-allows-kernel-memory-corruption-cve-2016-2061
- http://source.android.com/security/bulletin/2016-06-01.html
- https://us.codeaurora.org/cgit/quic/la//kernel/msm-3.18/commit/id=79db14ca9f791a14be9376a0340ad3b9b9a4d603
- https://www.codeaurora.org/array-overflow-msm-v4l2-video-driver-allows-kernel-memory-corruption-cve-2016-2061
HIGH7.8
The adreno_perfcounter_query_group function in drivers/gpu/msm/adreno_perfcounter.c in the Adreno GPU driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, uses an incorrect integer data type, which allows attackers to cause a denial of service (integer overflow, heap-based buffer overflow, and incorrect memory allocation) or possibly have unspecified other impact via a crafted IOCTL_KGSL_PERFCOUNTER_QUERY ioctl call.
CVSS 2.0MEDIUM 4.6
CVSS:2.0/AV:L/AC:L/Au:N/C:P/I:P/A:PCVSS 3.xHIGH 7.8
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HReferences
- http://source.android.com/security/bulletin/2016-06-01.html
- http://www.securitytracker.com/id/1035766
- https://codeaurora.org/cgit/quic/la/kernel/msm-3.18/commit/?id=27c95b64b2e4b5ff1288cbaa6e353dd803d71576
- https://www.codeaurora.org/buffer-overflow-adreno-gpu-msm-driver-cve-2016-2062
- http://source.android.com/security/bulletin/2016-06-01.html
- http://www.securitytracker.com/id/1035766
- https://codeaurora.org/cgit/quic/la/kernel/msm-3.18/commit/?id=27c95b64b2e4b5ff1288cbaa6e353dd803d71576
- https://www.codeaurora.org/buffer-overflow-adreno-gpu-msm-driver-cve-2016-2062
HIGH7.8
Stack-based buffer overflow in the supply_lm_input_write function in drivers/thermal/supply_lm_core.c in the MSM Thermal driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted application that sends a large amount of data through the debugfs interface.
CVSS 2.0MEDIUM 4.6
CVSS:2.0/AV:L/AC:L/Au:N/C:P/I:P/A:PCVSS 3.xHIGH 7.8
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HReferences
- http://www.securityfocus.com/bid/92381
- https://us.codeaurora.org/cgit/quic/la/kernel/msm-3.10/commit/?id=ab3f46119ca10de87a11fe966b0723c48f27acd4
- https://www.codeaurora.org/stack-overflow-msm-thermal-driver-allows-kernel-memory-corruption-cve-2016-2063
- http://www.securityfocus.com/bid/92381
- https://us.codeaurora.org/cgit/quic/la/kernel/msm-3.10/commit/?id=ab3f46119ca10de87a11fe966b0723c48f27acd4
- https://www.codeaurora.org/stack-overflow-msm-thermal-driver-allows-kernel-memory-corruption-cve-2016-2063
HIGH7.8
sound/soc/msm/qdsp6v2/msm-audio-effects-q6-v2.c in the MSM QDSP6 audio driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted application that makes an ioctl call specifying many commands.
CVSS 2.0MEDIUM 6.9
CVSS:2.0/AV:L/AC:M/Au:N/C:C/I:C/A:CCVSS 3.xHIGH 7.8
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HReferences
- http://www.securityfocus.com/bid/92375
- https://us.codeaurora.org/cgit/quic/la/kernel/msm-3.18/commit/?id=775fca8289eff931f91ff6e8c36cf2034ba59e88
- https://www.codeaurora.org/multiple-vulnerabilities-msm-qdsp6-audio-driver-allow-kernel-memory-corruption-cve-2016-2064-cve
- http://www.securityfocus.com/bid/92375
- https://us.codeaurora.org/cgit/quic/la/kernel/msm-3.18/commit/?id=775fca8289eff931f91ff6e8c36cf2034ba59e88
- https://www.codeaurora.org/multiple-vulnerabilities-msm-qdsp6-audio-driver-allow-kernel-memory-corruption-cve-2016-2064-cve
HIGH7.8
sound/soc/msm/qdsp6v2/msm-audio-effects-q6-v2.c in the MSM QDSP6 audio driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to cause a denial of service (out-of-bounds write and memory corruption) or possibly have unspecified other impact via a crafted application that makes an ioctl call triggering incorrect use of a parameters pointer.
CVSS 2.0MEDIUM 6.8
CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:PCVSS 3.xHIGH 7.8
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HReferences
- http://www.securityfocus.com/bid/92376
- https://us.codeaurora.org/cgit/quic/la/kernel/msm-3.18/commit/?id=775fca8289eff931f91ff6e8c36cf2034ba59e88
- https://www.codeaurora.org/multiple-vulnerabilities-msm-qdsp6-audio-driver-allow-kernel-memory-corruption-cve-2016-2064-cve
- http://www.securityfocus.com/bid/92376
- https://us.codeaurora.org/cgit/quic/la/kernel/msm-3.18/commit/?id=775fca8289eff931f91ff6e8c36cf2034ba59e88
- https://www.codeaurora.org/multiple-vulnerabilities-msm-qdsp6-audio-driver-allow-kernel-memory-corruption-cve-2016-2064-cve
HIGH7.8
Integer signedness error in the MSM QDSP6 audio driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to gain privileges or cause a denial of service (memory corruption) via a crafted application that makes an ioctl call.
CVSS 2.0MEDIUM 6.8
CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:PCVSS 3.xHIGH 7.8
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HReferences
- http://source.android.com/security/bulletin/2016-06-01.html
- http://www.securityfocus.com/bid/91046
- https://us.codeaurora.org/cgit/quic/la/kernel/msm-3.18/commit/?id=775fca8289eff931f91ff6e8c36cf2034ba59e88
- https://www.codeaurora.org/multiple-vulnerabilities-msm-qdsp6-audio-driver-allow-kernel-memory-corruption-cve-2016-2064-cve
- http://source.android.com/security/bulletin/2016-06-01.html
- http://www.securityfocus.com/bid/91046
- https://us.codeaurora.org/cgit/quic/la/kernel/msm-3.18/commit/?id=775fca8289eff931f91ff6e8c36cf2034ba59e88
- https://www.codeaurora.org/multiple-vulnerabilities-msm-qdsp6-audio-driver-allow-kernel-memory-corruption-cve-2016-2064-cve
HIGH7.8
drivers/gpu/msm/kgsl.c in the MSM graphics driver (aka GPU driver) for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, mishandles the KGSL_MEMFLAGS_GPUREADONLY flag, which allows attackers to gain privileges by leveraging accidental read-write mappings, aka Qualcomm internal bug CR988993.
CVSS 2.0CRITICAL 9.3
CVSS:2.0/AV:N/AC:M/Au:N/C:C/I:C/A:CCVSS 3.xHIGH 7.8
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HReferences
- http://source.android.com/security/bulletin/2016-07-01.html
- https://source.codeaurora.org/quic/la//kernel/msm-3.18/commit/?id=410cfa95f0a1cf58819cbfbd896f9aa45b004ac0
- https://www.codeaurora.org/privilege-escalation-vulnerability-graphics-driver-cve-2016-2067
- http://source.android.com/security/bulletin/2016-07-01.html
- https://source.codeaurora.org/quic/la//kernel/msm-3.18/commit/?id=410cfa95f0a1cf58819cbfbd896f9aa45b004ac0
- https://www.codeaurora.org/privilege-escalation-vulnerability-graphics-driver-cve-2016-2067
HIGH7.8
The MSM QDSP6 audio driver (aka sound driver) for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to gain privileges or cause a denial of service (integer overflow, and buffer overflow or buffer over-read) via a crafted application that performs a (1) AUDIO_EFFECTS_WRITE or (2) AUDIO_EFFECTS_READ operation, aka Qualcomm internal bug CR1006609.
CVSS 2.0MEDIUM 6.8
CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:PCVSS 3.xHIGH 7.8
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HReferences
- http://source.android.com/security/bulletin/2016-07-01.html
- https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=01ee86da5a0cd788f134e360e2be517ef52b6b00
- https://us.codeaurora.org/cgit/quic/la/kernel/msm-3.10/commit/?id=9900650540c889f761d102202bc80306ae80ab83
- https://us.codeaurora.org/cgit/quic/la/kernel/msm-3.18/commit/?id=2c04c0dab66013b7dfbe4d5a523c2c1d6b5b11d6
- https://www.codeaurora.org/multiple-vulnerabilities-msm-qdsp6-audio-driver-allow-kernel-memory-corruption-cve-2016-2068-0
- http://source.android.com/security/bulletin/2016-07-01.html
- https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=01ee86da5a0cd788f134e360e2be517ef52b6b00
- https://us.codeaurora.org/cgit/quic/la/kernel/msm-3.10/commit/?id=9900650540c889f761d102202bc80306ae80ab83
- https://us.codeaurora.org/cgit/quic/la/kernel/msm-3.18/commit/?id=2c04c0dab66013b7dfbe4d5a523c2c1d6b5b11d6
- https://www.codeaurora.org/multiple-vulnerabilities-msm-qdsp6-audio-driver-allow-kernel-memory-corruption-cve-2016-2068-0
HIGH7.8
The is_ashmem_file function in drivers/staging/android/ashmem.c in a certain Qualcomm Innovation Center (QuIC) Android patch for the Linux kernel 3.x mishandles pointer validation within the KGSL Linux Graphics Module, which allows attackers to bypass intended access restrictions by using the /ashmem string as the dentry name.
CVSS 2.0HIGH 7.2
CVSS:2.0/AV:L/AC:L/Au:N/C:C/I:C/A:CCVSS 3.xHIGH 7.8
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HReferences
- http://source.android.com/security/bulletin/2016-10-01.html
- http://www.securityfocus.com/bid/92374
- http://www.securitytracker.com/id/1036763
- https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=06e51489061e5473b4e2035c79dcf7c27a6f75a6
- https://www.codeaurora.org/invalid-path-check-ashmem-memory-file-cve-2016-5340
- http://source.android.com/security/bulletin/2016-10-01.html
- http://www.securityfocus.com/bid/92374
- http://www.securitytracker.com/id/1036763
- https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=06e51489061e5473b4e2035c79dcf7c27a6f75a6
- https://www.codeaurora.org/invalid-path-check-ashmem-memory-file-cve-2016-5340
HIGH7.8
Heap-based buffer overflow in the wcnss_wlan_write function in drivers/net/wireless/wcnss/wcnss_wlan.c in the wcnss_wlan device driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to cause a denial of service or possibly have unspecified other impact by writing to /dev/wcnss_wlan with an unexpected amount of data.
CVSS 2.0HIGH 7.2
CVSS:2.0/AV:L/AC:L/Au:N/C:C/I:C/A:CCVSS 3.xHIGH 7.8
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HReferences
- http://source.android.com/security/bulletin/2016-10-01.html
- http://www.securityfocus.com/bid/92693
- https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=579e796cb089324c55e0e689a180575ba81b23d9
- https://www.codeaurora.org/buffer-overflow-vulnerability-wcnsswlanwrite-cve-2016-5342
- http://source.android.com/security/bulletin/2016-10-01.html
- http://www.securityfocus.com/bid/92693
- https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=579e796cb089324c55e0e689a180575ba81b23d9
- https://www.codeaurora.org/buffer-overflow-vulnerability-wcnsswlanwrite-cve-2016-5342
CRITICAL9.8
drivers/soc/qcom/qdsp6v2/voice_svc.c in the QDSP6v2 Voice Service driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a write request, as demonstrated by a voice_svc_send_req buffer overflow.
CVSS 2.0HIGH 7.5
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:PCVSS 3.xCRITICAL 9.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HReferences
- http://source.android.com/security/bulletin/2016-10-01.html
- http://www.securityfocus.com/bid/93330
- https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=6927e2e0af4dcac357be86ba563c9ae12354bb08
- https://www.codeaurora.org/multiple-memory-corruption-issues-write-operation-qdsp6v2-voice-service-driver-cve-2016-5343
- http://source.android.com/security/bulletin/2016-10-01.html
- http://www.securityfocus.com/bid/93330
- https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=6927e2e0af4dcac357be86ba563c9ae12354bb08
- https://www.codeaurora.org/multiple-memory-corruption-issues-write-operation-qdsp6v2-voice-service-driver-cve-2016-5343
CRITICAL9.8
Multiple integer overflows in the MDSS driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allow attackers to cause a denial of service or possibly have unspecified other impact via a large size value, related to mdss_compat_utils.c, mdss_fb.c, and mdss_rotator.c.
CVSS 2.0HIGH 7.5
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:PCVSS 3.xCRITICAL 9.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HReferences
- http://source.android.com/security/bulletin/2016-10-01.html
- http://www.securityfocus.com/bid/92695
- https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=1d2297267c24f2c44bd0ecb244ddb8bc880a29b7
- https://www.codeaurora.org/integer-overflow-mdss-driver-cve-2016-5344
- http://source.android.com/security/bulletin/2016-10-01.html
- http://www.securityfocus.com/bid/92695
- https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=1d2297267c24f2c44bd0ecb244ddb8bc880a29b7
- https://www.codeaurora.org/integer-overflow-mdss-driver-cve-2016-5344
HIGH7.8
The msm_ipc_router_close function in net/ipc_router/ipc_router_socket.c in the ipc_router component for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allow attackers to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact by triggering failure of an accept system call for an AF_MSM_IPC socket.
CVSS 2.0MEDIUM 4.6
CVSS:2.0/AV:L/AC:L/Au:N/C:P/I:P/A:PCVSS 3.xHIGH 7.8
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HReferences
- http://www.securityfocus.com/bid/97414
- https://source.codeaurora.org/quic/la//kernel/msm-3.18/commit/?id=71fe5361cbef34e2d606b79e8936a910a3e95566
- https://www.codeaurora.org/null-pointer-dereference-when-processing-accept-system-call-user-process-afmsmipc-sockets-cve-2016
- http://www.securityfocus.com/bid/97414
- https://source.codeaurora.org/quic/la//kernel/msm-3.18/commit/?id=71fe5361cbef34e2d606b79e8936a910a3e95566
- https://www.codeaurora.org/null-pointer-dereference-when-processing-accept-system-call-user-process-afmsmipc-sockets-cve-2016
HIGH7.0
kernel/events/core.c in the performance subsystem in the Linux kernel before 4.0 mismanages locks during certain migrations, which allows local users to gain privileges via a crafted application, aka Android internal bug 30955111.
CVSS 2.0MEDIUM 6.9
CVSS:2.0/AV:L/AC:M/Au:N/C:C/I:C/A:CCVSS 3.xHIGH 7.0
CVSS:3.x/CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HReferences
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f63a8daa5812afef4f06c962351687e1ff9ccb2b
- http://source.android.com/security/bulletin/2016-12-01.html
- http://www.debian.org/security/2017/dsa-3791
- http://www.securityfocus.com/bid/94679
- https://bugzilla.redhat.com/show_bug.cgi?id=1403842
- https://github.com/torvalds/linux/commit/f63a8daa5812afef4f06c962351687e1ff9ccb2b
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f63a8daa5812afef4f06c962351687e1ff9ccb2b
- http://source.android.com/security/bulletin/2016-12-01.html
- http://www.debian.org/security/2017/dsa-3791
- http://www.securityfocus.com/bid/94679
- https://bugzilla.redhat.com/show_bug.cgi?id=1403842
- https://github.com/torvalds/linux/commit/f63a8daa5812afef4f06c962351687e1ff9ccb2b
HIGH7.0
kernel/events/core.c in the performance subsystem in the Linux kernel before 4.0 mismanages locks during certain migrations, which allows local users to gain privileges via a crafted application, aka Android internal bug 31095224.
CVSS 2.0MEDIUM 6.9
CVSS:2.0/AV:L/AC:M/Au:N/C:C/I:C/A:CCVSS 3.xHIGH 7.0
CVSS:3.x/CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HReferences
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f63a8daa5812afef4f06c962351687e1ff9ccb2b
- http://source.android.com/security/bulletin/2016-12-01.html
- http://www.debian.org/security/2017/dsa-3791
- http://www.securityfocus.com/bid/94679
- https://bugzilla.redhat.com/show_bug.cgi?id=1403842
- https://github.com/torvalds/linux/commit/f63a8daa5812afef4f06c962351687e1ff9ccb2b
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f63a8daa5812afef4f06c962351687e1ff9ccb2b
- http://source.android.com/security/bulletin/2016-12-01.html
- http://www.debian.org/security/2017/dsa-3791
- http://www.securityfocus.com/bid/94679
- https://bugzilla.redhat.com/show_bug.cgi?id=1403842
- https://github.com/torvalds/linux/commit/f63a8daa5812afef4f06c962351687e1ff9ccb2b
HIGH7.8
The bnep_add_connection function in net/bluetooth/bnep/core.c in the Linux kernel before 3.19 does not ensure that an l2cap socket is available, which allows local users to gain privileges via a crafted application.
CVSS 2.0HIGH 7.2
CVSS:2.0/AV:L/AC:L/Au:N/C:C/I:C/A:CCVSS 3.xHIGH 7.8
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HReferences
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=71bb99a02b32b4cc4265118e85f6035ca72923f0
- http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00007.html
- http://www.securityfocus.com/bid/102084
- https://github.com/torvalds/linux/commit/71bb99a02b32b4cc4265118e85f6035ca72923f0
- https://lists.debian.org/debian-lts-announce/2017/12/msg00004.html
- https://patchwork.kernel.org/patch/9882449/
- https://source.android.com/security/bulletin/pixel/2017-12-01
- https://usn.ubuntu.com/3583-1/
- https://usn.ubuntu.com/3583-2/
- https://www.debian.org/security/2018/dsa-4082
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=71bb99a02b32b4cc4265118e85f6035ca72923f0
- http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00007.html
- http://www.securityfocus.com/bid/102084
- https://github.com/torvalds/linux/commit/71bb99a02b32b4cc4265118e85f6035ca72923f0
- https://lists.debian.org/debian-lts-announce/2017/12/msg00004.html
- https://patchwork.kernel.org/patch/9882449/
- https://source.android.com/security/bulletin/pixel/2017-12-01
- https://usn.ubuntu.com/3583-1/
- https://usn.ubuntu.com/3583-2/
- https://www.debian.org/security/2018/dsa-4082
HIGH7.5
The TCP stack in the Linux kernel 3.x does not properly implement a SYN cookie protection mechanism for the case of a fast network connection, which allows remote attackers to cause a denial of service (CPU consumption) by sending many TCP SYN packets, as demonstrated by an attack against the kernel-3.10.0 package in CentOS Linux 7. NOTE: third parties have been unable to discern any relationship between the GitHub Engineering finding and the Trigemini.c attack code.
CVSS 2.0HIGH 7.8
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:CCVSS 3.xHIGH 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HReferences
- http://seclists.org/oss-sec/2017/q1/573
- http://www.securityfocus.com/bid/96231
- https://access.redhat.com/security/cve/cve-2017-5972
- https://bugzilla.redhat.com/show_bug.cgi?id=1422081
- https://cxsecurity.com/issue/WLB-2017020112
- https://githubengineering.com/syn-flood-mitigation-with-synsanity/
- https://packetstormsecurity.com/files/141083/CentOS7-Kernel-Denial-Of-Service.html
- https://security-tracker.debian.org/tracker/CVE-2017-5972
- https://www.exploit-db.com/exploits/41350/
- http://seclists.org/oss-sec/2017/q1/573
- http://www.securityfocus.com/bid/96231
- https://access.redhat.com/security/cve/cve-2017-5972
- https://bugzilla.redhat.com/show_bug.cgi?id=1422081
- https://cxsecurity.com/issue/WLB-2017020112
- https://githubengineering.com/syn-flood-mitigation-with-synsanity/
- https://packetstormsecurity.com/files/141083/CentOS7-Kernel-Denial-Of-Service.html
- https://security-tracker.debian.org/tracker/CVE-2017-5972
- https://www.exploit-db.com/exploits/41350/
HIGH7.5
In the Linux kernel before 5.0.3, a memory leak exits in hsr_dev_finalize() in net/hsr/hsr_device.c if hsr_add_port fails to add a port, which may cause denial of service, aka CID-6caabe7f197d.
CVSS 2.0HIGH 7.8
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:CCVSS 3.xHIGH 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HReferences
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00010.html
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00035.html
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.0.3
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6caabe7f197d3466d238f70915d65301f1716626
- https://github.com/torvalds/linux/commit/6caabe7f197d3466d238f70915d65301f1716626
- https://security.netapp.com/advisory/ntap-20191031-0005/
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00010.html
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00035.html
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.0.3
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6caabe7f197d3466d238f70915d65301f1716626
- https://github.com/torvalds/linux/commit/6caabe7f197d3466d238f70915d65301f1716626
- https://security.netapp.com/advisory/ntap-20191031-0005/
MEDIUM4.7
A flaw was found in the subsequent get_user_pages_fast in the Linux kernel’s interface for symmetric key cipher algorithms in the skcipher_recvmsg of crypto/algif_skcipher.c function. This flaw allows a local user to crash the system.
CVSS 3.xMEDIUM 4.7
CVSS:3.x/CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:HReferences
- https://access.redhat.com/security/cve/CVE-2023-3108
- https://bugzilla.redhat.com/show_bug.cgi?id=2221472
- https://github.com/torvalds/linux/commit/9399f0c51489ae8c16d6559b82a452fdc1895e91
- https://access.redhat.com/security/cve/CVE-2023-3108
- https://bugzilla.redhat.com/show_bug.cgi?id=2221472
- https://github.com/torvalds/linux/commit/9399f0c51489ae8c16d6559b82a452fdc1895e91
MEDIUM6.8
A race condition was found in the Linux kernel's net/bluetooth device driver in conn_info_{min,max}_age_set() function. This can result in integrity overflow issue, possibly leading to bluetooth connection abnormality or denial of service.
CVSS 3.xMEDIUM 6.8
CVSS:3.x/CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:HReferences
- https://bugzilla.openanolis.cn/show_bug.cgi?id=8155
- https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html
- https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html
- https://bugzilla.openanolis.cn/show_bug.cgi?id=8155
- https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html
- https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html
MEDIUM5.3
A race condition was found in the Linux kernel's net/bluetooth in {conn,adv}_{min,max}_interval_set() function. This can result in I2cap connection or broadcast abnormality issue, possibly leading to denial of service.
CVSS 3.xMEDIUM 5.3
CVSS:3.x/CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HReferences
- https://bugzilla.openanolis.cn/show_bug.cgi?id=8154
- https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html
- https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html
- https://bugzilla.openanolis.cn/show_bug.cgi?id=8154
- https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html
- https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html
MEDIUM4.8
A race condition was found in the Linux kernel's net/bluetooth in sniff_{min,max}_interval_set() function. This can result in a bluetooth sniffing exception issue, possibly leading denial of service.
CVSS 3.xMEDIUM 4.8
CVSS:3.x/CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H