ALT-PU-2016-2233-1 — kernel-image-un-def

BDU:2022-03979

MEDIUM4.7

Уязвимость функции load_elf_binary() ядра операционной системы Linux, позволяющая нарушителю обойти механизм защиты ASLR и раскрыть защищаемую информацию

Опубликовано: 2022-06-29Изменено: 2024-05-22

CVSS 3.xСРЕДНЯЯ 4.7

CVSS:3.x/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

CVSS 2.0СРЕДНЯЯ 4.4

CVSS:2.0/AV:L/AC:M/Au:S/C:C/I:N/A:N

Ссылки

CVE-2019-11190

CVE-2016-10905

HIGH7.8

An issue was discovered in fs/gfs2/rgrp.c in the Linux kernel before 4.8. A use-after-free is caused by the functions gfs2_clear_rgrpd and read_rindex_entry.

Опубликовано: 2019-08-19Изменено: 2024-11-21

CVSS 2.0СРЕДНЯЯ 6.1

CVSS:2.0/AV:L/AC:L/Au:N/C:P/I:P/A:C

CVSS 3.xВЫСОКАЯ 7.8

CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Ссылки

CVE-2016-7042

MEDIUM6.2

The proc_keys_show function in security/keys/proc.c in the Linux kernel through 4.8.2, when the GNU Compiler Collection (gcc) stack protector is enabled, uses an incorrect buffer size for certain timeout data, which allows local users to cause a denial of service (stack memory corruption and panic) by reading the /proc/keys file.

Опубликовано: 2016-10-16Изменено: 2025-04-12

CVSS 2.0СРЕДНЯЯ 4.9

CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:C

CVSS 3.xСРЕДНЯЯ 6.2

CVSS:3.x/CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Ссылки

CVE-2016-7097

MEDIUM4.4

The filesystem implementation in the Linux kernel through 4.8.2 preserves the setgid bit during a setxattr call, which allows local users to gain group privileges by leveraging the existence of a setgid program with restrictions on execute permissions.

Опубликовано: 2016-10-16Изменено: 2025-04-12

CVSS 2.0НИЗКАЯ 3.6

CVSS:2.0/AV:L/AC:L/Au:N/C:P/I:P/A:N

CVSS 3.xСРЕДНЯЯ 4.4

CVSS:3.x/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Ссылки

CVE-2016-8660

MEDIUM5.5

The XFS subsystem in the Linux kernel through 4.8.2 allows local users to cause a denial of service (fdatasync failure and system hang) by using the vfs syscall group in the trinity program, related to a "page lock order bug in the XFS seek hole/data implementation."

Опубликовано: 2016-10-16Изменено: 2025-04-12

CVSS 2.0СРЕДНЯЯ 4.9

CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:C

CVSS 3.xСРЕДНЯЯ 5.5

CVSS:3.x/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Ссылки

CVE-2017-15102

MEDIUM6.3

The tower_probe function in drivers/usb/misc/legousbtower.c in the Linux kernel before 4.8.1 allows local users (who are physically proximate for inserting a crafted USB device) to gain privileges by leveraging a write-what-where condition that occurs after a race condition and a NULL pointer dereference.

Опубликовано: 2017-11-15Изменено: 2025-04-20

CVSS 2.0СРЕДНЯЯ 6.9

CVSS:2.0/AV:L/AC:M/Au:N/C:C/I:C/A:C

CVSS 3.xСРЕДНЯЯ 6.3

CVSS:3.x/CVSS:3.0/AV:P/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Ссылки

CVE-2018-16597

MEDIUM5.5

An issue was discovered in the Linux kernel before 4.8. Incorrect access checking in overlayfs mounts could be used by local attackers to modify or truncate files in the underlying filesystem.

Опубликовано: 2018-09-21Изменено: 2024-11-21

CVSS 2.0СРЕДНЯЯ 4.9

CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:C/A:N

CVSS 3.xСРЕДНЯЯ 5.5

CVSS:3.x/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Ссылки

CVE-2019-11190

MEDIUM4.7

The Linux kernel before 4.8 allows local users to bypass ASLR on setuid programs (such as /bin/su) because install_exec_creds() is called too late in load_elf_binary() in fs/binfmt_elf.c, and thus the ptrace_may_access() check has a race condition when reading /proc/pid/stat.

Опубликовано: 2019-04-12Изменено: 2024-11-21

CVSS 2.0СРЕДНЯЯ 4.7

CVSS:2.0/AV:L/AC:M/Au:N/C:C/I:N/A:N

CVSS 3.xСРЕДНЯЯ 4.7

CVSS:3.x/CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Ссылки

CVE-2019-3901

MEDIUM4.7

A race condition in perf_event_open() allows local attackers to leak sensitive data from setuid programs. As no relevant locks (in particular the cred_guard_mutex) are held during the ptrace_may_access() call, it is possible for the specified target task to perform an execve() syscall with setuid execution before perf_event_alloc() actually attaches to it, allowing an attacker to bypass the ptrace_may_access() check and the perf_event_exit_task(current) call that is performed in install_exec_creds() during privileged execve() calls. This issue affects kernel versions before 4.8.

Опубликовано: 2019-04-22Изменено: 2024-11-21

CVSS 2.0НИЗКАЯ 1.9

CVSS:2.0/AV:L/AC:M/Au:N/C:P/I:N/A:N

CVSS 3.xСРЕДНЯЯ 4.7

CVSS:3.x/CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Ссылки

Обновление пакета kernel-image-un-def в ветке p8

Закрытые проблемы (9)

Уязвимость функции load_elf_binary() ядра операционной системы Linux, позволяющая нарушителю обойти механизм защиты ASLR и раскрыть защищаемую информацию

An issue was discovered in fs/gfs2/rgrp.c in the Linux kernel before 4.8. A use-after-free is caused by the functions gfs2_clear_rgrpd and read_rindex_entry.

The filesystem implementation in the Linux kernel through 4.8.2 preserves the setgid bit during a setxattr call, which allows local users to gain group privileges by leveraging the existence of a setgid program with restrictions on execute permissions.

The XFS subsystem in the Linux kernel through 4.8.2 allows local users to cause a denial of service (fdatasync failure and system hang) by using the vfs syscall group in the trinity program, related to a "page lock order bug in the XFS seek hole/data implementation."

An issue was discovered in the Linux kernel before 4.8. Incorrect access checking in overlayfs mounts could be used by local attackers to modify or truncate files in the underlying filesystem.

The Linux kernel before 4.8 allows local users to bypass ASLR on setuid programs (such as /bin/su) because install_exec_creds() is called too late in load_elf_binary() in fs/binfmt_elf.c, and thus the ptrace_may_access() check has a race condition when reading /proc/pid/stat.