Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 26,203

Export CSV
CVE-2023-3773

Kernel: xfrm: out-of-bounds read of xfrma_mtimer_thresh nlattr

A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAP_NET_ADMIN privileges to cause a 4 byte out-of-bounds read of XFRMA_MTIMER_THRESH when parsing netlink attributes, leading to potential leakage of sensitive heap data to userspace.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Linux and 1 more
Products
Debian Linux Fedora Linux Kernel and 2 more
CVE-2023-4273

Kernel: exfat: stack overflow in exfat_get_uniname_from_ext_entry

A flaw was found in the exFAT driver of the Linux kernel. The vulnerability exists in the implementation of the file name reconstruction function, which is responsible for reading file name entries from a directory index and merging file name parts belonging to one file into a single long file name. Since the file name characters are copied into a stack variable, a local privileged attacker could use this flaw to overflow the kernel stack.

CVSS 3.1 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Linux and 2 more
Products
Debian Linux Fedora Linux Kernel and 10 more
CVE-2023-4004

Kernel: netfilter: use-after-free due to improper element removal in nft_pipapo_remove()

A use-after-free flaw was found in the Linux kernel's netfilter in the way a user triggers the nft_pipapo_remove function with the element, without a NFT_SET_EXT_KEY_END. This issue could allow a local user to crash the system or potentially escalate their privileges on the system.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Linux and 2 more
Products
Debian Linux Fedora Linux Kernel and 11 more
CVE-2023-3108

Kernel: a race condition in crypto module in the function skcipher_recvmsg

A flaw was found in the subsequent get_user_pages_fast in the Linux kernel’s interface for symmetric key cipher algorithms in the skcipher_recvmsg of crypto/algif_skcipher.c function. This flaw allows a local user to crash the system.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Rhel Els
CVE-2023-4459

Kernel: vmxnet3: null pointer dereference in vmxnet3_rq_cleanup()

A NULL pointer dereference flaw was found in vmxnet3_rq_cleanup in drivers/net/vmxnet3/vmxnet3_drv.c in the networking sub-component in vmxnet3 in the Linux Kernel. This issue may allow a local attacker with normal user privilege to cause a denial of service due to a missing sanity check during cleanup.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Rhel Aus and 5 more
CVE-2023-42756

Kernel: netfilter: race condition between ipset_cmd_add and ipset_cmd_swap

A flaw was found in the Netfilter subsystem of the Linux kernel. A race condition between IPSET_CMD_ADD and IPSET_CMD_SWAP can lead to a kernel panic due to the invocation of `__ip_set_put` on a wrong `set`. This issue may allow a local user to crash the system.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Linux and 1 more
Products
Debian Linux Fedora Linux Kernel and 2 more
CVE-2023-39192

Kernel: netfilter: xtables out-of-bounds read in u32_match_it()

A flaw was found in the Netfilter subsystem in the Linux kernel. The xt_u32 module did not validate the fields in the xt_u32 structure. This flaw allows a local privileged attacker to trigger an out-of-bounds read by setting the size fields with a value beyond the array boundaries, leading to a crash or information disclosure.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Linux Redhat
Products
Fedora Linux Kernel Enterprise Linux and 1 more
CVE-2023-39193

Kernel: netfilter: xtables sctp out-of-bounds read in match_flags()

A flaw was found in the Netfilter subsystem in the Linux kernel. The sctp_mt_check did not validate the flag_count field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Linux Redhat
Products
Fedora Linux Kernel Enterprise Linux and 1 more
CVE-2023-39191

Kernel: ebpf: insufficient stack type checks in dynptr

An improper input validation flaw was found in the eBPF subsystem in the Linux kernel. The issue occurs due to a lack of proper validation of dynamic pointers within user-supplied eBPF programs prior to executing them. This may allow an attacker with CAP_BPF privileges to escalate privileges and execute arbitrary code in the context of the kernel.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Linux Redhat
Products
Fedora Linux Kernel Enterprise Linux and 2 more
CVE-2023-39194

Kernel: xfrm: out-of-bounds read in __xfrm_state_filter_match()

A flaw was found in the XFRM subsystem in the Linux kernel. The specific flaw exists within the processing of state filters, which can result in a read past the end of an allocated buffer. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, potentially leading to an information disclosure.

CVSS 3.1 · 3.2 Low EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Linux Redhat
Products
Fedora Linux Kernel Enterprise Linux and 1 more
CVE-2023-39189

Kernel: netfilter: nftables out-of-bounds read in nf_osf_match_one()

A flaw was found in the Netfilter subsystem in the Linux kernel. The nfnl_osf_add_callback function did not validate the user mode controlled opt_num field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure.

CVSS 3.1 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Linux Redhat
Products
Fedora Linux Kernel Enterprise Linux and 1 more
CVE-2023-3567

Kernel: use after free in vcs_read in drivers/tty/vt/vc_screen.c due to race

A use-after-free flaw was found in vcs_read in drivers/tty/vt/vc_screen.c in vc_screen in the Linux Kernel. This issue may allow an attacker with local user access to cause a system crash or leak internal kernel information.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Canonical Linux Redhat
Products
Ubuntu Linux Linux Kernel Enterprise Linux and 3 more
CVE-2023-4132

Kernel: smsusb: use-after-free caused by do_submit_urb()

A use-after-free vulnerability was found in the siano smsusb module in the Linux kernel. The bug occurs during device initialization when the siano device is plugged in. This flaw allows a local user to crash the system, causing a denial of service condition.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Linux and 1 more
Products
Debian Linux Fedora Linux Kernel and 6 more
CVE-2023-42753

Kernel: netfilter: potential slab-out-of-bound access due to integer underflow

An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro could lead to a miscalculation of the `h->nets` array offset, providing attackers with the primitive to arbitrarily increment/decrement a memory buffer out-of-bound. This issue may allow a local user to crash the system or potentially escalate their privileges on the system.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed
Vendors
Debian Linux Redhat
Products
Debian Linux Linux Kernel Enterprise Linux and 7 more
CVE-2023-4194

Kernel: tap: tap_open(): correctly initialize socket uid next fix of i_uid to current_fsuid

A flaw was found in the Linux kernel's TUN/TAP functionality. This issue could allow a local user to bypass network filters and gain unauthorized access to some resources. The original patches fixing CVE-2023-1076 are incorrect or incomplete. The problem is that the following upstream commits - a096ccca6e50 ("tun: tun_chr_open(): correctly initialize socket uid"), - 66b2c338adce ("tap: tap_open(): correctly initialize socket uid"), pass "inode->i_uid" to sock_init_data_uid() as the last parameter and that turns out to not be accurate.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Linux and 1 more
Products
Debian Linux Fedora Linux Kernel and 3 more
CVE-2023-42754

Kernel: ipv4: null pointer dereference in ipv4_send_dest_unreach()

A NULL pointer dereference flaw was found in the Linux kernel ipv4 stack. The socket buffer (skb) was assumed to be associated with a device before calling __ip_options_compile, which is not always the case if the skb is re-routed by ipvs. This issue may allow a local user with CAP_NET_ADMIN privileges to crash the system.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Linux Redhat
Products
Fedora Linux Kernel Enterprise Linux and 1 more
CVE-2023-4133

Kernel: cxgb4: use-after-free in ch_flower_stats_cb()

A use-after-free vulnerability was found in the cxgb4 driver in the Linux kernel. The bug occurs when the cxgb4 device is detaching due to a possible rearming of the flower_stats_timer from the work queue. This flaw allows a local user to crash the system, causing a denial of service condition.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Linux Redhat
Products
Fedora Linux Kernel Enterprise Linux and 1 more
CVE-2023-5090

Kernel: kvm: svm: improper check in svm_set_x2apic_msr_interception allows direct access to host x2apic msrs

A flaw was found in KVM. An improper check in svm_set_x2apic_msr_interception() may allow direct access to host x2apic msrs when the guest resets its apic, potentially leading to a denial of service condition.

CVSS 3.1 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Redhat
Products
Linux Kernel Enterprise Linux Rhel Els and 1 more
CVE-2023-3106

Kernel: netlink socket crash (null pointer deref) in netlink_dump function

A NULL pointer dereference vulnerability was found in netlink_dump. This issue can occur when the Netlink socket receives the message(sendmsg) for the XFRM_MSG_GETSA, XFRM_MSG_GETPOLICY type message, and the DUMP flag is set and can cause a denial of service or possibly another unspecified impact. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although it is unlikely.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Linux Redhat
Products
Fedora Linux Kernel Enterprise Linux and 1 more
CVE-2023-39198

Kernel: qxl: race condition leading to use-after-free in qxl_mode_dumb_create()

A race condition was found in the QXL driver in the Linux kernel. The qxl_mode_dumb_create() function dereferences the qobj returned by the qxl_gem_object_create_with_handle(), but the handle is the only one holding a reference to it. This flaw allows an attacker to guess the returned handle value and trigger a use-after-free issue, potentially leading to a denial of service or privilege escalation.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Linux Redhat
Products
Fedora Linux Kernel Enterprise Linux and 1 more