CVE-2014-9584

kernel: isofs: unchecked printing of ER records

The parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel before 3.18.2 does not validate a length value in the Extensions Reference (ER) System Use Field, which allows local users to obtain sensitive information from kernel memory via a crafted iso9660 image.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Linux and 4 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 19 more

CVE-2014-9585

kernel: ASLR bruteforce possible for vdso library

The vdso_addr function in arch/x86/vdso/vma.c in the Linux kernel through 3.18.2 does not properly choose memory locations for the vDSO area, which makes it easier for local users to bypass the ASLR protection mechanism by guessing a location at the end of a PMD.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 4 more

Products

Ubuntu Linux Debian Linux Fedora and 19 more

CVE-2014-9529

kernel: use-after-free during key garbage collection

Race condition in the key_gc_unused_keys function in security/keys/gc.c in the Linux kernel through 3.18.2 allows local users to cause a denial of service (memory corruption or panic) or possibly have unspecified other impact via keyctl commands that trigger access to a key structure member during garbage collection of a key.

CVSS 2.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 3 more

Products

Ubuntu Linux Debian Linux Fedora and 11 more

CVE-2015-8660

kernel: Permission bypass on overlayfs during copy_up

The ovl_setattr function in fs/overlayfs/inode.c in the Linux kernel through 4.3.3 attempts to merge distinct setattr operations, which allows local users to bypass intended access restrictions and modify the attributes of arbitrary overlay files via a crafted application.

CVSS 3.1 · 6.7 Medium EPSS 22.2% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Enterprise Mrg and 1 more

CVE-2015-8839

kernel: ext4 filesystem page fault race condition with fallocate call.

Multiple race conditions in the ext4 filesystem implementation in the Linux kernel before 4.5 allow local users to cause a denial of service (disk corruption) by writing to a page that is associated with a different user's file after unsynchronized hole punching and page-fault handling.

CVSS 3.1 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Linux Redhat

Products

Ubuntu Linux Linux Kernel Enterprise Linux and 2 more

CVE-2015-8970

kernel: crypto: GPF in lrw_crypt caused by null-deref

crypto/algif_skcipher.c in the Linux kernel before 4.4.2 does not verify that a setkey operation has been performed on an AF_ALG socket before an accept system call is processed, which allows local users to cause a denial of service (NULL pointer dereference and system crash) via a crafted application that does not supply a key, related to the lrw_crypt function in crypto/lrw.c.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Enterprise Mrg and 2 more

CVE-2014-9644

kernel: crypto api unprivileged arbitrary module load via request_module()

The Crypto API in the Linux kernel before 3.18.5 allows local users to load arbitrary kernel modules via a bind system call for an AF_ALG socket with a parenthesized module template expression in the salg_name field, as demonstrated by the vfat(aes) expression, a different vulnerability than CVE-2013-7421.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Linux and 2 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 4 more

CVE-2015-1350

kernel: denial of service in notify_change for filesystem xattrs

The VFS subsystem in the Linux kernel 3.x provides an incomplete set of requirements for setattr operations that underspecifies removing extended privilege attributes, which allows local users to cause a denial of service (capability stripping) via a failed invocation of a system call, as demonstrated by using chown to remove a capability from the ping or Wireshark dumpcap program.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Enterprise Mrg

CVE-2014-8173

kernel: NULL pointer dereference in madvise(MADV_WILLNEED) support

The pmd_none_or_trans_huge_or_clear_bad function in include/asm-generic/pgtable.h in the Linux kernel before 3.13 on NUMA systems does not properly determine whether a Page Middle Directory (PMD) entry is a transparent huge-table entry, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted MADV_WILLNEED madvise system call that leverages the absence of a page-table lock.

CVSS 3.0 · 6.2 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Enterprise Mrg

CVE-2016-3134

kernel: netfilter: missing bounds check in ipt_entry structure

The netfilter subsystem in the Linux kernel through 4.5.2 does not validate certain offset fields, which allows local users to gain privileges or cause a denial of service (heap memory corruption) via an IPT_SO_SET_REPLACE setsockopt call.

CVSS 3.0 · 8.4 High EPSS 1.2% KEV · Not listed

Vendors

Linux Novell Redhat

Products

Linux Kernel Suse Linux Enterprise Debuginfo Suse Linux Enterprise Desktop and 9 more

CVE-2014-8172

kernel: soft lockup on aio

The filesystem implementation in the Linux kernel before 3.13 performs certain operations on lists of files with an inappropriate locking approach, which allows local users to cause a denial of service (soft lockup or system crash) via unspecified use of Asynchronous I/O (AIO) operations.

CVSS 2.0 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Enterprise Mrg

CVE-2016-4470

kernel: Uninitialized variable in request_key handling causes kernel crash in error handling path

The key_reject_and_link function in security/keys/key.c in the Linux kernel through 4.6.3 does not ensure that a certain data structure is initialized, which allows local users to cause a denial of service (system crash) via vectors involving a crafted keyctl request2 command.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Novell Oracle and 1 more

Products

Linux Kernel Suse Linux Enterprise Real Time Extension Linux and 14 more

CVE-2014-8559

kernel: fs: deadlock due to incorrect usage of rename_lock

The d_walk function in fs/dcache.c in the Linux kernel through 3.17.2 does not properly maintain the semantics of rename_lock, which allows local users to cause a denial of service (deadlock and system hang) via a crafted application.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Linux Novell and 4 more

Products

Ubuntu Linux Linux Kernel Suse Linux Enterprise Desktop and 11 more

CVE-2016-4998

kernel: out of bounds reads when processing IPT_SO_SET_REPLACE setsockopt

The IPT_SO_SET_REPLACE setsockopt implementation in the netfilter subsystem in the Linux kernel before 4.6 allows local users to cause a denial of service (out-of-bounds read) or possibly obtain sensitive information from kernel heap memory by leveraging in-container root access to provide a crafted offset value that leads to crossing a ruleset blob boundary.

CVSS 3.0 · 7.1 High EPSS 1.9% KEV · Not listed

Vendors

Canonical Linux Oracle and 1 more

Products

Ubuntu Linux Linux Kernel Linux and 3 more

CVE-2014-8086

Kernel: fs: ext4 race condition

Race condition in the ext4_file_write_iter function in fs/ext4/file.c in the Linux kernel through 3.17 allows local users to cause a denial of service (file unavailability) via a combination of a write action and an F_SETFL fcntl operation for the O_DIRECT flag.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat Suse

Products

Linux Kernel Enterprise Linux Enterprise Mrg and 1 more

CVE-2016-7039

kernel: remotely triggerable unbounded recursion in the vlan gro code leading to a kernel crash

The IP stack in the Linux kernel through 4.8.2 allows remote attackers to cause a denial of service (stack consumption and panic) or possibly have unspecified other impact by triggering use of the GRO path for large crafted packets, as demonstrated by packets that contain only VLAN headers, a related issue to CVE-2016-8666.

CVSS 3.1 · 7.5 High EPSS 7.6% KEV · Not listed

Vendors

Linux Oracle Redhat

Products

Linux Kernel Linux Vm Server and 3 more

CVE-2014-8159

kernel: infiniband: uverbs: unprotected physical memory access

The InfiniBand (IB) implementation in the Linux kernel package before 2.6.32-504.12.2 on Red Hat Enterprise Linux (RHEL) 6 does not properly restrict use of User Verbs for registration of memory regions, which allows local users to access arbitrary physical memory locations, and consequently cause a denial of service (system crash) or gain privileges, by leveraging permissions on a uverbs device under /dev/infiniband/.

CVSS 2.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Linux and 1 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 6 more

CVE-2016-7097

kernel: Setting a POSIX ACL via setxattr doesn't clear the setgid bit

The filesystem implementation in the Linux kernel through 4.8.2 preserves the setgid bit during a setxattr call, which allows local users to gain group privileges by leveraging the existence of a setgid program with restrictions on execute permissions.

CVSS 3.0 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Enterprise Mrg and 1 more

CVE-2014-9322

kernel: x86: local privesc due to bad_iret and paranoid entry incompatibility

arch/x86/kernel/entry_64.S in the Linux kernel before 3.17.5 does not properly handle faults associated with the Stack Segment (SS) segment register, which allows local users to gain privileges by triggering an IRET instruction that leads to access to a GS Base address from the wrong space.

CVSS 3.1 · 7.8 High EPSS 1.5% KEV · Not listed

Vendors

Canonical Google Linux and 3 more

Products

Ubuntu Linux Android Linux Kernel and 8 more

CVE-2014-7822

kernel: splice: lack of generic write checks

The implementation of certain splice_write file operations in the Linux kernel before 3.16 does not enforce a restriction on the maximum size of a single file, which allows local users to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted splice system call, as demonstrated by use of a file descriptor associated with an ext4 filesystem.

CVSS 2.0 · 7.2 High EPSS 1.2% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Enterprise Mrg