Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 491

Export CSV
CVE-2020-10690

kernel: use-after-free in cdev_put() when a PTP device is removed while it's chardev is open

There is a use-after-free in kernel versions before 5.5 due to a race condition between the release of ptp_clock and cdev while resource deallocation. When a (high privileged) process allocates a ptp device file (like /dev/ptpX) and voluntarily goes to sleep. During this time if the underlying device is removed, it can cause an exploitable condition as the process wakes up to terminate and clean all attached files. The system crashes due to the cdev structure being invalid (as already freed) which is pointed to by the inode.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Linux and 3 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 31 more
CVE-2020-0466

kernel: use after free in eventpoll.c may lead to escalation of privilege

In do_epoll_ctl and ep_loop_check_proc of eventpoll.c, there is a possible use after free due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-147802478References: Upstream kernel

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Google Redhat
Products
Android Enterprise Linux Rhel Aus and 5 more
CVE-2020-0465

kernel: out of bounds write in hid-multitouch.c may lead to escalation of privilege

In various methods of hid-multitouch.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-162844689References: Upstream kernel

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Google Redhat
Products
Android Enterprise Linux Rhel Extras Rt
CVE-2020-0427

kernel: out-of-bounds reads in pinctrl subsystem.

In create_pinctrl of core.c, there is a possible out of bounds read due to a use after free. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-140550171

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Google Opensuse and 2 more
Products
Debian Linux Android Leap and 3 more
CVE-2019-9506

Blutooth BR/EDR specification does not specify sufficient encryption key length and allows an attacker to influence key length negotiation

The Bluetooth BR/EDR specification up to and including version 5.1 permits sufficiently low encryption key length and does not prevent an attacker from influencing the key length negotiation. This allows practical brute-force attacks (aka "KNOB") that can decrypt traffic and inject arbitrary ciphertext without the victim noticing.

CVSS 3.1 · 8.1 High EPSS 2.9% KEV · Not listed
Vendors
Apple Blackberry Canonical and 5 more
Products
Iphone Os Mac Os X Tvos and 277 more
CVE-2019-9503

Broadcom brcmfmac driver is vulnerable to a frame validation bypass

The Broadcom brcmfmac WiFi driver prior to commit a4176ec356c73a46c07c181c6d04039fafa34a9f is vulnerable to a frame validation bypass. If the brcmfmac driver receives a firmware event frame from a remote source, the is_wlc_event_frame function will cause this frame to be discarded and unprocessed. If the driver receives the firmware event frame from the host, the appropriate handler is called. This frame validation can be bypassed if the bus used is USB (for instance by a wifi dongle). This can allow firmware event frames from a remote source to be processed. In the worst case scenario, by sending specially-crafted WiFi packets, a remote, unauthenticated attacker may be able to execute arbitrary code on a vulnerable system. More typically, this vulnerability will result in denial-of-service conditions.

CVSS 3.1 · 7.9 High EPSS 3.3% KEV · Not listed
Vendors
Broadcom Redhat
Products
Brcmfmac Driver Enterprise Linux Rhel Eus and 1 more
CVE-2019-9500

Broadcom brcmfmac driver is vulnerable to a heap buffer overflow

The Broadcom brcmfmac WiFi driver prior to commit 1b5e2423164b3670e8bc9174e4762d297990deff is vulnerable to a heap buffer overflow. If the Wake-up on Wireless LAN functionality is configured, a malicious event frame can be constructed to trigger an heap buffer overflow in the brcmf_wowl_nd_results function. This vulnerability can be exploited with compromised chipsets to compromise the host, or when used in combination with CVE-2019-9503, can be used remotely. In the worst case scenario, by sending specially-crafted WiFi packets, a remote, unauthenticated attacker may be able to execute arbitrary code on a vulnerable system. More typically, this vulnerability will result in denial-of-service conditions.

CVSS 3.1 · 7.9 High EPSS 3.9% KEV · Not listed
Vendors
Broadcom Linux Redhat
Products
Brcmfmac Driver Linux Kernel Enterprise Linux and 2 more
CVE-2019-9458

kernel: use after free due to race condition in the video driver leads to local privilege escalation

In the Android kernel in the video driver there is a use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed
Vendors
Google Opensuse Redhat
Products
Android Leap Enterprise Linux and 1 more
CVE-2019-9456

kernel: OOB write due to missing bounds check leads to local privilege escalation

In the Android kernel in Pixel C USB monitor driver there is a possible OOB write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Google Opensuse Redhat
Products
Android Leap Enterprise Linux and 1 more
CVE-2019-9454

kernel: out of bounds write in i2c driver leads to local escalation of privilege

In the Android kernel in i2c driver there is a possible out of bounds write due to memory corruption. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Google Redhat
Products
Android Enterprise Linux Rhel Aus and 4 more
CVE-2019-5489

Kernel: page cache side channel attacks

The mincore() implementation in mm/mincore.c in the Linux kernel through 4.19.13 allowed local attackers to observe page cache access patterns of other processes on the same system, potentially allowing sniffing of secret information. (Fixing this affects the output of the fincore program.) Limited remote exploitation may be possible, as demonstrated by latency differences in accessing public files from an Apache HTTP Server.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Netapp Redhat
Products
Linux Kernel Active Iq Performance Analytics Services Element Software Management Node and 8 more
CVE-2019-5108

kernel: triggering AP to send IAPP location updates for stations before the required authentication process has completed can lead to DoS

An exploitable denial-of-service vulnerability exists in the Linux kernel prior to mainline 5.3. An attacker could exploit this vulnerability by triggering AP to send IAPP location updates for stations before the required authentication process has completed. This could lead to different denial-of-service scenarios, either by causing CAM table attacks, or by leading to traffic flapping if faking already existing clients in other nearby APs of the same wireless infrastructure. An attacker can forge Authentication and Association Request packets to trigger this vulnerability.

CVSS 3.1 · 6.5 Medium EPSS 10.1% KEV · Not listed
Vendors
Canonical Debian Linux and 3 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 20 more
CVE-2019-3901

kernel: perf_event_open() and execve() race in setuid programs allows a data leak

A race condition in perf_event_open() allows local attackers to leak sensitive data from setuid programs. As no relevant locks (in particular the cred_guard_mutex) are held during the ptrace_may_access() call, it is possible for the specified target task to perform an execve() syscall with setuid execution before perf_event_alloc() actually attaches to it, allowing an attacker to bypass the ptrace_may_access() check and the perf_event_exit_task(current) call that is performed in install_exec_creds() during privileged execve() calls. This issue affects kernel versions before 4.8.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Linux Netapp and 1 more
Products
Debian Linux Linux Kernel Active Iq Unified Manager For Vmware Vsphere and 11 more
CVE-2019-3900

Kernel: vhost_net: infinite loop while receiving packets leads to DoS

An infinite loop issue was found in the vhost_net kernel module in Linux Kernel up to and including v5.1-rc6, while handling incoming packets in handle_rx(). It could occur if one end sends packets faster than the other end can process them. A guest user, maybe remote one, could use this flaw to stall the vhost_net kernel thread, resulting in a DoS scenario.

CVSS 3.1 · 7.7 High EPSS 4.3% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 17 more
CVE-2019-3882

kernel: denial of service vector through vfio DMA mappings

A flaw was found in the Linux kernel's vfio interface implementation that permits violation of the user's locked memory limit. If a device is bound to a vfio driver, such as vfio-pci, and the local attacker is administratively granted ownership of the device, it may cause a system memory exhaustion and thus a denial of service (DoS). Versions 3.10, 4.14 and 4.18 are vulnerable.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 13 more
CVE-2019-3846

kernel: Heap overflow in mwifiex_update_bss_desc_with_ie function in marvell/mwifiex/scan.c

A flaw that allowed an attacker to corrupt memory and possibly escalate privileges was found in the mwifiex kernel module while connecting to a malicious wireless network.

CVSS 3.1 · 8.8 High EPSS 5.9% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 4 more
Products
Ubuntu Linux Debian Linux Fedora and 14 more