Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 383

Export CSV
CVE-2019-25045

kernel: use-after-free in the XFRM subsystem related to an xfrm_state_fini() panic

An issue was discovered in the Linux kernel before 5.0.19. The XFRM subsystem has a use-after-free, related to an xfrm_state_fini panic, aka CID-dbb2483b2a46.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Linux Netapp
Products
Linux Kernel Aff 8300 Aff 8300 Firmware and 38 more
CVE-2019-25044

kernel: use-after-free in the block subsystem related to blk_mq_free_rqs and blk_cleanup_queue

The block subsystem in the Linux kernel before 5.2 has a use-after-free that can lead to arbitrary code execution in the kernel context and privilege escalation, aka CID-c3e2219216c9. This is related to blk_mq_free_rqs and blk_cleanup_queue.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Linux Netapp
Products
Linux Kernel Cloud Backup H300e and 18 more
CVE-2019-20636

kernel: out-of-bounds write via crafted keycode table

In the Linux kernel before 5.4.12, drivers/input/input.c has out-of-bounds writes via a crafted keycode table, as demonstrated by input_set_keycode, aka CID-cb222aed03d7.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Netapp Redhat
Products
Linux Kernel Cloud Backup Fas 8300 and 21 more
CVE-2019-20054

kernel: Null pointer dereference in drop_sysctl_table() in fs/proc/proc_sysctl.c

In the Linux kernel before 5.0.6, there is a NULL pointer dereference in drop_sysctl_table() in fs/proc/proc_sysctl.c, related to put_links, aka CID-23da9588037e.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Netapp Redhat
Products
Linux Kernel 8300 8300 Firmware and 16 more
CVE-2019-1559

0-byte record padding oracle

If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable "non-stitched" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q).

CVSS 3.1 · 5.9 Medium EPSS 17.1% KEV · Not listed
Vendors
Canonical Debian F5 and 10 more
Products
Ubuntu Linux Debian Linux Big-ip Access Policy Manager and 88 more
CVE-2019-19966

kernel: use-after-free in cpia2_exit in drivers/media/usb/cpia2/cpia2_v4l.c

In the Linux kernel before 5.1.6, there is a use-after-free in cpia2_exit() in drivers/media/usb/cpia2/cpia2_v4l.c that will cause denial of service, aka CID-dea37a972655.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Linux Netapp and 1 more
Products
Debian Linux Linux Kernel Active Iq Unified Manager and 10 more
CVE-2019-19947

kernel: uninitialized memory allocation in drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c leading to information leak

In the Linux kernel through 5.4.6, there are information leaks of uninitialized memory to a USB device in the drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c driver, aka CID-da2311a6385c.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Linux and 1 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 10 more
CVE-2019-19922

kernel: when cpu.cfs_quota_us is used allows attackers to cause a denial of service against non-cpu-bound applications

kernel/sched/fair.c in the Linux kernel before 5.3.9, when cpu.cfs_quota_us is used (e.g., with Kubernetes), allows attackers to cause a denial of service against non-cpu-bound applications by generating a workload that triggers unwanted slice expiration, aka CID-de53fd7aedb1. (In other words, although this slice expiration would typically be seen with benign workloads, it is possible that an attacker could calculate how many stray requests are required to force an entire Kubernetes cluster into a low-performance state caused by slice expiration, and ensure that a DDoS attack sent that number of stray requests. An attack does not affect the stability of the kernel; it only causes mismanagement of application execution.)

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Linux and 3 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 12 more
CVE-2019-19816

kernel: out-of-bounds write in __btrfs_map_block in fs/btrfs/volumes.c

In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image and performing some operations can cause slab-out-of-bounds write access in __btrfs_map_block in fs/btrfs/volumes.c, because a value of 1 for the number of data stripes is mishandled.

CVSS 3.1 · 7.8 High EPSS 3.3% KEV · Not listed
Vendors
Canonical Debian Linux and 1 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 15 more
CVE-2019-19813

kernel: use-after-free in __mutex_lock in kernel/locking/mutex.c

In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image, performing some operations, and then making a syncfs system call can lead to a use-after-free in __mutex_lock in kernel/locking/mutex.c. This is related to mutex_can_spin_on_owner in kernel/locking/mutex.c, __btrfs_qgroup_free_meta in fs/btrfs/qgroup.c, and btrfs_insert_delayed_items in fs/btrfs/delayed-inode.c.

CVSS 3.1 · 5.5 Medium EPSS 2.1% KEV · Not listed
Vendors
Canonical Debian Linux and 1 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 15 more
CVE-2019-19448

kernel: mounting a crafted btrfs filesystem image, performing some operations, and then making a syncfs system call can lead to a use-after-free in try_merge_free_space in fs/btrfs/free-space-cache.c

In the Linux kernel 5.0.21 and 5.3.11, mounting a crafted btrfs filesystem image, performing some operations, and then making a syncfs system call can lead to a use-after-free in try_merge_free_space in fs/btrfs/free-space-cache.c because the pointer to a left data structure can be the same as the pointer to a right data structure.

CVSS 3.1 · 7.8 High EPSS 2.1% KEV · Not listed
Vendors
Canonical Debian Linux and 1 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 24 more
CVE-2019-19447

kernel: mounting a crafted ext4 filesystem image, performing some operations, and unmounting can lead to a use-after-free in ext4_put_super in fs/ext4/super.c

In the Linux kernel 5.0.21, mounting a crafted ext4 filesystem image, performing some operations, and unmounting can lead to a use-after-free in ext4_put_super in fs/ext4/super.c, related to dump_orphan_list in fs/ext4/super.c.

CVSS 3.1 · 7.8 High EPSS 3.5% KEV · Not listed
Vendors
Linux Netapp Redhat
Products
Linux Kernel Active Iq Unified Manager Cloud Backup and 10 more
CVE-2019-19377

kernel: use-after-free in btrfs_queue_work in fs/btrfs/async-thread.c

In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image, performing some operations, and unmounting can lead to a use-after-free in btrfs_queue_work in fs/btrfs/async-thread.c.

CVSS 3.1 · 7.8 High EPSS 3.4% KEV · Not listed
Vendors
Linux Netapp
Products
Linux Kernel Active Iq Unified Manager Cloud Backup and 2 more
CVE-2019-19318

kernel: use-after-free in rwsem_down_write_slowpath in kernel/locking/rwsem.c

In the Linux kernel 5.3.11, mounting a crafted btrfs image twice can cause an rwsem_down_write_slowpath use-after-free because (in rwsem_can_spin_on_owner in kernel/locking/rwsem.c) rwsem_owner_flags returns an already freed pointer,

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Linux and 2 more
Products
Ubuntu Linux Debian Linux Linux Kernel and 16 more
CVE-2019-19069

kernel: A memory leak in the fastrpc_dma_buf_attach() function in drivers/misc/fastrpc.c allows for a DoS

A memory leak in the fastrpc_dma_buf_attach() function in drivers/misc/fastrpc.c in the Linux kernel before 5.3.9 allows attackers to cause a denial of service (memory consumption) by triggering dma_get_sgtable() failures, aka CID-fc739a058d99.

CVSS 3.1 · 7.5 High EPSS 3.5% KEV · Not listed
Vendors
Broadcom Canonical Linux and 1 more
Products
Fabric Operating System Ubuntu Linux Linux Kernel and 18 more
CVE-2019-19063

kernel: Two memory leaks in the rtl_usb_probe() function in drivers/net/wireless/realtek/rtlwifi/usb.c allow for a DoS

Two memory leaks in the rtl_usb_probe() function in drivers/net/wireless/realtek/rtlwifi/usb.c in the Linux kernel through 5.3.11 allow attackers to cause a denial of service (memory consumption), aka CID-3f9361695113.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Broadcom Canonical Fedoraproject and 5 more
Products
Brocade Fabric Operating System Firmware Ubuntu Linux Fedora and 19 more
CVE-2019-19061

kernel: A memory leak in the adis_update_scan_mode_burst() function in drivers/iio/imu/adis_buffer.c allows for a DoS

A memory leak in the adis_update_scan_mode_burst() function in drivers/iio/imu/adis_buffer.c in the Linux kernel before 5.3.9 allows attackers to cause a denial of service (memory consumption), aka CID-9c0530e898f3.

CVSS 3.1 · 7.5 High EPSS 3.4% KEV · Not listed
Vendors
Broadcom Canonical Linux and 1 more
Products
Brocade Fabric Operating System Firmware Ubuntu Linux Linux Kernel and 14 more
CVE-2019-19060

kernel: A memory leak in the adis_update_scan_mode() function in drivers/iio/imu/adis_buffer.c allows for a DoS

A memory leak in the adis_update_scan_mode() function in drivers/iio/imu/adis_buffer.c in the Linux kernel before 5.3.9 allows attackers to cause a denial of service (memory consumption), aka CID-ab612b1daf41.

CVSS 3.1 · 7.5 High EPSS 3.6% KEV · Not listed
Vendors
Broadcom Canonical Linux and 2 more
Products
Brocade Fabric Operating System Firmware Ubuntu Linux Linux Kernel and 15 more
CVE-2019-19057

kernel: Two memory leaks in the mwifiex_pcie_init_evt_ring() function in drivers/net/wireless/marvell/mwifiex/pcie.c allows for a DoS

Two memory leaks in the mwifiex_pcie_init_evt_ring() function in drivers/net/wireless/marvell/mwifiex/pcie.c in the Linux kernel through 5.3.11 allow attackers to cause a denial of service (memory consumption) by triggering mwifiex_map_pci_memory() failures, aka CID-d10dcb615c8e.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Broadcom Canonical Debian and 5 more
Products
Brocade Fabric Operating System Firmware Ubuntu Linux Debian Linux and 18 more
CVE-2019-19053

kernel: A memory leak in the rpmsg_eptdev_write_iter() function in drivers/rpmsg/rpmsg_char.c allows attackers to cause a DoS

A memory leak in the rpmsg_eptdev_write_iter() function in drivers/rpmsg/rpmsg_char.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering copy_from_iter_full() failures, aka CID-bbe692e349e2.

CVSS 3.1 · 7.5 High EPSS 3.3% KEV · Not listed
Vendors
Broadcom Canonical Linux and 1 more
Products
Brocade Fabric Operating System Firmware Ubuntu Linux Linux Kernel and 14 more