CVE-2015-7701

ntp: slow memory leak in CRYPTO_ASSOC

Memory leak in the CRYPTO_ASSOC function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (memory consumption).

CVSS 3.1 · 7.5 High EPSS 6.5% KEV · Not listed

Vendors

Debian Netapp Ntp and 2 more

Products

Debian Linux Clustered Data Ontap Data Ontap and 11 more

CVE-2016-7797

pacemaker: pacemaker remote nodes vulnerable to hijacking, resulting in a DoS attack

Pacemaker before 1.1.15, when using pacemaker remote, might allow remote attackers to cause a denial of service (node disconnection) via an unauthenticated connection.

CVSS 3.0 · 7.5 High EPSS 3.2% KEV · Not listed

Vendors

Clusterlabs Opensuse Opensuse Project and 2 more

Products

Pacemaker Leap Leap and 5 more

CVE-2017-13081

wpa_supplicant: Reinstallation of the integrity group key in the group key handshake

Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11w allows reinstallation of the Integrity Group Temporal Key (IGTK) during the group key handshake, allowing an attacker within radio range to spoof frames from access points to clients.

CVSS 3.0 · 5.3 Medium EPSS 2.0% KEV · Not listed

Vendors

Canonical Debian Freebsd and 4 more

Products

Ubuntu Linux Debian Linux Freebsd and 9 more

CVE-2017-13080

wpa_supplicant: Reinstallation of the group key in the group key handshake

Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the group key handshake, allowing an attacker within radio range to replay frames from access points to clients.

CVSS 3.0 · 5.3 Medium EPSS 2.3% KEV · Not listed

Vendors

Canonical Debian Freebsd and 4 more

Products

Ubuntu Linux Debian Linux Freebsd and 10 more

CVE-2017-13079

wpa_supplicant: Reinstallation of the integrity group key in the 4-way handshake

Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11w allows reinstallation of the Integrity Group Temporal Key (IGTK) during the four-way handshake, allowing an attacker within radio range to spoof frames from access points to clients.

CVSS 3.0 · 5.3 Medium EPSS 2.1% KEV · Not listed

Vendors

Canonical Debian Freebsd and 4 more

Products

Ubuntu Linux Debian Linux Freebsd and 9 more

CVE-2017-13078

wpa_supplicant: Reinstallation of the group key in the 4-way handshake

Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the four-way handshake, allowing an attacker within radio range to replay frames from access points to clients.

CVSS 3.0 · 5.3 Medium EPSS 2.1% KEV · Not listed

Vendors

Canonical Debian Freebsd and 4 more

Products

Ubuntu Linux Debian Linux Freebsd and 10 more

CVE-2017-13077

wpa_supplicant: Reinstallation of the pairwise key in the 4-way handshake

Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Pairwise Transient Key (PTK) Temporal Key (TK) during the four-way handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.

CVSS 3.0 · 6.8 Medium EPSS 2.4% KEV · Not listed

Vendors

Canonical Debian Freebsd and 4 more

Products

Ubuntu Linux Debian Linux Freebsd and 10 more

CVE-2017-12193

kernel: Null pointer dereference due to incorrect node-splitting in assoc_array implementation

The assoc_array_insert_into_terminal_node function in lib/assoc_array.c in the Linux kernel before 4.13.11 mishandles node splitting, which allows local users to cause a denial of service (NULL pointer dereference and panic) via a crafted application, as demonstrated by the keyring key type, and key addition and link creation operations.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Enterprise Mrg and 1 more

CVE-2017-1000111

kernel: Heap out-of-bounds read in AF_PACKET sockets

Linux kernel: heap out-of-bounds in AF_PACKET sockets. This new issue is analogous to previously disclosed CVE-2016-8655. In both cases, a socket option that changes socket state may race with safety checks in packet_set_ring. Previously with PACKET_VERSION. This time with PACKET_RESERVE. The solution is similar: lock the socket for the update. This issue may be exploitable, we did not investigate further. As this issue affects PF_PACKET sockets, it requires CAP_NET_RAW in the process namespace. But note that with user namespaces enabled, any process can create a namespace in which it has CAP_NET_RAW.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Debian Linux Redhat

Products

Debian Linux Linux Kernel Enterprise Linux and 8 more

CVE-2017-1000112

kernel: Exploitable memory corruption due to UFO to non-UFO path switch

Linux kernel: Exploitable memory corruption due to UFO to non-UFO path switch. When building a UFO packet with MSG_MORE __ip_append_data() calls ip_ufo_append_data() to append. However in between two send() calls, the append path can be switched from UFO to non-UFO one, which leads to a memory corruption. In case UFO packet lengths exceeds MTU, copy = maxfraglen - skb->len becomes negative on the non-UFO path and the branch to allocate new skb is taken. This triggers fragmentation and computation of fraggap = skb_prev->len - maxfraglen. Fraggap can exceed MTU, causing copy = datalen - transhdrlen - fraggap to become negative. Subsequently skb_copy_and_csum_bits() writes out-of-bounds. A similar issue is present in IPv6 code. The bug was introduced in e89e9cf539a2 ("[IPv4/IPv6]: UFO Scatter-gather approach") on Oct 18 2005.

CVSS 3.1 · 7.0 High EPSS 20.8% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Enterprise Mrg and 5 more

CVE-2017-1000251

kernel: stack buffer overflow in the native Bluetooth stack

The native Bluetooth stack in the Linux Kernel (BlueZ), starting at the Linux kernel version 2.6.32 and up to and including 4.13.1, are vulnerable to a stack overflow vulnerability in the processing of L2CAP configuration responses resulting in Remote code execution in kernel space.

CVSS 3.1 · 8.0 High EPSS 16.2% KEV · Not listed

Vendors

Debian Linux Nvidia and 1 more

Products

Debian Linux Linux Kernel Jetson Tk1 and 14 more

CVE-2017-1000252

kernel: kvm: Reachable BUG() on out-of-bounds guest IRQ

The KVM subsystem in the Linux kernel through 4.13.3 allows guest OS users to cause a denial of service (assertion failure, and hypervisor hang or crash) via an out-of bounds guest_irq value, related to arch/x86/kvm/vmx.c and virt/kvm/eventfd.c.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Rhel Eus and 1 more

CVE-2017-12192

kernel: NULL pointer dereference due to KEYCTL_READ on negative key

The keyctl_read_key function in security/keys/keyctl.c in the Key Management subcomponent in the Linux kernel before 4.13.5 does not properly consider that a key may be possessed but negatively instantiated, which allows local users to cause a denial of service (OOPS and system crash) via a crafted KEYCTL_READ operation.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Enterprise Mrg and 1 more

CVE-2017-1000255

kernel: Arbitrary stack overwrite causing oops via crafted signal frame

On Linux running on PowerPC hardware (Power8 or later) a user process can craft a signal frame and then do a sigreturn so that the kernel will take an exception (interrupt), and use the r1 value *from the signal frame* as the kernel stack pointer. As part of the exception entry the content of the signal frame is written to the kernel stack, allowing an attacker to overwrite arbitrary locations with arbitrary values. The exception handling does produce an oops, and a panic if panic_on_oops=1, but only after kernel memory has been over written. This flaw was introduced in commit: "5d176f751ee3 (powerpc: tm: Enable transactional memory (TM) lazily for userspace)" which was merged upstream into v4.9-rc1. Please note that kernels built with CONFIG_PPC_TRANSACTIONAL_MEM=n are not vulnerable.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm Linux Redhat

Products

Powerpc Power8 Powerpc Power9 Linux Kernel and 1 more

CVE-2017-1000364

kernel: heap/stack gap jumping via unbounded stack allocations

An issue was discovered in the size of the stack guard page on Linux, specifically a 4k stack guard page is not sufficiently large and can be "jumped" over (the stack guard page is bypassed), this affects Linux Kernel versions 4.11.5 and earlier (the stackguard page was introduced in 2010).

CVSS 3.0 · 7.4 High EPSS 5.2% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Container Development Kit Enterprise Linux and 7 more

CVE-2017-1000366

glibc: heap/stack gap jumping via unbounded stack allocations

glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causing them to alias, potentially resulting in arbitrary code execution. Please note that additional hardening changes have been made to glibc to prevent manipulation of stack and heap memory but these issues are not directly exploitable, as such they have not been given a CVE. This affects glibc 2.25 and earlier.

CVSS 3.0 · 7.8 High EPSS 2.7% KEV · Not listed

Vendors

Debian Gnu Mcafee and 5 more

Products

Debian Linux Glibc Web Gateway and 23 more

CVE-2017-1000371

kernel: offset2lib allows for the stack guard page to be jumped over

The offset2lib patch as used by the Linux Kernel contains a vulnerability, if RLIMIT_STACK is set to RLIM_INFINITY and 1 Gigabyte of memory is allocated (the maximum under the 1/4 restriction) then the stack will be grown down to 0x80000000, and as the PIE binary is mapped above 0x80000000 the minimum distance between the end of the PIE binary's read-write segment and the start of the stack becomes small enough that the stack guard page can be jumped over by an attacker. This affects Linux Kernel version 4.11.5. This is a different issue than CVE-2017-1000370 and CVE-2017-1000365. This issue appears to be limited to i386 based systems.

CVSS 3.1 · 7.8 High EPSS 2.6% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux

CVE-2017-1000379

kernel: Incorrectly mapped contents of PIE executable

The Linux Kernel running on AMD64 systems will sometimes map the contents of PIE executable, the heap or ld.so to where the stack is mapped allowing attackers to more easily manipulate the stack. Linux Kernel version 4.11.5 is affected.

CVSS 3.1 · 7.8 High EPSS 1.8% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Enterprise Mrg and 6 more

CVE-2017-1000380

kernel: information leak due to a data race in ALSA timer

sound/core/timer.c in the Linux kernel before 4.11.5 is vulnerable to a data race in the ALSA /dev/snd/timer driver resulting in local users being able to read information belonging to other users, i.e., uninitialized memory contents may be disclosed when a read and an ioctl happen at the same time.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Enterprise Mrg and 1 more

CVE-2017-1000405

kernel: pmd can become dirty without going through a COW cycle

The Linux Kernel versions 2.6.38 through 4.14 have a problematic use of pmd_mkdirty() in the touch_pmd() function inside the THP implementation. touch_pmd() can be reached by get_user_pages(). In such case, the pmd will become dirty. This scenario breaks the new can_follow_write_pmd()'s logic - pmd can become dirty without going through a COW cycle. This bug is not as severe as the original "Dirty cow" because an ext4 file (or any other regular file) cannot be mapped using THP. Nevertheless, it does allow us to overwrite read-only huge pages. For example, the zero huge page and sealed shmem files can be overwritten (since their mapping can be populated using THP). Note that after the first write page-fault to the zero page, it will be replaced with a new fresh (and zeroed) thp.

CVSS 3.1 · 7.0 High EPSS 2.8% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux