CVE-2018-14634

kernel: Integer overflow in Linux's create_elf_tables function

An integer overflow flaw was found in the Linux kernel's create_elf_tables() function. An unprivileged local user with access to SUID (or otherwise privileged) binary could use this flaw to escalate their privileges on the system. Kernel versions 2.6.x, 3.10.x and 4.14.x are believed to be vulnerable.

CVSS 3.0 · 7.8 High EPSS 14.7% KEV · Listed

Vendors

Canonical F5 Linux and 3 more

Products

Ubuntu Linux Big-ip Access Policy Manager Big-ip Advanced Firewall Manager and 32 more

CVE-2017-5715

hw: cpu: speculative execution branch target injection

Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis.

CVSS 3.1 · 5.6 Medium EPSS 73.2% KEV · Not listed

Vendors

Arm Canonical Debian and 5 more

Products

Cortex-a Ubuntu Linux Debian Linux and 227 more

CVE-2017-17558

kernel: Unallocated memory access by malicious USB device via bNumInterfaces overflow

The usb_destroy_configuration function in drivers/usb/core/config.c in the USB core subsystem in the Linux kernel through 4.14.5 does not consider the maximum number of configurations and interfaces before attempting to release resources, which allows local users to cause a denial of service (out-of-bounds write access) or possibly have unspecified other impact via a crafted USB device.

CVSS 3.0 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat Suse

Products

Linux Kernel Enterprise Linux Enterprise Mrg and 3 more

CVE-2017-15649

kernel: Use-after-free in the af_packet.c

net/packet/af_packet.c in the Linux kernel before 4.13.6 allows local users to gain privileges via crafted system calls that trigger mishandling of packet_fanout data structures, because of a race condition (involving fanout_add and packet_do_bind) that leads to a use-after-free, a different vulnerability than CVE-2017-6346.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Enterprise Mrg and 1 more

CVE-2017-14340

kernel: xfs: unprivileged user kernel oops

The XFS_IS_REALTIME_INODE macro in fs/xfs/xfs_linux.h in the Linux kernel before 4.13.2 does not verify that a filesystem has a realtime device, which allows local users to cause a denial of service (NULL pointer dereference and OOPS) via vectors related to setting an RHINHERIT flag on a directory.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Mrg

CVE-2017-16939

Kernel: ipsec: xfrm: use-after-free leading to potential privilege escalation

The XFRM dump policy implementation in net/xfrm/xfrm_user.c in the Linux kernel before 4.13.11 allows local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages.

CVSS 3.1 · 7.8 High EPSS 2.1% KEV · Not listed

Vendors

Debian Linux Redhat

Products

Debian Linux Linux Kernel Enterprise Linux and 3 more

CVE-2014-3706

ovirt-engine: connection does not validate certificate attributes.

ovirt-engine, as used in Red Hat MRG 3, allows man-in-the-middle attackers to spoof servers by leveraging failure to verify key attributes in vdsm X.509 certificates.

CVSS 3.0 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Mrg

CVE-2017-17449

kernel: Missing namespace check in net/netlink/af_netlink.c allows for network monitors to observe systemwide activity

The __netlink_deliver_tap_skb function in net/netlink/af_netlink.c in the Linux kernel through 4.14.4, when CONFIG_NLMON is enabled, does not restrict observations of Netlink messages to a single net namespace, which allows local users to obtain sensitive information by leveraging the CAP_NET_ADMIN capability to sniff an nlmon interface for all Netlink activity on the system.

CVSS 3.0 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Enterprise Mrg and 2 more

CVE-2017-2636

kernel: Race condition access to n_hdlc.tbuf causes double free in n_hdlc_release()

Race condition in drivers/tty/n_hdlc.c in the Linux kernel through 4.10.1 allows local users to gain privileges or cause a denial of service (double free) by setting the HDLC line discipline.

CVSS 3.1 · 7.0 High EPSS 1.0% KEV · Not listed

Vendors

Debian Linux Redhat

Products

Debian Linux Linux Kernel Enterprise Linux and 6 more

CVE-2017-12192

kernel: NULL pointer dereference due to KEYCTL_READ on negative key

The keyctl_read_key function in security/keys/keyctl.c in the Key Management subcomponent in the Linux kernel before 4.13.5 does not properly consider that a key may be possessed but negatively instantiated, which allows local users to cause a denial of service (OOPS and system crash) via a crafted KEYCTL_READ operation.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Enterprise Mrg and 1 more

CVE-2017-12193

kernel: Null pointer dereference due to incorrect node-splitting in assoc_array implementation

The assoc_array_insert_into_terminal_node function in lib/assoc_array.c in the Linux kernel before 4.13.11 mishandles node splitting, which allows local users to cause a denial of service (NULL pointer dereference and panic) via a crafted application, as demonstrated by the keyring key type, and key addition and link creation operations.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Enterprise Mrg and 1 more

CVE-2017-12190

kernel: memory leak when merging buffers in SCSI IO vectors

The bio_map_user_iov and bio_unmap_user functions in block/bio.c in the Linux kernel before 4.13.8 do unbalanced refcounting when a SCSI I/O vector has small consecutive buffers belonging to the same page. The bio_add_pc_page function merges them into one, but the page reference is never dropped. This causes a memory leak and possible system lockup (exploitable against the host OS by a guest OS user, if a SCSI disk is passed through to a virtual machine) due to an out-of-memory condition.

CVSS 3.0 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Enterprise Mrg and 2 more

CVE-2017-13166

kernel: v4l2: disabled memory access protection mechanism allowing privilege escalation

An elevation of privilege vulnerability in the kernel v4l2 video driver. Product: Android. Versions: Android kernel. Android ID A-34624167.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Google Redhat

Products

Android Enterprise Linux Enterprise Mrg and 2 more

CVE-2017-10661

kernel: Handling of might_cancel queueing is not properly pretected against race

Race condition in fs/timerfd.c in the Linux kernel before 4.10.15 allows local users to gain privileges or cause a denial of service (list corruption or use-after-free) via simultaneous file-descriptor operations that leverage improper might_cancel queueing.

CVSS 3.1 · 7.0 High EPSS 13.5% KEV · Not listed

Vendors

Debian Linux Redhat

Products

Debian Linux Linux Kernel Enterprise Linux and 9 more

CVE-2017-11176

kernel: Use-after-free in sys_mq_notify()

The mq_notify function in the Linux kernel through 4.11.9 does not set the sock pointer to NULL upon entry into the retry logic. During a user-space close of a Netlink socket, it allows attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact.

CVSS 3.1 · 7.8 High EPSS 3.8% KEV · Not listed

Vendors

Debian Linux Redhat

Products

Debian Linux Linux Kernel Enterprise Linux and 3 more

CVE-2017-11600

kernel: Out-of-bounds access via an XFRM_MSG_MIGRATE xfrm Netlink message

net/xfrm/xfrm_policy.c in the Linux kernel through 4.12.3, when CONFIG_XFRM_MIGRATE is enabled, does not ensure that the dir value of xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which allows local users to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via an XFRM_MSG_MIGRATE xfrm Netlink message.

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Enterprise Mrg and 2 more

CVE-2017-13167

kernel: sound: a race condition in the kernel sound timer in snd_timer_user_read()

An elevation of privilege vulnerability in the kernel sound timer. Product: Android. Versions: Android kernel. Android ID A-37240993.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Google Redhat

Products

Android Enterprise Linux Enterprise Mrg and 1 more

CVE-2017-15265

kernel: Use-after-free in snd_seq_ioctl_create_port()

Race condition in the ALSA subsystem in the Linux kernel before 4.13.8 allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted /dev/snd/seq ioctl calls, related to sound/core/seq/seq_clientmgr.c and sound/core/seq/seq_ports.c.

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Enterprise Mrg and 4 more

CVE-2017-1000364

kernel: heap/stack gap jumping via unbounded stack allocations

An issue was discovered in the size of the stack guard page on Linux, specifically a 4k stack guard page is not sufficiently large and can be "jumped" over (the stack guard page is bypassed), this affects Linux Kernel versions 4.11.5 and earlier (the stackguard page was introduced in 2010).

CVSS 3.0 · 7.4 High EPSS 5.2% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Container Development Kit Enterprise Linux and 7 more

CVE-2017-1000379

kernel: Incorrectly mapped contents of PIE executable

The Linux Kernel running on AMD64 systems will sometimes map the contents of PIE executable, the heap or ld.so to where the stack is mapped allowing attackers to more easily manipulate the stack. Linux Kernel version 4.11.5 is affected.

CVSS 3.1 · 7.8 High EPSS 1.8% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Enterprise Mrg and 6 more