RHSA-2021:1578
Vulnerability from csaf_redhat - Published: 2021-05-18 15:49 - Updated: 2026-08-07 02:39A flaw was found in the Linux kernel’s sof_set_get_large_ctrl_data function, in the way it handled memory cleanup in a specific error path. A local attacker could use this flaw to crash the system.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: BaseOS-8.4.0.GA:bpftool-0:4.18.0-305.el8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:bpftool-0:4.18.0-305.el8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:bpftool-0:4.18.0-305.el8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:bpftool-0:4.18.0-305.el8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:bpftool-debuginfo-0:4.18.0-305.el8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:bpftool-debuginfo-0:4.18.0-305.el8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:bpftool-debuginfo-0:4.18.0-305.el8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:bpftool-debuginfo-0:4.18.0-305.el8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-0:4.18.0-305.el8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-0:4.18.0-305.el8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-0:4.18.0-305.el8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-0:4.18.0-305.el8.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-0:4.18.0-305.el8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-abi-stablelists-0:4.18.0-305.el8.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-core-0:4.18.0-305.el8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-core-0:4.18.0-305.el8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-core-0:4.18.0-305.el8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-core-0:4.18.0-305.el8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-debug-0:4.18.0-305.el8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-debug-0:4.18.0-305.el8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-debug-0:4.18.0-305.el8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-debug-0:4.18.0-305.el8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-debug-core-0:4.18.0-305.el8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-debug-core-0:4.18.0-305.el8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-debug-core-0:4.18.0-305.el8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-debug-core-0:4.18.0-305.el8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-debug-debuginfo-0:4.18.0-305.el8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-debug-debuginfo-0:4.18.0-305.el8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-debug-debuginfo-0:4.18.0-305.el8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-debug-debuginfo-0:4.18.0-305.el8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-debug-devel-0:4.18.0-305.el8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-debug-devel-0:4.18.0-305.el8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-debug-devel-0:4.18.0-305.el8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-debug-devel-0:4.18.0-305.el8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-debug-modules-0:4.18.0-305.el8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-debug-modules-0:4.18.0-305.el8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-debug-modules-0:4.18.0-305.el8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-debug-modules-0:4.18.0-305.el8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-debug-modules-extra-0:4.18.0-305.el8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-debug-modules-extra-0:4.18.0-305.el8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-debug-modules-extra-0:4.18.0-305.el8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-debug-modules-extra-0:4.18.0-305.el8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-debuginfo-0:4.18.0-305.el8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-debuginfo-0:4.18.0-305.el8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-debuginfo-0:4.18.0-305.el8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-debuginfo-0:4.18.0-305.el8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-debuginfo-common-aarch64-0:4.18.0-305.el8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-debuginfo-common-ppc64le-0:4.18.0-305.el8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-debuginfo-common-s390x-0:4.18.0-305.el8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-debuginfo-common-x86_64-0:4.18.0-305.el8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-devel-0:4.18.0-305.el8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-devel-0:4.18.0-305.el8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-devel-0:4.18.0-305.el8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-devel-0:4.18.0-305.el8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-doc-0:4.18.0-305.el8.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-modules-0:4.18.0-305.el8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-modules-0:4.18.0-305.el8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-modules-0:4.18.0-305.el8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-modules-0:4.18.0-305.el8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-modules-extra-0:4.18.0-305.el8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-modules-extra-0:4.18.0-305.el8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-modules-extra-0:4.18.0-305.el8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-modules-extra-0:4.18.0-305.el8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-tools-0:4.18.0-305.el8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-tools-0:4.18.0-305.el8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-tools-0:4.18.0-305.el8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-tools-0:4.18.0-305.el8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-tools-debuginfo-0:4.18.0-305.el8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-tools-debuginfo-0:4.18.0-305.el8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-tools-debuginfo-0:4.18.0-305.el8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-tools-debuginfo-0:4.18.0-305.el8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-tools-libs-0:4.18.0-305.el8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-tools-libs-0:4.18.0-305.el8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-tools-libs-0:4.18.0-305.el8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-zfcpdump-0:4.18.0-305.el8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-zfcpdump-core-0:4.18.0-305.el8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-zfcpdump-debuginfo-0:4.18.0-305.el8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-zfcpdump-devel-0:4.18.0-305.el8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-zfcpdump-modules-0:4.18.0-305.el8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:kernel-zfcpdump-modules-extra-0:4.18.0-305.el8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:perf-0:4.18.0-305.el8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:perf-0:4.18.0-305.el8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:perf-0:4.18.0-305.el8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:perf-0:4.18.0-305.el8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:perf-debuginfo-0:4.18.0-305.el8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:perf-debuginfo-0:4.18.0-305.el8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:perf-debuginfo-0:4.18.0-305.el8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:perf-debuginfo-0:4.18.0-305.el8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:python3-perf-0:4.18.0-305.el8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:python3-perf-0:4.18.0-305.el8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:python3-perf-0:4.18.0-305.el8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:python3-perf-0:4.18.0-305.el8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:python3-perf-debuginfo-0:4.18.0-305.el8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:python3-perf-debuginfo-0:4.18.0-305.el8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:python3-perf-debuginfo-0:4.18.0-305.el8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: BaseOS-8.4.0.GA:python3-perf-debuginfo-0:4.18.0-305.el8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.4.0.GA:bpftool-debuginfo-0:4.18.0-305.el8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.4.0.GA:bpftool-debuginfo-0:4.18.0-305.el8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.4.0.GA:bpftool-debuginfo-0:4.18.0-305.el8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.4.0.GA:kernel-debug-debuginfo-0:4.18.0-305.el8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.4.0.GA:kernel-debug-debuginfo-0:4.18.0-305.el8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.4.0.GA:kernel-debug-debuginfo-0:4.18.0-305.el8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.4.0.GA:kernel-debuginfo-0:4.18.0-305.el8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.4.0.GA:kernel-debuginfo-0:4.18.0-305.el8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.4.0.GA:kernel-debuginfo-0:4.18.0-305.el8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.4.0.GA:kernel-debuginfo-common-aarch64-0:4.18.0-305.el8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.4.0.GA:kernel-debuginfo-common-ppc64le-0:4.18.0-305.el8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.4.0.GA:kernel-debuginfo-common-x86_64-0:4.18.0-305.el8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.4.0.GA:kernel-tools-debuginfo-0:4.18.0-305.el8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.4.0.GA:kernel-tools-debuginfo-0:4.18.0-305.el8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.4.0.GA:kernel-tools-debuginfo-0:4.18.0-305.el8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.4.0.GA:kernel-tools-libs-devel-0:4.18.0-305.el8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.4.0.GA:kernel-tools-libs-devel-0:4.18.0-305.el8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.4.0.GA:kernel-tools-libs-devel-0:4.18.0-305.el8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.4.0.GA:perf-debuginfo-0:4.18.0-305.el8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.4.0.GA:perf-debuginfo-0:4.18.0-305.el8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.4.0.GA:perf-debuginfo-0:4.18.0-305.el8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.4.0.GA:python3-perf-debuginfo-0:4.18.0-305.el8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.4.0.GA:python3-perf-debuginfo-0:4.18.0-305.el8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: CRB-8.4.0.GA:python3-perf-debuginfo-0:4.18.0-305.el8.x86_64 | — |
Vendor Fix
fix
Workaround
|
A flaw was found in the Linux kernel’s implementation for ADU devices from Ontrak Control Systems, where an attacker with administrative privileges and access to a local account could pre-groom the memory and physically disconnect or unload a module. The attacker must be able to access either of these two events to trigger the use-after-free, and then race the access to the use-after-free, to create a situation where key USB structs can be manipulated into corrupting memory.
A use-after-free flaw was found in iowarrior_disconnect in iowarrior USB driver module were a flag was simultaneously modified causing a race between a device open and disconnect. This flaw could allow a physical attacker to cause a denial of service (DoS) attack. This vulnerability could even lead to a kernel information leak problem.
A flaw out of bounds write in the Linux kernel human interface devices subsystem was found in the way user calls find key code by index. A local user could use this flaw to crash the system or escalate privileges on the system.
A flaw was found in the way the ov519 driver in the Linux kernel handled certain types of USB descriptors. This flaw allows an attacker with the ability to induce the error conditions to crash the system.
A flaw was found in the Linux kernel’s implementation of the pivot_root syscall. This flaw allows a local privileged user (root outside or root inside a privileged container) to exploit a race condition to manipulate the reference count of the root filesystem. To be able to abuse this flaw, the process or user calling pivot_root must have advanced permissions. The highest threat from this vulnerability is to system availability.
A flaw was found in the Linux kernel. An integer overflow in the firmware for some Intel(R) Graphics Drivers may allow a privileged user to potentially enable an escalation of privilege via local access. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
A flaw was found in the Linux kernel. Improper input validation in some Intel(R) Graphics Drivers may allow a privileged user to potentially enable a denial of service via local access.
Null pointer reference in some Intel(R) Graphics Drivers for Microsoft Windows and the Linux kernel may allow a privileged user to potentially enable a denial of service via local access.
A use-after-free flaw was found in usb_sg_cancel in drivers/usb/core/message.c in the USB core subsystem. This flaw allows a local attacker with a special user or root privileges to crash the system due to a race problem in the scatter-gather cancellation and transfer completion in usb_sg_wait. This vulnerability can also lead to a leak of internal kernel information.
A memory out-of-bounds read flaw was found in the Linux kernel's ext3/ext4 file system, in the way it accesses a directory with broken indexing. This flaw allows a local user to crash the system if the directory exists. The highest threat from this vulnerability is to system availability.
A use-after-free flaw was found in the Linux kernel’s cgroupv2 subsystem when rebooting the system. This flaw allows a local user to crash the system or escalate their privileges. The highest threat from this vulnerability is to system availability.
A NULL pointer dereference flaw was found in the Linux kernel’s UART 8250 functionality, in the way certain hardware architectures handled situations where default ports (0x2E8, 0x2F8, 0x3E8, 0x3F8) are not available. This flaw allows a local user to crash the system. The highest threat from this vulnerability is to system availability.
A vulnerability was found in NFSv4.2 in the Linux kernel, where a server fails to correctly apply umask when creating a new object on filesystem without ACL support (for example, ext4 with the "noacl" mount option). This flaw allows a local attacker with a user privilege to cause a kernel information leak problem.
A flaw was found in the NFSv4 implementation where when mounting a remote attacker controlled server it could return specially crafted response allow for local memory corruption and possibly privilege escalation.
A flaw was found in the capabilities check of the rados block device functionality in the Linux kernel. Incorrect capability checks could alllow a local user with root priviledges (but no capabilities) to add or remove Rados Block Devices from the system.
A flaw was found in the Linux kernels sysctl handling code for hugepages management. When multiple root level processes would write to modify the /proc/sys/vm/nr_hugepages file it could create a race on internal variables leading to a system crash or memory corruption.
A flaw was found in the HDLC_PPP module of the Linux kernel. Memory corruption and a read overflow is caused by improper input validation in the ppp_cp_parse_cr function which can cause the system to crash or cause a denial of service. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
A flaw was found in the Linux kernel. Traffic between two Geneve endpoints may be unencrypted when IPsec is configured to encrypt traffic for the specific UDP port used by the GENEVE tunnel allowing anyone in between the two endpoints to read the traffic unencrypted. The main threat from this vulnerability is to data confidentiality.
A memory leak flaw was found in the Linux kernel’s performance monitoring subsystem when using PERF_EVENT_IOC_SET_FILTER. This flaw allows a local user to starve the resources, causing a denial of service. The highest threat from this vulnerability is to system availability.
A flaw was found in the Linux kernel’s implementation of MIDI, where an attacker with a local account and the permissions to issue ioctl commands to midi devices could trigger a use-after-free issue. A write to this specific memory while freed and before use causes the flow of execution to change and possibly allow for memory corruption or privilege escalation. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
A flaw use after free in the Linux kernel infiniband hfi1 driver was found in the way user calls Ioctl after open dev file and fork. A local user could use this flaw to crash the system.
An out-of-bounds (OOB) SLAB memory access flaw was found in the Linux kernel's fbcon driver module. A bounds check failure allows a local attacker with special user privileges to gain access to out-of-bounds memory, leading to a system crash or leaking of internal kernel information. The highest threat from this vulnerability is to system availability.
A flaw possibility of race condition and incorrect initialization of the process id was found in the Linux kernel child/parent process identification handling while filtering signal handlers. A local attacker is able to abuse this flaw to bypass checks to send any signal to a privileged process.
A denial of service flaw was found in fuse_do_getattr in fs/fuse/dir.c in the kernel side of the FUSE filesystem in the Linux kernel. A local user could use this flaw to crash the system.
A use-after-free flaw was found in the Linux kernel’s Virtual Terminal subsystem in how a user calls the VT_DISALLOCATE ioctl during the closing/opening of ttys. This flaw allows a local user to crash the system.
A use-after-free flaw was found in the packet processing context in net/netfilter/x_tables.c in netfilter in the Linux Kernel. This issue occurs when the per-CPU sequence count is mishandled during concurrent iptables rules replacement and can be exploited with the CAP_NET_ADMIN capability in an unprivileged namespace.
A flaw use after free in the Linux kernel TUN/TAP device driver functionality was found in the way user create and use tun/tap device. A local user could use this flaw to crash the system or possibly escalate their privileges on the system.
A flaw was found in the way the Linux kernel's pfkey_dump function trusted the provided filter size parameters. A local, sufficiently privileged user could use this flaw to leak information from the kernel.
A flaw was found in the Linux kernel. A denial of service problem is identified if an extent tree is corrupted in a crafted ext4 filesystem in fs/ext4/extents.c in ext4_es_cache_extent. Fabricating an integer overflow, A local attacker with a special user privilege may cause a system crash problem which can lead to an availability threat.
A remote denial of service vulnerability was found in the Linux kernel’s TIPC kernel module. The while loop in tipc_link_xmit() hits an unknown state while attempting to parse SKBs, which are not in the queue. Sending two small UDP packets to a system with a UDP bearer results in the CPU utilization for the system to instantly spike to 100%, causing a denial of service condition.
Loading 1.2 MB of JSON…
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.