Kernel/ptrace.c in Linux kernel mishandles contains an improper privilege management vulnerability that allows local users to obtain root access. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Linux Kernel contains a flaw in the packet socket (AF_PACKET) implementation which could lead to incorrectly freeing memory. A local user could exploit this for denial-of-service (DoS) or possibly for privilege escalation. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Linux kernel contains an improper initialization vulnerability where an unprivileged local user could escalate their privileges on the system. This vulnerability has the moniker of "Dirty Pipe." CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Android kernel contains a use-after-free vulnerability that allows for privilege escalation. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Android kernel contains a race condition, which allows for a use-after-free vulnerability. Exploitation can allow for privilege escalation. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
The futex_requeue function in kernel/futex.c in Linux kernel does not ensure that calls have two different futex addresses, which allows local users to gain privileges. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Linux kernel fails to check all 64 bits of attr.config passed by user space, resulting to out-of-bounds access of the perf_swevent_enabled array in sw_perf_event_destroy(). Explotation allows for privilege escalation. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Linux kernel fb_mmap function in drivers/video/fbmem.c contains an integer overflow vulnerability that allows for privilege escalation. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
The get_user and put_user API functions of the Linux kernel fail to validate the target address when being used on ARM v6k/v7 platforms. This allows an application to read and write kernel memory which could lead to privilege escalation. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
The overlayfs stacking file system in Linux kernel does not properly validate the application of file capabilities against user namespaces, which could lead to privilege escalation. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Linux kernel contains a use-after-free vulnerability that allows for privilege escalation to gain ring0 access from the system user. CISA required action: Apply updates per vendor instructions.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Linux Kernel contains a race condition vulnerability within the n_tty_write function that allows local users to cause a denial-of-service (DoS) or gain privileges via read and write operations with long strings. CISA required action: The impacted product is end-of-life and should be disconnected if still in use.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Linux Kernel contains an improper input validation vulnerability in the Reliable Datagram Sockets (RDS) protocol implementation that allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls. CISA required action: The impacted product is end-of-life and should be disconnected if still in use.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Linux kernel contains a use-after-free vulnerability in the netfilter: nf_tables component that allows an attacker to achieve local privilege escalation. CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Linux Kernel contains a use-after-free vulnerability in the nft_object, allowing local attackers to escalate privileges. CISA required action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Android contains an unspecified vulnerability in the kernel that allows for remote code execution. This vulnerability resides in Linux Kernel and could impact other products, including but not limited to Android OS. CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Linux kernel contains a heap-based buffer overflow vulnerability in the legacy_parse_param function in the Filesystem Context functionality. This allows an attacker to open a filesystem that does not support the Filesystem Context API and ultimately escalate privileges. CISA required action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Linux kernel contains a position-independent executable (PIE) stack buffer corruption vulnerability in load_elf_ binary() that allows a local attacker to escalate privileges. CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Linux kernel contains an out-of-bounds write vulnerability in the uvc_parse_streaming component of the USB Video Class (UVC) driver that could allow for physical escalation of privilege. CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
