Kernel vulnerabilities
27 vulnerabilities
Known vulnerabilities in Kernel products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 9 products.
Products
9- Util Linux18 vulnerabilities
- Linux Kernel2 vulnerabilities
- Drivers1 vulnerabilities
- Heap Based Buffer Overflow In Fs/Ext4/Xattr.C1 vulnerabilities
- KVM1 vulnerabilities
- Linux Pam1 vulnerabilities
- Security1 vulnerabilities
- Selinux1 vulnerabilities
- Vhost1 vulnerabilities
CVE-2018-1087canonicalubuntu_linux+29
EPSS score0.76%
kernel KVM before versions kernel 4.16, kernel 4.16-rc7, kernel 4.17-rc1, kernel 4.17-rc2 and kernel 4.17-rc3 is vulnerable to a flaw in the way the Linux kernel's KVM hypervisor handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack switch operation, the processor did not deliver interrupts and exceptions, rather they are delivered once the first instruction after the stack switch is executed. An unprivileged KVM guest user could use this flaw to crash the guest or, potentially, escalate their privileges in the guest.CVE-2018-1108canonicalubuntu_linux+12EPSS score1.73%
kernel drivers before version 4.17-rc1 are vulnerable to a weakness in the Linux kernel's implementation of random seed data. Programs, early in the boot sequence, could use the data allocated for the seed before it was sufficiently generated.CVE-2018-1118canonicalubuntu_linux+16EPSS score0.38%
Linux kernel vhost since version 4.8 does not properly initialize memory in messages passed between virtual guests and the host operating system in the vhost/vhost.c:vhost_new_msg() function. This can allow local privileged users to read some kernel memory contents when reading from the /dev/vhost-net device file.CVE-2018-17953kernellinux-pam+3EPSS score1.34%
A incorrect variable in a SUSE specific patch for pam_access rule matching in PAM 1.3.0 in openSUSE Leap 15.0 and SUSE Linux Enterprise 15 could lead to pam_access rules not being applied (fail open).CVE-2018-7738debianbash-completion+55EPSS score0.43%
In util-linux before 2.32-rc1, bash-completion/umount allows local users to gain privileges by embedding shell commands in a mountpoint name, which is mishandled during a umount command (within Bash) by a different user, as demonstrated by logging in as root and entering umount followed by a tab character for autocompletion.CVE-2018-10840chainguardhyperv-daemons-6.18+110EPSS score0.67%
Linux kernel is vulnerable to a heap-based buffer overflow in the fs/ext4/xattr.c:ext4_xattr_set_entry() function. An attacker could exploit this by operating on a mounted crafted ext4 image.CVE-2013-0157debianutil-linux+9EPSS score0.38%
(a) mount and (b) umount in util-linux 2.14.1, 2.17.2, and probably other versions allow local users to determine the existence of restricted directories by (1) using the --guess-fstype command-line option or (2) attempting to mount a non-existent device, which generates different error messages depending on whether the directory exists.CVE-2021-37600alpineutil-linux+69EPSS score0.66%
An integer overflow in util-linux through 2.37.1 can potentially cause a buffer overflow if an attacker were able to use system resources in a way that leads to a large number in the /proc/sysvipc/sem file. NOTE: this is unexploitable in GNU C Library environments, and possibly in all realistic environments.CVE-2021-3995alpineutil-linux+4EPSS score0.64%
A logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmount a FUSE filesystem. This flaw allows an unprivileged local attacker to unmount FUSE filesystems that belong to certain other users who have a UID that is a prefix of the UID of the attacker in its string form. An attacker may use this flaw to cause a denial of service to applications that use the affected filesystems.CVE-2021-3996alpineutil-linux+4EPSS score0.64%
A logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmount a FUSE filesystem. This flaw allows a local user on a vulnerable system to unmount other users' filesystems that are either world-writable themselves (like /tmp) or mounted in a world-writable directory. An attacker may use this flaw to cause a denial of service to applications that use the affected filesystems.CVE-2015-5224debianutil-linux+2EPSS score4.53%
The mkostemp function in login-utils in util-linux when used incorrectly allows remote attackers to cause file name collision and possibly other attacks.CVE-2015-5218debianutil-linux+23EPSS score0.61%
Buffer overflow in text-utils/colcrt.c in colcrt in util-linux before 2.27 allows local users to cause a denial of service (crash) via a crafted file, related to the page global variable.CVE-2007-5191canonicalubuntu_linux+10EPSS score0.44%
mount and umount in util-linux and loop-aes-utils call the setuid and setgid functions in the wrong order and do not check the return values, which might allow attackers to gain privileges via helpers such as mount.nfs.CVE-2007-6712kernellinux_kernelEPSS score0.39%
Integer overflow in the hrtimer_forward function (hrtimer.c) in Linux kernel 2.6.21-rc4, when running on 64-bit systems, allows local users to cause a denial of service (infinite loop) via a timer with a large expiry value, which causes the timer to always be expired.CVE-2016-2779debianutil-linux+2EPSS score0.39%
runuser in util-linux allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.CVE-2016-9604debianlinux+23EPSS score0.27%
It was discovered in the Linux kernel before 4.11-rc8 that root can gain direct access to an internal keyring, such as '.dns_resolver' in RHEL-7 or '.builtin_trusted_keys' upstream, by joining it as its session keyring. This allows root to bypass module signature verification by adding a new public key of its own devising to the keyring.CVE-2016-5011debianutil-linux+45EPSS score0.46%
The parse_dos_extended function in partitions/dos.c in the libblkid library in util-linux allows physically proximate attackers to cause a denial of service (memory consumption) via a crafted MSDOS partition table with an extended partition boot record at zero offset.CVE-2020-21583debianutil-linux+2EPSS score0.55%
An issue was discovered in hwclock.13-v2.27 allows attackers to gain escalated privlidges or execute arbitrary commands via the path parameter when setting the date.CVE-2020-10751debianlinux+43EPSS score0.35%
A flaw was found in the Linux kernels SELinux LSM hook implementation before version 5.7, where it incorrectly assumed that an skb would only contain a single netlink message. The hook would incorrectly only validate the first netlink message in the skb and allow or deny the rest of the messages within the skb with the granted permission without further processing.CVE-2014-9114debianutil-linux+16EPSS score0.64%
Blkid in util-linux before 2.26rc-1 allows local users to execute arbitrary code.