p PatchFirst

PatchFirst · Vulnérabilités récentes

Vulnérabilités de linux-gcp · Page n° 150

Vulnérabilité publiée pour linux-gcp au cours des 30 derniers jours : 0. Dans le catalogue KEV : 0.

RSS ↗ JSON ↗
Filtrer les vulnérabilités
Effacer les filtres

Vulnérabilités : 3436

  1. CVE-2023-1281

    Élevée · CVSS 7.8EPSS 0,3%Correctif disponible

    UAF in Linux kernel's tcindex (traffic control index filter) implementation

    Use After Free vulnerability in Linux kernel traffic control index filter (tcindex) allows Privilege Escalation. The imperfect hash area can be updated while packets are traversing, which will cause a use-after-free when 'tcf_exts_exec()' is called with the destroyed tcf_ext. A local attacker user can use this vulnerability to elevate its privileges to root. This issue affects Linux Kernel: from 4.14 before git commit ee059170b1f7e94e55fa6cadee544e176a6e59c2.

    linux-gcpSystèmes d’exploitation
    • Mettez à jour vers 5.4.0-1103.112
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  3. CVE-2023-1390

    Élevée · CVSS 7.5EPSS 5,1%Correctif disponible

    CVE-2023-1390

    A remote denial of service vulnerability was found in the Linux kernel’s TIPC kernel module. The while loop in tipc_link_xmit() hits an unknown state while attempting to parse SKBs, which are not in the queue. Sending two small UDP packets to a system with a UDP bearer results in the CPU utilization for the system to instantly spike to 100%, causing a denial of service condition.

    linux-gcpSystèmes d’exploitation
    • Mettez à jour vers 5.4.0-1038.41
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  6. CVE-2022-3424

    Élevée · CVSS 7.8EPSS 0,24%Correctif disponible

    CVE-2022-3424

    A use-after-free flaw was found in the Linux kernel’s SGI GRU driver in the way the first gru_file_unlocked_ioctl function is called by the user, where a fail pass occurs in the gru_check_chiplet_assignment function. This flaw allows a local user to crash or potentially escalate their privileges on the system.

    linux-gcpSystèmes d’exploitation
    • Mettez à jour vers 5.4.0-1101.110
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  11. CVE-2023-0461

    Élevée · CVSS 7.8EPSS 0,65%Correctif disponible

    Use-after-free vulnerability in the Linux Kernel

    There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local privilege escalation. To reach the vulnerability kernel configuration flag CONFIG_TLS or CONFIG_XFRM_ESPINTCP has to be configured, but the operation does not require any privilege. There is a use-after-free bug of icsk_ulp_data of a struct inet_connection_sock. When CONFIG_TLS is enabled, user can install a tls context (struct tls_context) on a connected tcp socket. The context is not cleared if this socket is disconnected and reused as a listener. If a new socket is created from the listener, the context is inherited and vulnerable. The se

    linux-gcpSystèmes d’exploitation
    • Mettez à jour vers 5.4.0-1101.110
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  13. CVE-2023-20938

    Élevée · CVSS 8.1EPSS 0,34%Code d’exploitation publicCorrectif disponible

    CVE-2023-20938

    In binder_transaction_buffer_release of binder.c, there is a possible use after free due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-257685302References: Upstream kernel

    linux-gcpSystèmes d’exploitation
    • Mettez à jour vers 5.4.0-1101.110
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  14. CVE-2023-1095

    Moyenne · CVSS 5.5EPSS 0,24%Correctif disponible

    CVE-2023-1095

    In nf_tables_updtable, if nf_tables_table_enable returns an error, nft_trans_destroy is called to free the transaction object. nft_trans_destroy() calls list_del(), but the transaction was never placed on a list -- the list head is all zeroes, this results in a NULL pointer dereference.

    linux-gcpSystèmes d’exploitation
    • Mettez à jour vers 5.4.0-1093.102
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  17. CVE-2023-0597

    Moyenne · CVSS 5.5EPSS 0,3%Correctif disponible

    CVE-2023-0597

    A flaw possibility of memory leak in the Linux kernel cpu_entry_area mapping of X86 CPU data to memory was found in the way user can guess location of exception stack(s) or other important data. A local user could use this flaw to get access to some important data with expected location in memory.

    linux-gcpSystèmes d’exploitation
    • Mettez à jour vers 5.4.0-1117.126
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  19. CVE-2023-0615

    Moyenne · CVSS 5.5EPSS 0,19%Correctif disponible

    CVE-2023-0615

    A memory leak flaw and potential divide by zero and Integer overflow was found in the Linux kernel V4L2 and vivid test code functionality. This issue occurs when a user triggers ioctls, such as VIDIOC_S_DV_TIMINGS ioctl. This could allow a local user to crash the system if vivid test code enabled.

    linux-gcpSystèmes d’exploitation
    • Mettez à jour vers 5.4.0-1100.109
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

Vérifiez votre serveur

Comparez votre pile et les versions installées aux bases de vulnérabilités actuelles.

Vérifiez votre serveur →