Multiple Security Vulnerabilities in Linux Kernel
dezembro 27, 2022
Overview On December 26, 2022, NSFOCUS CERT detected multiple security vulnerabilities in Linux Kernel released online, relevant users are requested to take protective measures as soon as possible. Linux Kernel Remote Code Execution Vulnerability (CVE-2022-47939): A remote code execution vulnerability exists in Linux Kernel SMB2_TREE_DISCONNECT command processing. Due to the lack of verification of the […]
Linux Kernel Privilege Escalation Vulnerability (CVE-2022-2588) Notification
setembro 27, 2022
Overview Recently, NSFOCUS CERT detected that a researcher disclosed an EXP that exists in the Linux kernel privilege escalation vulnerability (CVE-2022-2588) on the Internet. Due to improper operation of the route4_filter linked list, there is a use-after-free vulnerability in the route4_change function of the net/schedule/cls_route.c filter. By exploiting this vulnerability, a local attacker with general […]
Linux Kernel Privilege Escalation Vulnerability (CVE-2022-0847) Alert
março 10, 2022
Overview Recently, NSFOCUS CERT detected that a security researcher disclosed a local privilege escalation vulnerability (CVE-2022-0847) in the Linux kernel. Due to a flaw in the correct initialization of the copy_page_to_iter_pipe and push_pipe functions in the Linux kernel, an attacker can overwrite the data in any readable file by exploiting this vulnerability, thereby escalating ordinary […]
Linux Polkit Privilege Escalation Vulnerability (CVE-2021-4034)
fevereiro 5, 2022
Overview On January 26, NSFOCUS CERT detected that the Qualys research team publicly disclosed a privilege escalation vulnerability (CVE-2021-4034) found in Polkit’s pkexec, also known as PwnKit. The vulnerability is due to the inability of pkexec to properly process the call parameters, thereby executing the environment variable as a command. An attacker with arbitrary user […]
Linux Kernel Arbitrary Code Execution Vulnerability (CVE-2021-3490) Threat Alert
setembro 18, 2021
Overview Recently, NSFOCUS CERT found that a security researcher published details and the PoC of an arbitrary code execution vulnerability (CVE-2021-3490) in eBPF and exploited this vulnerability to cause local privilege escalation on Ubuntu 20.10 and 21.04. This vulnerability exists because the eBPF ALU32 bounds tracking for bitwise ops (AND, OR and XOR) in the […]
Linux Kernel Privilege Escalation Vulnerability (CVE-2021-33909) Threat Alert
agosto 13, 2021
Overview Recently, NSFOCUS CERT discovered that the Qualys research team disclosed a local privilege escalation vulnerability (CVE-2021-33909, aka Sequoia) in the filesystem layer in the Linux kernel. It is a size_t-to-int type conversion vulnerability in the seq_file interface in the Linux kernel. fs/seq_file.c’s improper restriction of the seq buffer allocation may cause an integer overflow, […]
Linux Kernel Privilege Escalation Vulnerability (CVE-2020-14386) Threat Alert
outubro 20, 2020
Vulnerability Description
Recently, NSFOCUS detected a privilege escalation vulnerability in the Linux kernel (CVE-2020-14386). An integer overflow exists in the way net/packet/af_packet.c processes AF_PACKET, which leads to out-of-bounds write, thereby escalating privileges. An attacker could exploit this vulnerability to gain system root privileges from unprivileged processes. This vulnerability may affect virtualized products using the Linux kernel, such as OpenShift, Kubernetes, and docker, thus leading to VM escape. Affected users should take preventive measures.
(mais…)Linux Kernel Multiple Remote Denial-of-Service Vulnerabilities Threat Alert
junho 25, 2019
Overview
Recently, Red Hat released a security bulletin, pointing out multiple TCP-based remote denial-of-service vulnerabilities in the Linux kernel, namely, a SACK Panic vulnerability of important severity and two other vulnerabilities of moderate severity. (mais…)
Linux apt/apt-get Remote Code Execution (RCE) Vulnerability (CVE-2019-3462) Threat Alert
janeiro 28, 2019
Overview
On January 22, 2019, local time, security researcher Max Justicz announced his discovery of a remote code execution (RCE) vulnerability in Linux apt/apt-get. This vulnerability stems from the APT’s failure to properly handle certain parameters involved in HTTP redirects. It can be triggered via a man-in-the-middle attack or a malicious package mirror, resulting in remote code execution. (mais…)
