Debian Linux vulnerabilities

CVE-2022-0847 [HIGH] CVE-2022-0847: linux - A flaw was found in the way the "flags" member of the new pipe buffer structure ... A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache backed by read only files and as such escalate their privileges on t

CVE-2016-5195 [HIGH] CVE-2016-5195: linux - Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allo... Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka "Dirty COW." Scope: local bookworm: resolved (fixed in 4.7.8-1) bullseye: resolved (fixed in 4.7.8-1) fork

CVE-2021-22555 [HIGH] CVE-2021-22555: linux - A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in n... A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space Scope: local bookworm: resolved (fixed in 5.10.38-1) bullseye: resolved (fixed in 5.10.38-1) forky: resolved (fixed in 5.10.38-1) sid: resolved (fixed in

CVE-2014-3153 [HIGH] CVE-2014-3153: linux - The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 ... The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which allows local users to gain privileges via a crafted FUTEX_REQUEUE command that facilitates unsafe waiter modification. Scope: local bookworm: resolved (fixed in 3.14.5-1) bullseye: resolved (fixed in 3.14.5-1) forky: resolv

CVE-2013-2094 [HIGH] CVE-2013-2094: linux - The perf_swevent_init function in kernel/events/core.c in the Linux kernel befor... The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect integer data type, which allows local users to gain privileges via a crafted perf_event_open system call. Scope: local bookworm: resolved (fixed in 3.8.11-1) bullseye: resolved (fixed in 3.8.11-1) forky: resolved (fixed in 3.8.11-1) sid: resolved (fixed in 3.8.11-1)

CVE-2019-13272 [HIGH] CVE-2019-13272: linux - In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the... In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by

CVE-2021-3493 [HIGH] CVE-2021-3493: linux - The overlayfs implementation in the linux kernel did not properly validate with ... The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an underlying file system. Due to the combination of unprivileged user namespaces along with a patch carried in the Ubuntu kernel to allow unprivileged overlay mounts, an attacker could use this to gain elevated privileg

CVE-2024-1086 [HIGH] CVE-2024-1086: linux - A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables compon... A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error which resembles NF_AC

CVE-2019-2215 [HIGH] CVE-2019-2215: linux - A use-after-free in binder.c allows an elevation of privilege from an applicatio... A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interaction is required to exploit this vulnerability, however exploitation does require either the installation of a malicious local application or a separate vulnerability in a network facing application.Product: AndroidAndroid ID: A-141720095 Scope: local bo

CVE-2013-6282 [HIGH] CVE-2013-6282: linux - The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5... The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not validate certain addresses, which allows attackers to read or modify the contents of arbitrary kernel memory locations via a crafted application, as exploited in the wild against Android devices in October and November 2013. Scope: local bookworm: reso

CVE-2022-0185 [HIGH] CVE-2022-0185: linux - A heap-based buffer overflow flaw was found in the way the legacy_parse_param fu... A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functionality of the Linux kernel verified the supplied parameters length. An unprivileged (in case of unprivileged user namespaces enabled, otherwise needs namespaced CAP_SYS_ADMIN privilege) local user able to open a filesystem that does not support the Fil

CVE-2017-1000253 [HIGH] CVE-2017-1000253: linux - Linux distributions that have not patched their long-term kernels with https://g... Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (committed on April 14, 2015). This kernel vulnerability was fixed in April 2015 by commit a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (backported to Linux 3.10.77 in May 2015), but it was not recognized as a security threat. Wi

CVE-2018-14634 [HIGH] CVE-2018-14634: linux - An integer overflow flaw was found in the Linux kernel's create_elf_tables() fun... An integer overflow flaw was found in the Linux kernel's create_elf_tables() function. An unprivileged local user with access to SUID (or otherwise privileged) binary could use this flaw to escalate their privileges on the system. Kernel versions 2.6.x, 3.10.x and 4.14.x are believed to be vulnerable. Scope: local bookworm: resolved (fixed in 4.12.6-1) bullseye: resol

CVE-2022-0492 [HIGH] CVE-2022-0492: linux - A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in th... A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly. Scope: local bookworm: resolved (fixed in 5.16.7-1) bullseye: resolved (fixed in 5.10.1

CVE-2023-0386 [HIGH] CVE-2023-0386: linux - A flaw was found in the Linux kernel, where unauthorized access to the execution... A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system. Scope: local bookworm: resolved (fixed in

CVE-2021-22600 [MEDIUM] CVE-2021-22600: linux - A double free bug in packet_set_ring() in net/packet/af_packet.c can be exploite... A double free bug in packet_set_ring() in net/packet/af_packet.c can be exploited by a local user through crafted syscalls to escalate privileges or deny service. We recommend upgrading kernel past the effected versions or rebuilding past ec6af094ea28f0f2dda1a6a33b14cd57e36a9755 Scope: local bookworm: resolved (fixed in 5.15.15-1) bullseye: resolved (fixed in 5.10.9

CVE-2014-0196 [MEDIUM] CVE-2014-0196: linux - The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14... The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial of service (memory corruption and system crash) or gain privileges by triggering a race condition involving read and write operations with long strings. Scope: local bookw

CVE-2020-0041 [HIGH] CVE-2020-0041: linux - In binder_transaction of binder.c, there is a possible out of bounds write due t... In binder_transaction of binder.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-145988638References: Upstream kernel Scope: local bookworm: reso

CVE-2022-2586 [MEDIUM] CVE-2022-2586: linux - It was discovered that a nft object or expression could reference a nft set on a... It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that table was deleted. Scope: local bookworm: resolved (fixed in 5.18.16-1) bullseye: resolved (fixed in 5.10.136-1) forky: resolved (fixed in 5.18.16-1) sid: resolved (fixed in 5.18.16-1) trixie: resolved (fixed in 5.18.16-1)

CVE-2013-2596 [HIGH] CVE-2013-2596: linux - Integer overflow in the fb_mmap function in drivers/video/fbmem.c in the Linux k... Integer overflow in the fb_mmap function in drivers/video/fbmem.c in the Linux kernel before 3.8.9, as used in a certain Motorola build of Android 4.1.2 and other products, allows local users to create a read-write memory mapping for the entirety of kernel memory, and consequently gain privileges, via crafted /dev/graphics/fb0 mmap2 system calls, as demonstrated by the