2.6.16.42 : Security Vulnerabilities (Gain Privilege)

Cpe Name:cpe:/o:linux:linux_kernel:2.6.16.42

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : Cve Number Descending Cve Number Ascending CVSS Score Descending Number Of Exploits Descending

Copy Results Download Results Select Table

#	CVE ID	CWE ID	# of Exploits	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
1	CVE-2012-0044	189		DoS Overflow +Priv Mem. Corr.	2012-05-17	2013-04-18	7.2	None	Local	Low	Not required	Complete	Complete	Complete
Integer overflow in the drm_mode_dirtyfb_ioctl function in drivers/gpu/drm/drm_crtc.c in the Direct Rendering Manager (DRM) subsystem in the Linux kernel before 3.1.5 allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted ioctl call.
2	CVE-2011-2517	119		Overflow +Priv	2012-05-24	2012-05-25	7.2	None	Local	Low	Not required	Complete	Complete	Complete
Multiple buffer overflows in net/wireless/nl80211.c in the Linux kernel before 2.6.39.2 allow local users to gain privileges by leveraging the CAP_NET_ADMIN capability during scan operations with a long SSID value.
3	CVE-2011-2022	20		DoS +Priv	2011-05-09	2012-03-19	6.9	None	Local	Medium	Not required	Complete	Complete	Complete
The agp_generic_remove_memory function in drivers/char/agp/generic.c in the Linux kernel before 2.6.38.5 does not validate a certain start parameter, which allows local users to gain privileges or cause a denial of service (system crash) via a crafted AGPIOC_UNBIND agp_ioctl ioctl call, a different vulnerability than CVE-2011-1745.
4	CVE-2011-1745	189		DoS Overflow +Priv	2011-05-09	2012-03-19	6.9	None	Local	Medium	Not required	Complete	Complete	Complete
Integer overflow in the agp_generic_insert_memory function in drivers/char/agp/generic.c in the Linux kernel before 2.6.38.5 allows local users to gain privileges or cause a denial of service (system crash) via a crafted AGPIOC_BIND agp_ioctl ioctl call.
5	CVE-2011-1495	20		DoS +Priv Mem. Corr. +Info	2011-05-03	2012-04-27	7.2	Admin	Local	Low	Not required	Complete	Complete	Complete
drivers/scsi/mpt2sas/mpt2sas_ctl.c in the Linux kernel 2.6.38 and earlier does not validate (1) length and (2) offset values before performing memory copy operations, which might allow local users to gain privileges, cause a denial of service (memory corruption), or obtain sensitive information from kernel memory via a crafted ioctl call, related to the _ctl_do_mpt_command and _ctl_diag_read_buffer functions.
6	CVE-2011-1494	189		DoS Overflow +Priv Mem. Corr.	2011-05-03	2012-04-27	6.9	None	Local	Medium	Not required	Complete	Complete	Complete
Integer overflow in the _ctl_do_mpt_command function in drivers/scsi/mpt2sas/mpt2sas_ctl.c in the Linux kernel 2.6.38 and earlier might allow local users to gain privileges or cause a denial of service (memory corruption) via an ioctl call specifying a crafted value that triggers a heap-based buffer overflow.
7	CVE-2011-1169	20		DoS +Priv Mem. Corr.	2011-05-03	2012-04-27	6.9	None	Local	Medium	Not required	Complete	Complete	Complete
Array index error in the asihpi_hpi_ioctl function in sound/pci/asihpi/hpioctl.c in the AudioScience HPI driver in the Linux kernel before 2.6.38.1 might allow local users to cause a denial of service (memory corruption) or possibly gain privileges via a crafted adapter index value that triggers access to an invalid kernel pointer.
8	CVE-2011-1017	119		Overflow +Priv +Info	2011-03-01	2012-03-19	7.2	None	Local	Low	Not required	Complete	Complete	Complete
Heap-based buffer overflow in the ldm_frag_add function in fs/partitions/ldm.c in the Linux kernel 2.6.37.2 and earlier might allow local users to gain privileges or obtain sensitive information via a crafted LDM partition table.
9	CVE-2010-4656	119		DoS Overflow +Priv	2011-07-18	2012-03-19	6.2	None	Local	High	Not required	Complete	Complete	Complete
The iowarrior_write function in drivers/usb/misc/iowarrior.c in the Linux kernel before 2.6.37 does not properly allocate memory, which might allow local users to trigger a heap-based buffer overflow, and consequently cause a denial of service or gain privileges, via a long report.
10	CVE-2010-4527	119		Overflow +Priv +Info	2011-01-13	2012-03-19	6.9	None	Local	Medium	Not required	Complete	Complete	Complete
The load_mixer_volumes function in sound/oss/soundcard.c in the OSS sound subsystem in the Linux kernel before 2.6.37 incorrectly expects that a certain name field ends with a '\0' character, which allows local users to conduct buffer overflow attacks and gain privileges, or possibly obtain sensitive information from kernel memory, via a SOUND_MIXER_SETLEVELS ioctl call.
11	CVE-2010-4347	264	1	+Priv	2010-12-22	2012-03-19	6.9	None	Local	Medium	Not required	Complete	Complete	Complete
The ACPI subsystem in the Linux kernel before 2.6.36.2 uses 0222 permissions for the debugfs custom_method file, which allows local users to gain privileges by placing a custom ACPI method in the ACPI interpreter tables, related to the acpi_debugfs_init function in drivers/acpi/debugfs.c.
12	CVE-2010-4258	264		+Priv Bypass	2010-12-30	2012-03-19	6.2	Admin	Local	High	Not required	Complete	Complete	Complete
The do_exit function in kernel/exit.c in the Linux kernel before 2.6.36.2 does not properly handle a KERNEL_DS get_fs value, which allows local users to bypass intended access_ok restrictions, overwrite arbitrary kernel memory locations, and gain privileges by leveraging a (1) BUG, (2) NULL pointer dereference, or (3) page fault, as demonstrated by vectors involving the clear_child_tid feature and the splice system call.
13	CVE-2010-4160	189		DoS Overflow +Priv Mem. Corr.	2011-01-07	2013-01-21	6.9	None	Local	Medium	Not required	Complete	Complete	Complete
Multiple integer overflows in the (1) pppol2tp_sendmsg function in net/l2tp/l2tp_ppp.c, and the (2) l2tp_ip_sendmsg function in net/l2tp/l2tp_ip.c, in the PPPoL2TP and IPoL2TP implementations in the Linux kernel before 2.6.36.2 allow local users to cause a denial of service (heap memory corruption and panic) or possibly gain privileges via a crafted sendto call.
14	CVE-2010-3904	20		+Priv	2010-12-06	2012-03-19	7.2	None	Local	Low	Not required	Complete	Complete	Complete
The rds_page_copy_user function in net/rds/page.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel before 2.6.36 does not properly validate addresses obtained from user space, which allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls.
15	CVE-2010-3859	189		Overflow +Priv	2010-12-29	2012-03-19	6.9	None	Local	Medium	Not required	Complete	Complete	Complete
Multiple integer signedness errors in the TIPC implementation in the Linux kernel before 2.6.36.2 allow local users to gain privileges via a crafted sendmsg call that triggers a heap-based buffer overflow, related to the tipc_msg_build function in net/tipc/msg.c and the verify_iovec function in net/core/iovec.c.
16	CVE-2010-3848	119		Overflow +Priv	2010-12-30	2012-03-19	6.9	None	Local	Medium	Not required	Complete	Complete	Complete
Stack-based buffer overflow in the econet_sendmsg function in net/econet/af_econet.c in the Linux kernel before 2.6.36.2, when an econet address is configured, allows local users to gain privileges by providing a large number of iovec structures.
17	CVE-2010-3301			+Priv	2010-09-22	2012-03-19	7.2	None	Local	Low	Not required	Complete	Complete	Complete
The IA32 system call emulation functionality in arch/x86/ia32/ia32entry.S in the Linux kernel before 2.6.36-rc4-git2 on the x86_64 platform does not zero extend the %eax register after the 32-bit entry path to ptrace is used, which allows local users to gain privileges by triggering an out-of-bounds access to the system call table using the %rax register. NOTE: this vulnerability exists because of a CVE-2007-4573 regression.
18	CVE-2010-3081	119		Overflow +Priv	2010-09-24	2012-03-19	7.2	None	Local	Low	Not required	Complete	Complete	Complete
The compat_alloc_user_space functions in include/asm/compat.h files in the Linux kernel before 2.6.36-rc4-git2 on 64-bit platforms do not properly allocate the userspace memory required for the 32-bit compatibility layer, which allows local users to gain privileges by leveraging the ability of the compat_mc_getsockopt function (aka the MCAST_MSFILTER getsockopt support) to control a certain length value, related to a "stack pointer underflow" issue, as exploited in the wild in September 2010.
19	CVE-2010-2963	20		+Priv	2010-11-26	2012-03-19	6.2	None	Local	High	Not required	Complete	Complete	Complete
drivers/media/video/v4l2-compat-ioctl32.c in the Video4Linux (V4L) implementation in the Linux kernel before 2.6.36 on 64-bit platforms does not validate the destination of a memory copy operation, which allows local users to write to arbitrary kernel memory locations, and consequently gain privileges, via a VIDIOCSTUNER ioctl call on a /dev/video device, followed by a VIDIOCSMICROCODE ioctl call on this device.
20	CVE-2010-2962	20		+Priv	2010-11-26	2012-03-19	7.2	None	Local	Low	Not required	Complete	Complete	Complete
drivers/gpu/drm/i915/i915_gem.c in the Graphics Execution Manager (GEM) in the Intel i915 driver in the Direct Rendering Manager (DRM) subsystem in the Linux kernel before 2.6.36 does not properly validate pointers to blocks of memory, which allows local users to write to arbitrary kernel memory locations, and consequently gain privileges, via crafted use of the ioctl interface, related to (1) pwrite and (2) pread operations.
21	CVE-2010-2492	119		DoS Overflow +Priv	2010-09-08	2012-03-19	7.2	None	Local	Low	Not required	Complete	Complete	Complete
Buffer overflow in the ecryptfs_uid_hash macro in fs/ecryptfs/messaging.c in the eCryptfs subsystem in the Linux kernel before 2.6.35 might allow local users to gain privileges or cause a denial of service (system crash) via unspecified vectors.
22	CVE-2010-1146	264	1	+Priv	2010-04-12	2012-03-19	6.9	None	Local	Medium	Not required	Complete	Complete	Complete
The Linux kernel 2.6.33.2 and earlier, when a ReiserFS filesystem exists, does not restrict read or write access to the .reiserfs_priv directory, which allows local users to gain privileges by modifying (1) extended attributes or (2) ACLs, as demonstrated by deleting a file under .reiserfs_priv/xattrs/.
23	CVE-2009-4004	119		DoS Overflow +Priv Mem. Corr.	2009-11-19	2012-03-19	7.2	None	Local	Low	Not required	Complete	Complete	Complete
Buffer overflow in the kvm_vcpu_ioctl_x86_setup_mce function in arch/x86/kvm/x86.c in the KVM subsystem in the Linux kernel before 2.6.32-rc7 allows local users to cause a denial of service (memory corruption) or possibly gain privileges via a KVM_X86_SETUP_MCE IOCTL request that specifies a large number of Machine Check Exception (MCE) banks.
24	CVE-2009-3725	264		+Priv Bypass	2009-11-06	2012-03-19	7.2	None	Local	Low	Not required	Complete	Complete	Complete
The connector layer in the Linux kernel before 2.6.31.5 does not require the CAP_SYS_ADMIN capability for certain interaction with the (1) uvesafb, (2) pohmelfs, (3) dst, or (4) dm subsystem, which allows local users to bypass intended access restrictions and gain privileges via calls to functions in these subsystems.
25	CVE-2009-3640	20		DoS +Priv	2009-10-29	2012-03-19	4.9	None	Local	Low	Not required	None	None	Complete
The update_cr8_intercept function in arch/x86/kvm/x86.c in the KVM subsystem in the Linux kernel before 2.6.32-rc1 does not properly handle the absence of an Advanced Programmable Interrupt Controller (APIC), which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly gain privileges via a call to the kvm_vcpu_ioctl function.
26	CVE-2009-3624	310		DoS +Priv	2009-11-02	2012-03-19	4.6	None	Local	Low	Not required	Partial	Partial	Partial
The get_instantiation_keyring function in security/keys/keyctl.c in the KEYS subsystem in the Linux kernel before 2.6.32-rc5 does not properly maintain the reference count of a keyring, which allows local users to gain privileges or cause a denial of service (OOPS) via vectors involving calls to this function without specifying a keyring by ID, as demonstrated by a series of keyctl request2 and keyctl list commands.
27	CVE-2009-3620	20		DoS +Priv	2009-10-22	2012-03-19	4.9	None	Local	Low	Not required	None	None	Complete
The ATI Rage 128 (aka r128) driver in the Linux kernel before 2.6.31-git11 does not properly verify Concurrent Command Engine (CCE) state initialization, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly gain privileges via unspecified ioctl calls.
28	CVE-2009-3547	362		DoS +Priv	2009-11-04	2012-03-19	6.9	None	Local	Medium	Not required	Complete	Complete	Complete
Multiple race conditions in fs/pipe.c in the Linux kernel before 2.6.32-rc6 allow local users to cause a denial of service (NULL pointer dereference and system crash) or gain privileges by attempting to open an anonymous pipe via a /proc/*/fd/ pathname.
29	CVE-2009-3080			DoS +Priv	2009-11-20	2012-03-19	7.2	None	Local	Low	Not required	Complete	Complete	Complete
Array index error in the gdth_read_event function in drivers/scsi/gdth.c in the Linux kernel before 2.6.32-rc8 allows local users to cause a denial of service or possibly gain privileges via a negative event index in an IOCTL request.
30	CVE-2009-3043	399		DoS +Priv	2009-09-02	2012-03-19	4.9	None	Local	Low	Not required	None	None	Complete
The tty_ldisc_hangup function in drivers/char/tty_ldisc.c in the Linux kernel 2.6.31-rc before 2.6.31-rc8 allows local users to cause a denial of service (system crash, sometimes preceded by a NULL pointer dereference) or possibly gain privileges via certain pseudo-terminal I/O activity, as demonstrated by KernelTtyTest.c.
31	CVE-2009-2848			DoS +Priv Mem. Corr.	2009-08-18	2013-01-22	4.7	None	Local	Medium	Not required	None	None	Complete
The execve function in the Linux kernel, possibly 2.6.30-rc6 and earlier, does not properly clear the current->clear_child_tid pointer, which allows local users to cause a denial of service (memory corruption) or possibly gain privileges via a clone system call with CLONE_CHILD_SETTID or CLONE_CHILD_CLEARTID enabled, which is not properly handled during thread creation and exit.
32	CVE-2009-2698			DoS +Priv	2009-08-27	2012-03-19	7.2	None	Local	Low	Not required	Complete	Complete	Complete
The udp_sendmsg function in the UDP implementation in (1) net/ipv4/udp.c and (2) net/ipv6/udp.c in the Linux kernel before 2.6.19 allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) via vectors involving the MSG_MORE flag and a UDP socket.
33	CVE-2009-2695	119		Overflow +Priv	2009-08-28	2012-03-19	7.2	Admin	Local	Low	Not required	Complete	Complete	Complete
The Linux kernel before 2.6.31-rc7 does not properly prevent mmap operations that target page zero and other low memory addresses, which allows local users to gain privileges by exploiting NULL pointer dereference vulnerabilities, related to (1) the default configuration of the allow_unconfined_mmap_low boolean in SELinux on Red Hat Enterprise Linux (RHEL) 5, (2) an error that causes allow_unconfined_mmap_low to be ignored in the unconfined_t domain, (3) lack of a requirement for the CAP_SYS_RAWIO capability for these mmap operations, and (4) interaction between the mmap_min_addr protection mechanism and certain application programs.
34	CVE-2009-2584	189		Overflow +Priv	2009-07-23	2012-03-19	7.2	None	Local	Low	Not required	Complete	Complete	Complete
Off-by-one error in the options_write function in drivers/misc/sgi-gru/gruprocfs.c in the SGI GRU driver in the Linux kernel 2.6.30.2 and earlier on ia64 and x86 platforms might allow local users to overwrite arbitrary memory locations and gain privileges via a crafted count argument, which triggers a stack-based buffer overflow.
35	CVE-2009-2407	119		DoS Overflow +Priv	2009-07-31	2012-03-19	6.9	Admin	Local	Medium	Not required	Complete	Complete	Complete
Heap-based buffer overflow in the parse_tag_3_packet function in fs/ecryptfs/keystore.c in the eCryptfs subsystem in the Linux kernel before 2.6.30.4 allows local users to cause a denial of service (system crash) or possibly gain privileges via vectors involving a crafted eCryptfs file, related to a large encrypted key size in a Tag 3 packet.
36	CVE-2009-2406	119		DoS Overflow +Priv	2009-07-31	2012-03-19	6.9	Admin	Local	Medium	Not required	Complete	Complete	Complete
Stack-based buffer overflow in the parse_tag_11_packet function in fs/ecryptfs/keystore.c in the eCryptfs subsystem in the Linux kernel before 2.6.30.4 allows local users to cause a denial of service (system crash) or possibly gain privileges via vectors involving a crafted eCryptfs file, related to not ensuring that the key signature length in a Tag 11 packet is compatible with the key signature buffer size.
37	CVE-2009-1527	362		+Priv	2009-05-05	2012-03-19	6.9	None	Local	Medium	Not required	Complete	Complete	Complete
Race condition in the ptrace_attach function in kernel/ptrace.c in the Linux kernel before 2.6.30-rc4 allows local users to gain privileges via a PTRACE_ATTACH ptrace call during an exec system call that is launching a setuid application, related to locking an incorrect cred_exec_mutex object.
38	CVE-2009-0605	119		DoS Overflow +Priv Mem. Corr.	2009-02-17	2012-03-19	4.9	None	Local	Low	Not required	None	None	Complete
Stack consumption vulnerability in the do_page_fault function in arch/x86/mm/fault.c in the Linux kernel before 2.6.28.5 allows local users to cause a denial of service (memory corruption) or possibly gain privileges via unspecified vectors that trigger page faults on a machine that has a registered Kprobes probe.
39	CVE-2009-0024	264		DoS +Priv	2009-01-13	2012-03-19	7.2	Admin	Local	Low	Not required	Complete	Complete	Complete
The sys_remap_file_pages function in mm/fremap.c in the Linux kernel before 2.6.24.1 allows local users to cause a denial of service or gain privileges via unspecified vectors, related to the vm_file structure member, and the mmap_region and do_munmap functions.
40	CVE-2008-5182	362		+Priv	2008-11-20	2012-03-19	6.9	None	Local	Medium	Not required	Complete	Complete	Complete
The inotify functionality in Linux kernel 2.6 before 2.6.28-rc5 might allow local users to gain privileges via unknown vectors related to race conditions in inotify watch removal and umount.
41	CVE-2008-1375	362		DoS +Priv	2008-05-02	2012-03-19	6.9	Admin	Local	Medium	Not required	Complete	Complete	Complete
Race condition in the directory notification subsystem (dnotify) in Linux kernel 2.6.x before 2.6.24.6, and 2.6.25 before 2.6.25.1, allows local users to cause a denial of service (OOPS) and possibly gain privileges via unspecified vectors.

Total number of vulnerabilities : 41 Page : 1 (This Page)