# |
CVE ID
|
CWE ID
|
# of Exploits
|
Vulnerability Type(s)
|
Publish Date
|
Update Date
|
Score
|
Gained Access Level
|
Access
|
Complexity
|
Authentication
|
Conf.
|
Integ.
|
Avail.
|
201 |
CVE-2013-3076 |
200 |
|
+Info |
2013-04-22 |
2017-11-28 |
4.9 |
None |
Local |
Low |
Not required |
Complete |
None |
None |
The crypto API in the Linux kernel through 3.9-rc8 does not initialize certain length variables, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call, related to the hash_recvmsg function in crypto/algif_hash.c and the skcipher_recvmsg function in crypto/algif_skcipher.c. |
202 |
CVE-2013-2929 |
264 |
|
Bypass +Info |
2013-12-09 |
2018-04-27 |
3.3 |
None |
Local |
Medium |
Not required |
Partial |
Partial |
None |
The Linux kernel before 3.12.2 does not properly use the get_dumpable function, which allows local users to bypass intended ptrace restrictions or obtain sensitive information from IA64 scratch registers via a crafted application, related to kernel/ptrace.c and arch/ia64/include/asm/processor.h. |
203 |
CVE-2013-2898 |
20 |
|
+Info |
2013-09-16 |
2013-10-30 |
1.9 |
None |
Local |
Medium |
Not required |
Partial |
None |
None |
drivers/hid/hid-sensor-hub.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_SENSOR_HUB is enabled, allows physically proximate attackers to obtain sensitive information from kernel memory via a crafted device. |
204 |
CVE-2013-2895 |
119 |
|
DoS Overflow +Info |
2013-09-16 |
2014-01-03 |
5.4 |
None |
Local |
Medium |
Not required |
Partial |
None |
Complete |
drivers/hid/hid-logitech-dj.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_LOGITECH_DJ is enabled, allows physically proximate attackers to cause a denial of service (NULL pointer dereference and OOPS) or obtain sensitive information from kernel memory via a crafted device. |
205 |
CVE-2013-2636 |
399 |
|
+Info |
2013-03-22 |
2013-04-05 |
1.9 |
None |
Local |
Medium |
Not required |
Partial |
None |
None |
net/bridge/br_mdb.c in the Linux kernel before 3.8.4 does not initialize certain structures, which allows local users to obtain sensitive information from kernel memory via a crafted application. |
206 |
CVE-2013-2635 |
399 |
|
+Info |
2013-03-22 |
2014-02-06 |
1.9 |
None |
Local |
Medium |
Not required |
Partial |
None |
None |
The rtnl_fill_ifinfo function in net/core/rtnetlink.c in the Linux kernel before 3.8.4 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel stack memory via a crafted application. |
207 |
CVE-2013-2634 |
399 |
|
+Info |
2013-03-22 |
2014-02-06 |
1.9 |
None |
Local |
Medium |
Not required |
Partial |
None |
None |
net/dcb/dcbnl.c in the Linux kernel before 3.8.4 does not initialize certain structures, which allows local users to obtain sensitive information from kernel stack memory via a crafted application. |
208 |
CVE-2013-2548 |
310 |
|
+Info |
2013-03-15 |
2014-01-03 |
2.1 |
None |
Local |
Low |
Not required |
Partial |
None |
None |
The crypto_report_one function in crypto/crypto_user.c in the report API in the crypto user configuration API in the Linux kernel through 3.8.2 uses an incorrect length value during a copy operation, which allows local users to obtain sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability. |
209 |
CVE-2013-2547 |
310 |
|
+Info |
2013-03-15 |
2014-01-03 |
2.1 |
None |
Local |
Low |
Not required |
Partial |
None |
None |
The crypto_report_one function in crypto/crypto_user.c in the report API in the crypto user configuration API in the Linux kernel through 3.8.2 does not initialize certain structure members, which allows local users to obtain sensitive information from kernel heap memory by leveraging the CAP_NET_ADMIN capability. |
210 |
CVE-2013-2546 |
310 |
|
+Info |
2013-03-15 |
2014-01-03 |
2.1 |
None |
Local |
Low |
Not required |
Partial |
None |
None |
The report API in the crypto user configuration API in the Linux kernel through 3.8.2 uses an incorrect C library function for copying strings, which allows local users to obtain sensitive information from kernel stack memory by leveraging the CAP_NET_ADMIN capability. |
211 |
CVE-2013-2237 |
119 |
|
Overflow +Info |
2013-07-04 |
2014-02-06 |
2.1 |
None |
Local |
Low |
Not required |
Partial |
None |
None |
The key_notify_policy_flush function in net/key/af_key.c in the Linux kernel before 3.9 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel heap memory by reading a broadcast message from the notify_policy interface of an IPSec key_socket. |
212 |
CVE-2013-2234 |
119 |
|
Overflow +Info |
2013-07-04 |
2014-01-30 |
2.1 |
None |
Local |
Low |
Not required |
Partial |
None |
None |
The (1) key_notify_sa_flush and (2) key_notify_policy_flush functions in net/key/af_key.c in the Linux kernel before 3.10 do not initialize certain structure members, which allows local users to obtain sensitive information from kernel heap memory by reading a broadcast message from the notify interface of an IPSec key_socket. |
213 |
CVE-2013-2164 |
200 |
|
+Info |
2013-07-04 |
2014-01-30 |
2.1 |
None |
Local |
Low |
Not required |
Partial |
None |
None |
The mmc_ioctl_cdrom_read_data function in drivers/cdrom/cdrom.c in the Linux kernel through 3.10 allows local users to obtain sensitive information from kernel memory via a read operation on a malfunctioning CD-ROM drive. |
214 |
CVE-2013-2148 |
399 |
|
+Info |
2013-06-07 |
2014-01-03 |
2.1 |
None |
Local |
Low |
Not required |
Partial |
None |
None |
The fill_event_metadata function in fs/notify/fanotify/fanotify_user.c in the Linux kernel through 3.9.4 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel memory via a read operation on the fanotify descriptor. |
215 |
CVE-2013-2147 |
399 |
|
+Info |
2013-06-07 |
2018-01-08 |
2.1 |
None |
Local |
Low |
Not required |
Partial |
None |
None |
The HP Smart Array controller disk-array driver and Compaq SMART2 controller disk-array driver in the Linux kernel through 3.9.4 do not initialize certain data structures, which allows local users to obtain sensitive information from kernel memory via (1) a crafted IDAGETPCIINFO command for a /dev/ida device, related to the ida_locked_ioctl function in drivers/block/cpqarray.c or (2) a crafted CCISS_PASSTHRU32 command for a /dev/cciss device, related to the cciss_ioctl32_passthru function in drivers/block/cciss.c. |
216 |
CVE-2013-2141 |
399 |
|
+Info |
2013-06-07 |
2018-01-08 |
2.1 |
None |
Local |
Low |
Not required |
Partial |
None |
None |
The do_tkill function in kernel/signal.c in the Linux kernel before 3.8.9 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory via a crafted application that makes a (1) tkill or (2) tgkill system call. |
217 |
CVE-2013-1943 |
20 |
|
+Priv +Info |
2013-07-16 |
2013-10-02 |
6.9 |
None |
Local |
Medium |
Not required |
Complete |
Complete |
Complete |
The KVM subsystem in the Linux kernel before 3.0 does not check whether kernel addresses are specified during allocation of memory slots for use in a guest's physical address space, which allows local users to gain privileges or obtain sensitive information from kernel memory via a crafted application, related to arch/x86/kvm/paging_tmpl.h and virt/kvm/kvm_main.c. |
218 |
CVE-2013-1928 |
200 |
|
+Info |
2013-04-29 |
2014-01-03 |
4.7 |
None |
Local |
Medium |
Not required |
Complete |
None |
None |
The do_video_set_spu_palette function in fs/compat_ioctl.c in the Linux kernel before 3.6.5 on unspecified architectures lacks a certain error check, which might allow local users to obtain sensitive information from kernel stack memory via a crafted VIDEO_SET_SPU_PALETTE ioctl call on a /dev/dvb device. |
219 |
CVE-2013-1798 |
20 |
|
DoS +Info |
2013-03-22 |
2014-01-27 |
6.2 |
None |
Local Network |
High |
Not required |
Complete |
None |
Complete |
The ioapic_read_indirect function in virt/kvm/ioapic.c in the Linux kernel through 3.8.4 does not properly handle a certain combination of invalid IOAPIC_REG_SELECT and IOAPIC_REG_WINDOW operations, which allows guest OS users to obtain sensitive information from host OS memory or cause a denial of service (host OS OOPS) via a crafted application. |
220 |
CVE-2013-0349 |
200 |
|
+Info |
2013-02-28 |
2013-06-04 |
1.9 |
None |
Local |
Medium |
Not required |
Partial |
None |
None |
The hidp_setup_hid function in net/bluetooth/hidp/core.c in the Linux kernel before 3.7.6 does not properly copy a certain name field, which allows local users to obtain sensitive information from kernel memory by setting a long name and making an HIDPCONNADD ioctl call. |
221 |
CVE-2013-0343 |
|
|
DoS +Info |
2013-02-28 |
2014-03-05 |
3.2 |
None |
Local Network |
High |
Not required |
Partial |
None |
Partial |
The ipv6_create_tempaddr function in net/ipv6/addrconf.c in the Linux kernel through 3.8 does not properly handle problems with the generation of IPv6 temporary addresses, which allows remote attackers to cause a denial of service (excessive retries and address-generation outage), and consequently obtain sensitive information, via ICMPv6 Router Advertisement (RA) messages. |
222 |
CVE-2013-0160 |
200 |
|
+Info |
2013-02-17 |
2017-11-28 |
2.1 |
None |
Local |
Low |
Not required |
Partial |
None |
None |
The Linux kernel through 3.7.9 allows local users to obtain sensitive information about keystroke timing by using the inotify API on the /dev/ptmx device. |
223 |
CVE-2012-6549 |
200 |
|
+Info |
2013-03-15 |
2013-08-22 |
1.9 |
None |
Local |
Medium |
Not required |
Partial |
None |
None |
The isofs_export_encode_fh function in fs/isofs/export.c in the Linux kernel before 3.6 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel heap memory via a crafted application. |
224 |
CVE-2012-6548 |
200 |
|
+Info |
2013-03-15 |
2014-02-06 |
1.9 |
None |
Local |
Medium |
Not required |
Partial |
None |
None |
The udf_encode_fh function in fs/udf/namei.c in the Linux kernel before 3.6 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel heap memory via a crafted application. |
225 |
CVE-2012-6547 |
200 |
|
+Info |
2013-03-15 |
2013-08-22 |
1.9 |
None |
Local |
Medium |
Not required |
Partial |
None |
None |
The __tun_chr_ioctl function in drivers/net/tun.c in the Linux kernel before 3.6 does not initialize a certain structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted application. |
226 |
CVE-2012-6546 |
200 |
|
+Info |
2013-03-15 |
2013-06-04 |
1.9 |
None |
Local |
Medium |
Not required |
Partial |
None |
None |
The ATM implementation in the Linux kernel before 3.6 does not initialize certain structures, which allows local users to obtain sensitive information from kernel stack memory via a crafted application. |
227 |
CVE-2012-6545 |
200 |
|
+Info |
2013-03-15 |
2014-01-03 |
1.9 |
None |
Local |
Medium |
Not required |
Partial |
None |
None |
The Bluetooth RFCOMM implementation in the Linux kernel before 3.6 does not properly initialize certain structures, which allows local users to obtain sensitive information from kernel memory via a crafted application. |
228 |
CVE-2012-6544 |
200 |
|
+Info |
2013-03-15 |
2014-02-06 |
1.9 |
None |
Local |
Medium |
Not required |
Partial |
None |
None |
The Bluetooth protocol stack in the Linux kernel before 3.6 does not properly initialize certain structures, which allows local users to obtain sensitive information from kernel stack memory via a crafted application that targets the (1) L2CAP or (2) HCI implementation. |
229 |
CVE-2012-6543 |
200 |
|
+Info |
2013-03-15 |
2013-03-18 |
1.9 |
None |
Local |
Medium |
Not required |
Partial |
None |
None |
The l2tp_ip6_getname function in net/l2tp/l2tp_ip6.c in the Linux kernel before 3.6 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel stack memory via a crafted application. |
230 |
CVE-2012-6542 |
200 |
|
+Info |
2013-03-15 |
2014-01-03 |
1.9 |
None |
Local |
Medium |
Not required |
Partial |
None |
None |
The llc_ui_getname function in net/llc/af_llc.c in the Linux kernel before 3.6 has an incorrect return value in certain circumstances, which allows local users to obtain sensitive information from kernel stack memory via a crafted application that leverages an uninitialized pointer argument. |
231 |
CVE-2012-6541 |
200 |
|
+Info |
2013-03-15 |
2013-03-18 |
1.9 |
None |
Local |
Medium |
Not required |
Partial |
None |
None |
The ccid3_hc_tx_getsockopt function in net/dccp/ccids/ccid3.c in the Linux kernel before 3.6 does not initialize a certain structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted application. |
232 |
CVE-2012-6540 |
200 |
|
+Info |
2013-03-15 |
2013-05-14 |
1.9 |
None |
Local |
Medium |
Not required |
Partial |
None |
None |
The do_ip_vs_get_ctl function in net/netfilter/ipvs/ip_vs_ctl.c in the Linux kernel before 3.6 does not initialize a certain structure for IP_VS_SO_GET_TIMEOUT commands, which allows local users to obtain sensitive information from kernel stack memory via a crafted application. |
233 |
CVE-2012-6539 |
200 |
|
+Info |
2013-03-15 |
2013-05-14 |
1.9 |
None |
Local |
Medium |
Not required |
Partial |
None |
None |
The dev_ifconf function in net/socket.c in the Linux kernel before 3.6 does not initialize a certain structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted application. |
234 |
CVE-2012-6538 |
200 |
|
+Info |
2013-03-15 |
2013-06-04 |
1.9 |
None |
Local |
Medium |
Not required |
Partial |
None |
None |
The copy_to_user_auth function in net/xfrm/xfrm_user.c in the Linux kernel before 3.6 uses an incorrect C library function for copying a string, which allows local users to obtain sensitive information from kernel heap memory by leveraging the CAP_NET_ADMIN capability. |
235 |
CVE-2012-6537 |
200 |
|
+Info |
2013-03-15 |
2013-06-04 |
1.9 |
None |
Local |
Medium |
Not required |
Partial |
None |
None |
net/xfrm/xfrm_user.c in the Linux kernel before 3.6 does not initialize certain structures, which allows local users to obtain sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability. |
236 |
CVE-2012-6536 |
200 |
|
+Info |
2013-03-15 |
2013-03-18 |
2.1 |
None |
Local |
Low |
Not required |
Partial |
None |
None |
net/xfrm/xfrm_user.c in the Linux kernel before 3.6 does not verify that the actual Netlink message length is consistent with a certain header field, which allows local users to obtain sensitive information from kernel heap memory by leveraging the CAP_NET_ADMIN capability and providing a (1) new or (2) updated state. |
237 |
CVE-2012-4530 |
200 |
|
+Info |
2013-02-17 |
2013-06-04 |
2.1 |
None |
Local |
Low |
Not required |
Partial |
None |
None |
The load_script function in fs/binfmt_script.c in the Linux kernel before 3.7.2 does not properly handle recursion, which allows local users to obtain sensitive information from kernel stack memory via a crafted application. |
238 |
CVE-2012-4508 |
362 |
|
+Info |
2012-12-21 |
2014-01-07 |
1.9 |
None |
Local |
Medium |
Not required |
Partial |
None |
None |
Race condition in fs/ext4/extents.c in the Linux kernel before 3.4.16 allows local users to obtain sensitive information from a deleted file by reading an extent that was not properly marked as uninitialized. |
239 |
CVE-2012-4467 |
399 |
|
DoS +Info |
2012-10-10 |
2013-01-29 |
6.6 |
None |
Local |
Low |
Not required |
Complete |
None |
Complete |
The (1) do_siocgstamp and (2) do_siocgstampns functions in net/socket.c in the Linux kernel before 3.5.4 use an incorrect argument order, which allows local users to obtain sensitive information from kernel memory or cause a denial of service (system crash) via a crafted ioctl call. |
240 |
CVE-2012-3510 |
399 |
|
DoS +Info |
2012-10-03 |
2013-04-18 |
5.6 |
None |
Local |
Low |
Not required |
Partial |
None |
Complete |
Use-after-free vulnerability in the xacct_add_tsk function in kernel/tsacct.c in the Linux kernel before 2.6.19 allows local users to obtain potentially sensitive information from kernel memory or cause a denial of service (system crash) via a taskstats TASKSTATS_CMD_ATTR_PID command. |
241 |
CVE-2012-3430 |
200 |
|
+Info |
2012-10-03 |
2013-04-18 |
2.1 |
None |
Local |
Low |
Not required |
Partial |
None |
None |
The rds_recvmsg function in net/rds/recv.c in the Linux kernel before 3.0.44 does not initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via a (1) recvfrom or (2) recvmsg system call on an RDS socket. |
242 |
CVE-2012-0957 |
16 |
|
+Info |
2012-12-21 |
2013-08-21 |
4.9 |
None |
Local |
Low |
Not required |
Complete |
None |
None |
The override_release function in kernel/sys.c in the Linux kernel before 3.4.16 allows local users to obtain sensitive information from kernel stack memory via a uname system call in conjunction with a UNAME26 personality. |
243 |
CVE-2011-4914 |
20 |
|
DoS +Info |
2012-06-21 |
2016-08-18 |
6.4 |
None |
Remote |
Low |
Not required |
Partial |
None |
Partial |
The ROSE protocol implementation in the Linux kernel before 2.6.39 does not verify that certain data-length values are consistent with the amount of data sent, which might allow remote attackers to obtain sensitive information from kernel memory or cause a denial of service (out-of-bounds read) via crafted data to a ROSE socket. |
244 |
CVE-2011-2909 |
200 |
|
+Info |
2014-02-15 |
2014-02-18 |
4.9 |
None |
Local |
Low |
Not required |
Complete |
None |
None |
The do_devinfo_ioctl function in drivers/staging/comedi/comedi_fops.c in the Linux kernel before 3.1 allows local users to obtain sensitive information from kernel memory via a copy of a short string. |
245 |
CVE-2011-2898 |
264 |
|
+Info |
2012-05-24 |
2012-05-29 |
4.9 |
None |
Local |
Low |
Not required |
Complete |
None |
None |
net/packet/af_packet.c in the Linux kernel before 2.6.39.3 does not properly restrict user-space access to certain packet data structures associated with VLAN Tag Control Information, which allows local users to obtain potentially sensitive information via a crafted application. |
246 |
CVE-2011-2707 |
20 |
|
+Info |
2012-05-24 |
2012-05-29 |
4.9 |
None |
Local |
Low |
Not required |
Complete |
None |
None |
The ptrace_setxregs function in arch/xtensa/kernel/ptrace.c in the Linux kernel before 3.1 does not validate user-space pointers, which allows local users to obtain sensitive information from kernel memory locations via a crafted PTRACE_SETXTREGS request. |
247 |
CVE-2011-2494 |
200 |
|
+Info |
2012-06-13 |
2017-12-28 |
2.1 |
None |
Local |
Low |
Not required |
Partial |
None |
None |
kernel/taskstats.c in the Linux kernel before 3.1 allows local users to obtain sensitive I/O statistics by sending taskstats commands to a netlink socket, as demonstrated by discovering the length of another user's password. |
248 |
CVE-2011-2492 |
200 |
|
+Info |
2011-07-28 |
2016-08-22 |
1.9 |
None |
Local |
Medium |
Not required |
Partial |
None |
None |
The bluetooth subsystem in the Linux kernel before 3.0-rc4 does not properly initialize certain data structures, which allows local users to obtain potentially sensitive information from kernel memory via a crafted getsockopt system call, related to (1) the l2cap_sock_getsockopt_old function in net/bluetooth/l2cap_sock.c and (2) the rfcomm_sock_getsockopt_old function in net/bluetooth/rfcomm/sock.c. |
249 |
CVE-2011-2210 |
264 |
|
+Info |
2012-06-13 |
2012-06-13 |
2.1 |
None |
Local |
Low |
Not required |
Partial |
None |
None |
The osf_getsysinfo function in arch/alpha/kernel/osf_sys.c in the Linux kernel before 2.6.39.4 on the Alpha platform does not properly restrict the data size for GSI_GET_HWRPB operations, which allows local users to obtain sensitive information from kernel memory via a crafted call. |
250 |
CVE-2011-2209 |
189 |
|
+Info |
2012-06-13 |
2012-06-13 |
2.1 |
None |
Local |
Low |
Not required |
None |
None |
Partial |
Integer signedness error in the osf_sysinfo function in arch/alpha/kernel/osf_sys.c in the Linux kernel before 2.6.39.4 on the Alpha platform allows local users to obtain sensitive information from kernel memory via a crafted call. |