CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   

Linux » Linux Kernel : Security Vulnerabilities

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2023-33288 416 2023-05-22 2023-05-26
0.0
 None ??? ??? ??? ??? ??? ???
An issue was discovered in the Linux kernel before 6.2.9. A use-after-free was found in bq24190_remove in drivers/power/supply/bq24190_charger.c. It could allow a local attacker to crash the system due to a race condition.
2 CVE-2023-33250 416 2023-05-21 2023-05-26
0.0
 None ??? ??? ??? ??? ??? ???
The Linux kernel 6.3 has a use-after-free in iopt_unmap_iova_range in drivers/iommu/iommufd/io_pagetable.c.
3 CVE-2023-33203 362 2023-05-18 2023-05-26
0.0
 None ??? ??? ??? ??? ??? ???
The Linux kernel before 6.2.9 has a race condition and resultant use-after-free in drivers/net/ethernet/qualcomm/emac/emac.c if a physically proximate attacker unplugs an emac based device.
4 CVE-2023-32269 416 2023-05-05 2023-05-11
0.0
 None ??? ??? ??? ??? ??? ???
An issue was discovered in the Linux kernel before 6.1.11. In net/netrom/af_netrom.c, there is a use-after-free because accept is also allowed for a successfully connected AF_NETROM socket. However, in order for an attacker to exploit this, the system must have netrom routing configured or the attacker must have the CAP_NET_ADMIN capability.
5 CVE-2023-32233 416 2023-05-08 2023-05-15
0.0
 None ??? ??? ??? ??? ??? ???
In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users can obtain root privileges. This occurs because anonymous sets are mishandled.
6 CVE-2023-31436 787 2023-04-28 2023-05-14
0.0
 None ??? ??? ??? ??? ??? ???
qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write because lmax can exceed QFQ_MIN_LMAX.
7 CVE-2023-31085 369 2023-04-24 2023-05-02
0.0
 None ??? ??? ??? ??? ??? ???
An issue was discovered in drivers/mtd/ubi/cdev.c in the Linux kernel 6.2. There is a divide-by-zero error in do_div(sz,mtd->erasesize), used indirectly by ctrl_cdev_ioctl, when mtd->erasesize is 0.
8 CVE-2023-31084 2023-04-24 2023-05-02
0.0
 None ??? ??? ??? ??? ??? ???
An issue was discovered in drivers/media/dvb-core/dvb_frontend.c in the Linux kernel 6.2. There is a blocking operation when a task is in !TASK_RUNNING. In dvb_frontend_get_event, wait_event_interruptible is called; the condition is dvb_frontend_test_event(fepriv,events). In dvb_frontend_test_event, down(&fepriv->sem) is called. However, wait_event_interruptible would put the process to sleep, and down(&fepriv->sem) may block the process.
9 CVE-2023-31083 362 2023-04-24 2023-05-02
0.0
 None ??? ??? ??? ??? ??? ???
An issue was discovered in drivers/bluetooth/hci_ldisc.c in the Linux kernel 6.2. In hci_uart_tty_ioctl, there is a race condition between HCIUARTSETPROTO and HCIUARTGETPROTO. HCI_UART_PROTO_SET is set before hu->proto is set. A NULL pointer dereference may occur.
10 CVE-2023-31082 763 2023-04-24 2023-05-02
0.0
 None ??? ??? ??? ??? ??? ???
An issue was discovered in drivers/tty/n_gsm.c in the Linux kernel 6.2. There is a sleeping function called from an invalid context in gsmld_write, which will block the kernel.
11 CVE-2023-31081 476 2023-04-24 2023-05-02
0.0
 None ??? ??? ??? ??? ??? ???
An issue was discovered in drivers/media/test-drivers/vidtv/vidtv_bridge.c in the Linux kernel 6.2. There is a NULL pointer dereference in vidtv_mux_stop_thread. In vidtv_stop_streaming, after dvb->mux=NULL occurs, it executes vidtv_mux_stop_thread(dvb->mux).
12 CVE-2023-30772 416 2023-04-16 2023-05-03
0.0
 None ??? ??? ??? ??? ??? ???
The Linux kernel before 6.2.9 has a race condition and resultant use-after-free in drivers/power/supply/da9150-charger.c if a physically proximate attacker unplugs a device.
13 CVE-2023-30456 2023-04-10 2023-05-11
0.0
 None ??? ??? ??? ??? ??? ???
An issue was discovered in arch/x86/kvm/vmx/nested.c in the Linux kernel before 6.2.8. nVMX on x86_64 lacks consistency checks for CR0 and CR4.
14 CVE-2023-28866 125 2023-03-27 2023-04-03
0.0
 None ??? ??? ??? ??? ??? ???
In the Linux kernel through 6.2.8, net/bluetooth/hci_sync.c allows out-of-bounds access because amp_init1[] and amp_init2[] are supposed to have an intentionally invalid element, but do not.
15 CVE-2023-28772 120 Overflow 2023-03-23 2023-04-27
0.0
 None ??? ??? ??? ??? ??? ???
An issue was discovered in the Linux kernel before 5.13.3. lib/seq_buf.c has a seq_buf_putmem_hex buffer overflow.
16 CVE-2023-28466 476 2023-03-16 2023-05-03
0.0
 None ??? ??? ??? ??? ??? ???
do_tls_getsockopt in net/tls/tls_main.c in the Linux kernel through 6.2.6 lacks a lock_sock call, leading to a race condition (with a resultant use-after-free or NULL pointer dereference).
17 CVE-2023-28464 415 2023-03-31 2023-05-17
0.0
 None ??? ??? ??? ??? ??? ???
hci_conn_cleanup in net/bluetooth/hci_conn.c in the Linux kernel through 6.2.9 has a use-after-free (observed in hci_conn_hash_flush) because of calls to hci_dev_put and hci_conn_put. There is a double free that may lead to privilege escalation.
18 CVE-2023-28328 476 DoS 2023-04-19 2023-05-03
0.0
 None ??? ??? ??? ??? ??? ???
A NULL pointer dereference flaw was found in the az6027 driver in drivers/media/usb/dev-usb/az6027.c in the Linux Kernel. The message from user space is not checked properly before transferring into the device. This flaw allows a local user to crash the system or potentially cause a denial of service.
19 CVE-2023-28327 476 DoS 2023-04-19 2023-04-29
0.0
 None ??? ??? ??? ??? ??? ???
A NULL pointer dereference flaw was found in the UNIX protocol in net/unix/diag.c In unix_diag_get_exact in the Linux Kernel. The newly allocated skb does not have sk, leading to a NULL pointer. This flaw allows a local user to crash or potentially cause a denial of service.
20 CVE-2023-26607 125 2023-02-26 2023-03-16
0.0
 None ??? ??? ??? ??? ??? ???
In the Linux kernel 6.0.8, there is an out-of-bounds read in ntfs_attr_find in fs/ntfs/attrib.c.
21 CVE-2023-26606 416 2023-02-26 2023-05-19
0.0
 None ??? ??? ??? ??? ??? ???
In the Linux kernel 6.0.8, there is a use-after-free in ntfs_trim_fs in fs/ntfs3/bitmap.c.
22 CVE-2023-26605 416 2023-02-26 2023-05-12
0.0
 None ??? ??? ??? ??? ??? ???
In the Linux kernel 6.0.8, there is a use-after-free in inode_cgwb_move_to_attached in fs/fs-writeback.c, related to __list_del_entry_valid.
23 CVE-2023-26545 415 2023-02-25 2023-05-03
0.0
 None ??? ??? ??? ??? ??? ???
In the Linux kernel before 6.1.13, there is a double free in net/mpls/af_mpls.c upon an allocation failure (for registering the sysctl table under a new location) during the renaming of a device.
24 CVE-2023-26544 416 2023-02-25 2023-03-16
0.0
 None ??? ??? ??? ??? ??? ???
In the Linux kernel 6.0.8, there is a use-after-free in run_unpack in fs/ntfs3/run.c, related to a difference between NTFS sector size and media sector size.
25 CVE-2023-26242 190 Overflow 2023-02-21 2023-04-06
0.0
 None ??? ??? ??? ??? ??? ???
afu_mmio_region_get_by_offset in drivers/fpga/dfl-afu-region.c in the Linux kernel through 6.1.12 has an integer overflow.
26 CVE-2023-25012 416 2023-02-02 2023-05-03
0.0
 None ??? ??? ??? ??? ??? ???
The Linux kernel through 6.1.9 has a Use-After-Free in bigben_remove in drivers/hid/hid-bigbenff.c via a crafted USB device because the LED controllers remain registered for too long.
27 CVE-2023-23586 416 +Info 2023-02-17 2023-02-27
0.0
 None ??? ??? ??? ??? ??? ???
Due to a vulnerability in the io_uring subsystem, it is possible to leak kernel memory information to the user process. timens_install calls current_is_single_threaded to determine if the current process is single-threaded, but this call does not consider io_uring's io_worker threads, thus it is possible to insert a time namespace's vvar page to process's memory space via a page fault. When this time namespace is destroyed, the vvar page is also freed, but not removed from the process' memory, and a next page allocated by the kernel will be still available from the user-space process and can leak memory contents via this (read-only) use-after-free vulnerability. We recommend upgrading past version 5.10.161 or commit 788d0824269bef539fe31a785b1517882eafed93 https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/io_uring
28 CVE-2023-23559 190 Overflow 2023-01-13 2023-05-03
0.0
 None ??? ??? ??? ??? ??? ???
In rndis_query_oid in drivers/net/wireless/rndis_wlan.c in the Linux kernel through 6.1.5, there is an integer overflow in an addition.
29 CVE-2023-23455 843 DoS 2023-01-12 2023-05-03
0.0
 None ??? ??? ??? ??? ??? ???
atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results).
30 CVE-2023-23454 843 DoS 2023-01-12 2023-05-03
0.0
 None ??? ??? ??? ??? ??? ???
cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service (slab-out-of-bounds read) because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results).
31 CVE-2023-23039 362 2023-02-22 2023-03-06
0.0
 None ??? ??? ??? ??? ??? ???
An issue was discovered in the Linux kernel through 6.2.0-rc2. drivers/tty/vcc.c has a race condition and resultant use-after-free if a physically proximate attacker removes a VCC device while calling open(), aka a race condition between vcc_open() and vcc_remove().
32 CVE-2023-23006 476 2023-03-01 2023-03-13
0.0
 None ??? ??? ??? ??? ??? ???
In the Linux kernel before 5.15.13, drivers/net/ethernet/mellanox/mlx5/core/steering/dr_domain.c misinterprets the mlx5_get_uars_page return value (expects it to be NULL in the error case, whereas it is actually an error pointer).
33 CVE-2023-23005 476 2023-03-01 2023-03-13
0.0
 None ??? ??? ??? ??? ??? ???
** DISPUTED ** In the Linux kernel before 6.2, mm/memory-tiers.c misinterprets the alloc_memory_type return value (expects it to be NULL in the error case, whereas it is actually an error pointer). NOTE: this is disputed by third parties because there are no realistic cases in which a user can cause the alloc_memory_type error case to be reached.
34 CVE-2023-23004 476 2023-03-01 2023-05-03
0.0
 None ??? ??? ??? ??? ??? ???
In the Linux kernel before 5.19, drivers/gpu/drm/arm/malidp_planes.c misinterprets the get_sg_table return value (expects it to be NULL in the error case, whereas it is actually an error pointer).
35 CVE-2023-23003 252 2023-03-01 2023-03-31
0.0
 None ??? ??? ??? ??? ??? ???
In the Linux kernel before 5.16, tools/perf/util/expr.c lacks a check for the hashmap__new return value.
36 CVE-2023-23002 476 2023-03-01 2023-03-13
0.0
 None ??? ??? ??? ??? ??? ???
In the Linux kernel before 5.16.3, drivers/bluetooth/hci_qca.c misinterprets the devm_gpiod_get_index_optional return value (expects it to be NULL in the error case, whereas it is actually an error pointer).
37 CVE-2023-23001 476 2023-03-01 2023-03-13
0.0
 None ??? ??? ??? ??? ??? ???
In the Linux kernel before 5.16.3, drivers/scsi/ufs/ufs-mediatek.c misinterprets the regulator_get return value (expects it to be NULL in the error case, whereas it is actually an error pointer).
38 CVE-2023-23000 476 2023-03-01 2023-03-31
0.0
 None ??? ??? ??? ??? ??? ???
In the Linux kernel before 5.17, drivers/phy/tegra/xusb.c mishandles the tegra_xusb_find_port_node return value. Callers expect NULL in the error case, but an error pointer is used.
39 CVE-2023-22999 476 2023-02-28 2023-03-06
0.0
 None ??? ??? ??? ??? ??? ???
In the Linux kernel before 5.16.3, drivers/usb/dwc3/dwc3-qcom.c misinterprets the dwc3_qcom_create_urs_usb_platdev return value (expects it to be NULL in the error case, whereas it is actually an error pointer).
40 CVE-2023-22998 436 2023-02-28 2023-05-03
0.0
 None ??? ??? ??? ??? ??? ???
In the Linux kernel before 6.0.3, drivers/gpu/drm/virtio/virtgpu_object.c misinterprets the drm_gem_shmem_get_sg_table return value (expects it to be NULL in the error case, whereas it is actually an error pointer).
41 CVE-2023-22997 476 2023-02-28 2023-03-06
0.0
 None ??? ??? ??? ??? ??? ???
In the Linux kernel before 6.1.2, kernel/module/decompress.c misinterprets the module_get_next_page return value (expects it to be NULL in the error case, whereas it is actually an error pointer).
42 CVE-2023-22996 772 2023-02-28 2023-03-06
0.0
 None ??? ??? ??? ??? ??? ???
In the Linux kernel before 5.17.2, drivers/soc/qcom/qcom_aoss.c does not release an of_find_device_by_node reference after use, e.g., with put_device.
43 CVE-2023-22995 2023-02-28 2023-03-31
0.0
 None ??? ??? ??? ??? ??? ???
In the Linux kernel before 5.17, an error path in dwc3_qcom_acpi_register_core in drivers/usb/dwc3/dwc3-qcom.c lacks certain platform_device_put and kfree calls.
44 CVE-2023-2898 362 DoS 2023-05-26 2023-06-02
0.0
 None ??? ??? ??? ??? ??? ???
There is a null-pointer-dereference flaw found in f2fs_write_end_io in fs/f2fs/data.c in the Linux kernel. This flaw allows a local privileged user to cause a denial of service problem.
45 CVE-2023-2513 416 2023-05-08 2023-05-15
0.0
 None ??? ??? ??? ??? ??? ???
A use-after-free vulnerability was found in the Linux kernel's ext4 filesystem in the way it handled the extra inode size for extended attributes. This flaw could allow a privileged local user to cause a system crash or other undefined behaviors.
46 CVE-2023-2269 667 DoS 2023-04-25 2023-05-16
0.0
 None ??? ??? ??? ??? ??? ???
A denial of service problem was found, due to a possible recursive locking scenario, resulting in a deadlock in table_clear in drivers/md/dm-ioctl.c in the Linux Kernel Device Mapper-Multipathing sub-component.
47 CVE-2023-2236 416 2023-05-01 2023-06-01
0.0
 None ??? ??? ??? ??? ??? ???
A use-after-free vulnerability in the Linux Kernel io_uring subsystem can be exploited to achieve local privilege escalation. Both io_install_fixed_file and its callers call fput in a file in case of an error, causing a reference underflow which leads to a use-after-free vulnerability. We recommend upgrading past commit 9d94c04c0db024922e886c9fd429659f22f48ea4.
48 CVE-2023-2235 416 2023-05-01 2023-05-06
0.0
 None ??? ??? ??? ??? ??? ???
A use-after-free vulnerability in the Linux Kernel Performance Events system can be exploited to achieve local privilege escalation. The perf_group_detach function did not check the event's siblings' attach_state before calling add_event_to_groups(), but remove_on_exec made it possible to call list_del_event() on before detaching from their group, making it possible to use a dangling pointer causing a use-after-free vulnerability. We recommend upgrading past commit fd0815f632c24878e325821943edccc7fde947a2.
49 CVE-2023-2194 787 Exec Code 2023-04-20 2023-05-03
0.0
 None ??? ??? ??? ??? ??? ???
An out-of-bounds write vulnerability was found in the Linux kernel's SLIMpro I2C device driver. The userspace "data->block[0]" variable was not capped to a number between 0-255 and was used as the size of a memcpy, possibly writing beyond the end of dma_buffer. This flaw could allow a local privileged user to crash the system or potentially achieve code execution.
50 CVE-2023-2177 476 DoS 2023-04-20 2023-04-28
0.0
 None ??? ??? ??? ??? ??? ???
A null pointer dereference issue was found in the sctp network protocol in net/sctp/stream_sched.c in Linux Kernel. If stream_in allocation is failed, stream_out is freed which would further be accessed. A local user could use this flaw to crash the system or potentially cause a denial of service.
Total number of vulnerabilities : 311   Page : 1 (This Page)2 3 4 5 6 7
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.