Linux » Linux Kernel : Security Vulnerabilities (CVSS score between 7 and 7.99)

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : CVE Number Descending CVE Number Ascending CVSS Score Descending Number Of Exploits Descending

#	CVE ID	CWE ID	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
1	CVE-2022-34918	843	Overflow	2022-07-04	2023-05-16	7.2	None	Local	Low	Not required	Complete	Complete	Complete
An issue was discovered in the Linux kernel through 5.18.9. A type confusion bug in nft_set_elem_init (leading to a buffer overflow) could be used by a local attacker to escalate privileges, a different vulnerability than CVE-2022-32250. (The attacker can obtain root access, but must start with an unprivileged user namespace to obtain CAP_NET_ADMIN access.) This can be fixed in nft_setelem_parse_data in net/netfilter/nf_tables_api.c.
2	CVE-2022-32250	416		2022-06-02	2023-05-16	7.2	None	Local	Low	Not required	Complete	Complete	Complete
net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to a use-after-free.
3	CVE-2022-29581	416		2022-05-17	2023-04-11	7.2	None	Local	Low	Not required	Complete	Complete	Complete
Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to cause privilege escalation to root. This issue affects: Linux Kernel versions prior to 5.18; version 4.14 and later versions.
4	CVE-2022-29156	415		2022-04-13	2023-04-11	7.2	None	Local	Low	Not required	Complete	Complete	Complete
drivers/infiniband/ulp/rtrs/rtrs-clt.c in the Linux kernel before 5.16.12 has a double free related to rtrs_clt_dev_release.
5	CVE-2022-28893	416		2022-04-11	2023-05-15	7.2	None	Local	Low	Not required	Complete	Complete	Complete
The SUNRPC subsystem in the Linux kernel through 5.17.2 can call xs_xprt_free before ensuring that sockets are in the intended state.
6	CVE-2022-23222	476	+Priv	2022-01-14	2023-05-16	7.2	None	Local	Low	Not required	Complete	Complete	Complete
kernel/bpf/verifier.c in the Linux kernel through 5.15.14 allows local users to gain privileges because of the availability of pointer arithmetic via certain *_OR_NULL pointer types.
7	CVE-2022-1998	416		2022-06-09	2023-05-16	7.2	None	Local	Low	Not required	Complete	Complete	Complete
A use after free in the Linux kernel File System notify functionality was found in the way user triggers copy_info_records_to_user() call to fail in copy_event_to_user(). A local user could use this flaw to crash the system or potentially escalate their privileges on the system.
8	CVE-2022-1943	787		2022-06-02	2023-05-16	7.2	None	Local	Low	Not required	Complete	Complete	Complete
A flaw out of bounds memory write in the Linux kernel UDF file system functionality was found in the way user triggers some file operation which triggers udf_write_fi(). A local user could use this flaw to crash the system or potentially
9	CVE-2022-1882	416		2022-05-26	2023-05-16	7.2	None	Local	Low	Not required	Complete	Complete	Complete
A use-after-free flaw was found in the Linux kernel’s pipes functionality in how a user performs manipulations with the pipe post_one_notification() after free_pipe_info() that is already called. This flaw allows a local user to crash or potentially escalate their privileges on the system.
10	CVE-2022-1786	416		2022-06-02	2023-03-01	7.2	None	Local	Low	Not required	Complete	Complete	Complete
A use-after-free flaw was found in the Linux kernel’s io_uring subsystem in the way a user sets up a ring with IORING_SETUP_IOPOLL with more than one task completing submissions on this ring. This flaw allows a local user to crash or escalate their privileges on the system.
11	CVE-2022-1679	416		2022-05-16	2022-12-03	7.2	None	Local	Low	Not required	Complete	Complete	Complete
A use-after-free flaw was found in the Linux kernel’s Atheros wireless adapter driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages. This flaw allows a local user to crash or potentially escalate their privileges on the system.
12	CVE-2022-1652	416	DoS Exec Code	2022-06-02	2023-03-01	7.2	None	Local	Low	Not required	Complete	Complete	Complete
Linux Kernel could allow a local attacker to execute arbitrary code on the system, caused by a concurrency use-after-free flaw in the bad_flp_intr function. By executing a specially-crafted program, an attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service condition on the system.
13	CVE-2022-1116	190	Overflow Mem. Corr.	2022-05-17	2022-10-19	7.2	None	Local	Low	Not required	Complete	Complete	Complete
Integer Overflow or Wraparound vulnerability in io_uring of Linux Kernel allows local attacker to cause memory corruption and escalate privileges to root. This issue affects: Linux Kernel versions prior to 5.4.189; version 5.4.24 and later versions.
14	CVE-2022-0998	190	Overflow	2022-03-30	2023-03-01	7.2	None	Local	Low	Not required	Complete	Complete	Complete
An integer overflow flaw was found in the Linux kernel’s virtio device driver code in the way a user triggers the vhost_vdpa_config_validate function. This flaw allows a local user to crash or potentially escalate their privileges on the system.
15	CVE-2022-0995	787	DoS +Priv	2022-03-25	2023-03-01	7.2	None	Local	Low	Not required	Complete	Complete	Complete
An out-of-bounds (OOB) memory write flaw was found in the Linux kernel’s watch_queue event notification subsystem. This flaw can overwrite parts of the kernel state, potentially allowing a local user to gain privileged access or cause a denial of service on the system.
16	CVE-2022-0847	665		2022-03-10	2022-12-09	7.2	None	Local	Low	Not required	Complete	Complete	Complete
A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache backed by read only files and as such escalate their privileges on the system.
17	CVE-2022-0742	401		2022-03-18	2023-01-20	7.8	None	Remote	Low	Not required	None	None	Complete
Memory leak in icmp6 implementation in Linux Kernel 5.13+ allows a remote attacker to DoS a host by making it go out-of-memory via icmp6 packets of type 130 or 131. We recommend upgrading past commit 2d3916f3189172d5c69d33065c3c21119fe539fc.
18	CVE-2022-0646	459		2022-02-18	2023-02-12	7.2	None	Local	Low	Not required	Complete	Complete	Complete
A flaw use after free in the Linux kernel Management Component Transport Protocol (MCTP) subsystem was found in the way user triggers cancel_work_sync after the unregister_netdev during removing device. A local user could use this flaw to crash the system or escalate their privileges on the system. It is actual from Linux Kernel 5.17-rc1 (when mctp-serial.c introduced) till 5.17-rc5.
19	CVE-2022-0500	119	Overflow	2022-03-25	2023-03-01	7.2	None	Local	Low	Not required	Complete	Complete	Complete
A flaw was found in unrestricted eBPF usage by the BPF_BTF_LOAD, leading to a possible out-of-bounds memory write in the Linux kernel’s BPF subsystem due to the way a user loads BTF. This flaw allows a local user to crash or escalate their privileges on the system.
20	CVE-2022-0185	190	Overflow	2022-02-11	2023-02-12	7.2	None	Local	Low	Not required	Complete	Complete	Complete
A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functionality of the Linux kernel verified the supplied parameters length. An unprivileged (in case of unprivileged user namespaces enabled, otherwise needs namespaced CAP_SYS_ADMIN privilege) local user able to open a filesystem that does not support the Filesystem Context API (and thus fallbacks to legacy handling) could use this flaw to escalate their privileges on the system.
21	CVE-2021-43267	20		2021-11-02	2022-11-03	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
An issue was discovered in net/tipc/crypto.c in the Linux kernel before 5.14.16. The Transparent Inter-Process Communication (TIPC) functionality allows remote attackers to exploit insufficient validation of user-supplied sizes for the MSG_CRYPTO message type.
22	CVE-2021-43057	416	Mem. Corr.	2021-10-28	2023-03-01	7.2	None	Local	Low	Not required	Complete	Complete	Complete
An issue was discovered in the Linux kernel before 5.14.8. A use-after-free in selinux_ptrace_traceme (aka the SELinux handler for PTRACE_TRACEME) could be used by local attackers to cause memory corruption and escalate privileges, aka CID-a3727a8bac0a. This occurs because of an attempt to access the subjective credentials of another task.
23	CVE-2021-41073	269	+Priv	2021-09-19	2023-01-11	7.2	None	Local	Low	Not required	Complete	Complete	Complete
loop_rw_iter in fs/io_uring.c in the Linux kernel 5.10 through 5.14.6 allows local users to gain privileges by using IORING_OP_PROVIDE_BUFFERS to trigger a free of a kernel buffer, as demonstrated by using /proc/<pid>/maps for exploitation.
24	CVE-2021-38300		Exec Code	2021-09-20	2023-03-01	7.2	None	Local	Low	Not required	Complete	Complete	Complete
arch/mips/net/bpf_jit.c in the Linux kernel before 5.4.10 can generate undesirable machine code when transforming unprivileged cBPF programs, allowing execution of arbitrary code within the kernel context. This occurs because conditional branches can exceed the 128 KB limit of the MIPS architecture.
25	CVE-2021-38160	120		2021-08-07	2022-01-01	7.2	None	Local	Low	Not required	Complete	Complete	Complete
DISPUTED In drivers/char/virtio_console.c in the Linux kernel before 5.13.4, data corruption or loss can be triggered by an untrusted device that supplies a buf->len value exceeding the buffer size. NOTE: the vendor indicates that the cited data corruption is not a vulnerability in any existing use case; the length validation was added solely for robustness in the face of anomalous host OS behavior.
26	CVE-2021-37576	787	Mem. Corr.	2021-07-26	2023-03-01	7.2	None	Local	Low	Not required	Complete	Complete	Complete
arch/powerpc/kvm/book3s_rtas.c in the Linux kernel through 5.13.5 on the powerpc platform allows KVM guest OS users to cause host OS memory corruption via rtas_args.nargs, aka CID-f62f3c20647e.
27	CVE-2021-34866	843	Exec Code	2022-01-25	2023-03-01	7.2	None	Local	Low	Not required	Complete	Complete	Complete
This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel 5.14-rc3. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of eBPF programs. The issue results from the lack of proper validation of user-supplied eBPF programs, which can result in a type confusion condition. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the kernel. Was ZDI-CAN-14689.
28	CVE-2021-33909	787	Overflow	2021-07-20	2023-03-01	7.2	None	Local	Low	Not required	Complete	Complete	Complete
fs/seq_file.c in the Linux kernel 3.16 through 5.13.x before 5.13.4 does not properly restrict seq buffer allocations, leading to an integer overflow, an Out-of-bounds Write, and escalation to root by an unprivileged user, aka CID-8cae8cd89f05.
29	CVE-2021-33200	787		2021-05-27	2023-02-24	7.2	None	Local	Low	Not required	Complete	Complete	Complete
kernel/bpf/verifier.c in the Linux kernel through 5.12.7 enforces incorrect limits for pointer arithmetic operations, aka CID-bb01a1bba579. This can be abused to perform out-of-bounds reads and writes in kernel memory, leading to local privilege escalation to root. In particular, there is a corner case where the off reg causes a masking direction change, which then results in an incorrect final aux->alu_limit.
30	CVE-2021-32606	416		2021-05-11	2021-09-07	7.2	None	Local	Low	Not required	Complete	Complete	Complete
In the Linux kernel 5.11 through 5.12.2, isotp_setsockopt in net/can/isotp.c allows privilege escalation to root by leveraging a use-after-free. (This does not affect earlier versions that lack CAN ISOTP SF_BROADCAST support.)
31	CVE-2021-29266	416		2021-03-26	2023-02-24	7.2	None	Local	Low	Not required	Complete	Complete	Complete
An issue was discovered in the Linux kernel before 5.11.9. drivers/vhost/vdpa.c has a use-after-free because v->config_ctx has an invalid value upon re-opening a character device, aka CID-f6bbf0010ba0.
32	CVE-2021-29154	77	Exec Code	2021-04-08	2023-02-24	7.2	None	Local	Low	Not required	Complete	Complete	Complete
BPF JIT compilers in the Linux kernel through 5.11.12 have incorrect computation of branch displacements, allowing them to execute arbitrary code within the kernel context. This affects arch/x86/net/bpf_jit_comp.c and arch/x86/net/bpf_jit_comp32.c.
33	CVE-2021-28972	120	Overflow	2021-03-22	2022-06-03	7.2	None	Local	Low	Not required	Complete	Complete	Complete
In drivers/pci/hotplug/rpadlpar_sysfs.c in the Linux kernel through 5.11.8, the RPA PCI Hotplug driver has a user-tolerable buffer overflow when writing a new device name to the driver from userspace, allowing userspace to write data to the kernel stack frame directly. This occurs because add_slot_store and remove_slot_store mishandle drc_name '\0' termination, aka CID-cc7a0bb058b8.
34	CVE-2021-28375	862		2021-03-15	2023-02-24	7.2	None	Local	Low	Not required	Complete	Complete	Complete
An issue was discovered in the Linux kernel through 5.11.6. fastrpc_internal_invoke in drivers/misc/fastrpc.c does not prevent user applications from sending kernel RPC messages, aka CID-20c40794eb85. This is a related issue to CVE-2019-2308.
35	CVE-2021-22600	415		2022-01-26	2023-05-16	7.2	None	Local	Low	Not required	Complete	Complete	Complete
A double free bug in packet_set_ring() in net/packet/af_packet.c can be exploited by a local user through crafted syscalls to escalate privileges or deny service. We recommend upgrading kernel past the effected versions or rebuilding past ec6af094ea28f0f2dda1a6a33b14cd57e36a9755
36	CVE-2021-20292	416	Exec Code	2021-05-28	2022-04-29	7.2	None	Local	Low	Not required	Complete	Complete	Complete
There is a flaw reported in the Linux kernel in versions before 5.9 in drivers/gpu/drm/nouveau/nouveau_sgdma.c in nouveau_sgdma_create_ttm in Nouveau DRM subsystem. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker with a local account with a root privilege, can leverage this vulnerability to escalate privileges and execute code in the context of the kernel.
37	CVE-2021-4197	287		2022-03-23	2023-05-16	7.2	None	Local	Low	Not required	Complete	Complete	Complete
An unprivileged write to the file handler flaw in the Linux kernel's control groups and namespaces subsystem was found in the way users have access to some less privileged process that are controlled by cgroups and have higher privileged parent process. It is actually both for cgroup2 and cgroup1 versions of control groups. A local user could use this flaw to crash the system or escalate their privileges on the system.
38	CVE-2021-4157	119	Overflow	2022-03-25	2023-01-17	7.4	None	Local Network	Medium	???	Complete	Complete	Complete
An out of memory bounds write flaw (1 or 2 bytes of memory) in the Linux kernel NFS subsystem was found in the way users use mirroring (replication of files with NFS). A user, having access to the NFS mount, could potentially use this flaw to crash the system or escalate privileges on the system.
39	CVE-2021-4154	416	DoS	2022-02-04	2023-01-19	7.2	None	Local	Low	Not required	Complete	Complete	Complete
A use-after-free flaw was found in cgroup1_parse_param in kernel/cgroup/cgroup-v1.c in the Linux kernel's cgroup v1 parser. A local attacker with a user privilege could cause a privilege escalation by exploiting the fsconfig syscall parameter leading to a container breakout and a denial of service on the system.
40	CVE-2021-4093	125		2022-02-18	2023-01-19	7.2	None	Local	Low	Not required	Complete	Complete	Complete
A flaw was found in the KVM's AMD code for supporting the Secure Encrypted Virtualization-Encrypted State (SEV-ES). A KVM guest using SEV-ES can trigger out-of-bounds reads and writes in the host kernel via a malicious VMGEXIT for a string I/O instruction (for example, outs or ins) using the exit reason SVM_EXIT_IOIO. This issue results in a crash of the entire system or a potential guest-to-host escape scenario.
41	CVE-2021-3847	281		2022-04-01	2022-04-11	7.2	None	Local	Low	Not required	Complete	Complete	Complete
An unauthorized access to the execution of the setuid file with capabilities flaw in the Linux kernel OverlayFS subsystem was found in the way user copying a capable file from a nosuid mount into another mount. A local user could use this flaw to escalate their privileges on the system.
42	CVE-2021-3773			2022-02-16	2023-02-24	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
A flaw in netfilter could allow a network-connected attacker to infer openvpn connection endpoint information for further use in traditional network attacks.
43	CVE-2021-3760	416		2022-02-16	2023-03-01	7.2	None	Local	Low	Not required	Complete	Complete	Complete
A flaw was found in the Linux kernel. A use-after-free vulnerability in the NFC stack can lead to a threat to confidentiality, integrity, and system availability.
44	CVE-2021-3752	416		2022-02-16	2023-02-24	7.9	None	Local Network	Medium	Not required	Complete	Complete	Complete
A use-after-free flaw was found in the Linux kernel’s Bluetooth subsystem in the way user calls connect to the socket and disconnect simultaneously due to a race condition. This flaw allows a user to crash the system or escalate their privileges. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
45	CVE-2021-3715	416		2022-03-02	2023-01-24	7.2	None	Local	Low	Not required	Complete	Complete	Complete
A flaw was found in the "Routing decision" classifier in the Linux kernel's Traffic Control networking subsystem in the way it handled changing of classification filters, leading to a use-after-free condition. This flaw allows unprivileged local users to escalate their privileges on the system. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
46	CVE-2021-3656	862		2022-03-04	2023-01-19	7.2	None	Local	Low	Not required	Complete	Complete	Complete
A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMCB (virtual machine control block) provided by the L1 guest to spawn/handle a nested guest (L2). Due to improper validation of the "virt_ext" field, this issue could allow a malicious L1 to disable both VMLOAD/VMSAVE intercepts and VLS (Virtual VMLOAD/VMSAVE) for the L2 guest. As a result, the L2 guest would be allowed to read/write physical pages of the host, resulting in a crash of the entire system, leak of sensitive data or potential guest-to-host escape.
47	CVE-2021-3612	787		2021-07-09	2023-01-11	7.2	None	Local	Low	Not required	Complete	Complete	Complete
An out-of-bounds memory write flaw was found in the Linux kernel's joystick devices subsystem in versions before 5.9-rc1, in the way the user calls ioctl JSIOCSBTNMAP. This flaw allows a local user to crash the system or possibly escalate their privileges on the system. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
48	CVE-2021-3491	787	Exec Code Overflow Bypass	2021-06-04	2021-09-14	7.2	None	Local	Low	Not required	Complete	Complete	Complete
The io_uring subsystem in the Linux kernel allowed the MAX_RW_COUNT limit to be bypassed in the PROVIDE_BUFFERS operation, which led to negative values being usedin mem_rw when reading /proc/<PID>/mem. This could be used to create a heap overflow leading to arbitrary code execution in the kernel. It was addressed via commit d1f82808877b ("io_uring: truncate lengths larger than MAX_RW_COUNT on provide buffers") (v5.13-rc1) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37. It was introduced in ddf0322db79c ("io_uring: add IORING_OP_PROVIDE_BUFFERS") (v5.7-rc1).
49	CVE-2021-3490	125	Exec Code	2021-06-04	2021-09-14	7.2	None	Local	Low	Not required	Complete	Complete	Complete
The eBPF ALU32 bounds tracking for bitwise ops (AND, OR and XOR) in the Linux kernel did not properly update 32-bit bounds, which could be turned into out of bounds reads and writes in the Linux kernel and therefore, arbitrary code execution. This issue was fixed via commit 049c4e13714e ("bpf: Fix alu32 const subreg bound tracking on bitwise operations") (v5.13-rc4) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37. The AND/OR issues were introduced by commit 3f50f132d840 ("bpf: Verifier, do explicit ALU32 bounds tracking") (5.7-rc1) and the XOR variant was introduced by 2921c90d4718 ("bpf:Fix a verifier failure with xor") ( 5.10-rc1).
50	CVE-2021-3489	787	Exec Code	2021-06-04	2021-09-14	7.2	None	Local	Low	Not required	Complete	Complete	Complete
The eBPF RINGBUF bpf_ringbuf_reserve() function in the Linux kernel did not check that the allocated size was smaller than the ringbuf size, allowing an attacker to perform out-of-bounds writes within the kernel and therefore, arbitrary code execution. This issue was fixed via commit 4b81ccebaeee ("bpf, ringbuf: Deny reserve of buffers larger than ringbuf") (v5.13-rc4) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37. It was introduced via 457f44363a88 ("bpf: Implement BPF ring buffer and verifier support for it") (v5.8-rc1).

Total number of vulnerabilities : 764 Page : 1 (This Page)2 3 4 5 6 7 8 9 10 11 12 13 14 15 16