2.6.18 RC3 * * : Security Vulnerabilities

Cpe Name:cpe:2.3:o:linux:linux_kernel:2.6.18:rc3:*:*:*:*:*:*

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : CVE Number Descending CVE Number Ascending CVSS Score Descending Number Of Exploits Descending

#	CVE ID	CWE ID	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
1	CVE-2012-3510	399	DoS +Info	2012-10-03	2013-04-19	5.6	None	Local	Low	Not required	Partial	None	Complete
Use-after-free vulnerability in the xacct_add_tsk function in kernel/tsacct.c in the Linux kernel before 2.6.19 allows local users to obtain potentially sensitive information from kernel memory or cause a denial of service (system crash) via a taskstats TASKSTATS_CMD_ATTR_PID command.
2	CVE-2012-1583	399	DoS	2012-06-16	2016-08-23	5.0	None	Remote	Low	Not required	None	None	Partial
Double free vulnerability in the xfrm6_tunnel_rcv function in net/ipv6/xfrm6_tunnel.c in the Linux kernel before 2.6.22, when the xfrm6_tunnel module is enabled, allows remote attackers to cause a denial of service (panic) via crafted IPv6 packets.
3	CVE-2011-1577	119	DoS Overflow	2011-05-03	2018-10-09	4.9	None	Local	Low	Not required	None	None	Complete
Heap-based buffer overflow in the is_gpt_valid function in fs/partitions/efi.c in the Linux kernel 2.6.38 and earlier allows physically proximate attackers to cause a denial of service (OOPS) or possibly have unspecified other impact via a crafted size of the EFI GUID partition-table header on removable media.
4	CVE-2011-1495	20	DoS +Priv Mem. Corr. +Info	2011-05-03	2018-10-09	7.2	None	Local	Low	Not required	Complete	Complete	Complete
drivers/scsi/mpt2sas/mpt2sas_ctl.c in the Linux kernel 2.6.38 and earlier does not validate (1) length and (2) offset values before performing memory copy operations, which might allow local users to gain privileges, cause a denial of service (memory corruption), or obtain sensitive information from kernel memory via a crafted ioctl call, related to the _ctl_do_mpt_command and _ctl_diag_read_buffer functions.
5	CVE-2011-1494	189	DoS Overflow +Priv Mem. Corr.	2011-05-03	2018-10-09	6.9	None	Local	Medium	Not required	Complete	Complete	Complete
Integer overflow in the _ctl_do_mpt_command function in drivers/scsi/mpt2sas/mpt2sas_ctl.c in the Linux kernel 2.6.38 and earlier might allow local users to gain privileges or cause a denial of service (memory corruption) via an ioctl call specifying a crafted value that triggers a heap-based buffer overflow.
6	CVE-2011-1172	200	+Info	2011-06-22	2015-10-06	2.1	None	Local	Low	Not required	Partial	None	None
net/ipv6/netfilter/ip6_tables.c in the IPv6 implementation in the Linux kernel before 2.6.39 does not place the expected '\0' character at the end of string data in the values of certain structure members, which allows local users to obtain potentially sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability to issue a crafted request, and then reading the argument to the resulting modprobe process.
7	CVE-2011-1171	200	+Info	2011-06-22	2015-10-06	2.1	None	Local	Low	Not required	Partial	None	None
net/ipv4/netfilter/ip_tables.c in the IPv4 implementation in the Linux kernel before 2.6.39 does not place the expected '\0' character at the end of string data in the values of certain structure members, which allows local users to obtain potentially sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability to issue a crafted request, and then reading the argument to the resulting modprobe process.
8	CVE-2011-1170	200	+Info	2011-06-22	2015-10-06	2.1	None	Local	Low	Not required	Partial	None	None
net/ipv4/netfilter/arp_tables.c in the IPv4 implementation in the Linux kernel before 2.6.39 does not place the expected '\0' character at the end of string data in the values of certain structure members, which allows local users to obtain potentially sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability to issue a crafted request, and then reading the argument to the resulting modprobe process.
9	CVE-2011-1090	399	DoS	2011-05-09	2018-10-09	4.9	None	Local	Low	Not required	None	None	Complete
The __nfs4_proc_set_acl function in fs/nfs/nfs4proc.c in the Linux kernel before 2.6.38 stores NFSv4 ACL data in memory that is allocated by kmalloc but not properly freed, which allows local users to cause a denial of service (panic) via a crafted attempt to set an ACL.
10	CVE-2011-0726	20		2011-07-18	2015-10-06	2.1	None	Local	Low	Not required	Partial	None	None
The do_task_stat function in fs/proc/array.c in the Linux kernel before 2.6.39-rc1 does not perform an expected uid check, which makes it easier for local users to defeat the ASLR protection mechanism by reading the start_code and end_code fields in the /proc/#####/stat file for a process executing a PIE binary.
11	CVE-2010-3066		DoS	2010-12-06	2018-10-10	4.9	None	Local	Low	Not required	None	None	Complete
The io_submit_one function in fs/aio.c in the Linux kernel before 2.6.23 allows local users to cause a denial of service (NULL pointer dereference) via a crafted io_submit system call with an IOCB_FLAG_RESFD flag.
12	CVE-2010-3015	189	DoS Overflow	2010-08-20	2018-10-10	4.7	None	Local	Medium	Not required	None	None	Complete
Integer overflow in the ext4_ext_get_blocks function in fs/ext4/extents.c in the Linux kernel before 2.6.34 allows local users to cause a denial of service (BUG and system crash) via a write operation on the last block of a large file, followed by a sync operation.
13	CVE-2010-1437	362	DoS Mem. Corr.	2010-05-07	2018-10-10	1.9	None	Local	Medium	Not required	None	None	Partial
Race condition in the find_keyring_by_name function in security/keys/keyring.c in the Linux kernel 2.6.34-rc5 and earlier allows local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact via keyctl session commands that trigger access to a dead keyring that is undergoing deletion by the key_cleanup function.
14	CVE-2010-1188	399	DoS	2010-03-31	2017-09-19	7.1	None	Remote	Medium	Not required	None	None	Complete
Use-after-free vulnerability in net/ipv4/tcp_input.c in the Linux kernel 2.6 before 2.6.20, when IPV6_RECVPKTINFO is set on a listening socket, allows remote attackers to cause a denial of service (kernel panic) via a SYN packet while the socket is in a listening (TCP_LISTEN) state, which is not properly handled and causes the skb structure to be freed.
15	CVE-2010-1173	20	DoS	2010-05-07	2018-10-10	7.1	None	Remote	Medium	Not required	None	None	Complete
The sctp_process_unk_param function in net/sctp/sm_make_chunk.c in the Linux kernel 2.6.33.3 and earlier, when SCTP is enabled, allows remote attackers to cause a denial of service (system crash) via an SCTPChunkInit packet containing multiple invalid parameters that require a large amount of error data.
16	CVE-2010-0437		DoS	2010-03-24	2018-10-10	7.8	None	Remote	Low	Not required	None	None	Complete
The ip6_dst_lookup_tail function in net/ipv6/ip6_output.c in the Linux kernel before 2.6.27 does not properly handle certain circumstances involving an IPv6 TUN network interface and a large number of neighbors, which allows attackers to cause a denial of service (NULL pointer dereference and OOPS) or possibly have unspecified other impact via unknown vectors.
17	CVE-2010-0008	399	DoS	2010-03-19	2018-10-10	7.8	None	Remote	Low	Not required	None	None	Complete
The sctp_rcv_ootb function in the SCTP implementation in the Linux kernel before 2.6.23 allows remote attackers to cause a denial of service (infinite loop) via (1) an Out Of The Blue (OOTB) chunk or (2) a chunk of zero length.
18	CVE-2009-3726	399	DoS	2009-11-09	2017-09-19	7.8	None	Remote	Low	Not required	None	None	Complete
The nfs4_proc_lock function in fs/nfs/nfs4proc.c in the NFSv4 client in the Linux kernel before 2.6.31-rc4 allows remote NFS servers to cause a denial of service (NULL pointer dereference and panic) by sending a certain response containing incorrect file attributes, which trigger attempted use of an open file that lacks NFSv4 state.
19	CVE-2009-3624	310	DoS +Priv	2009-11-02	2012-03-19	4.6	None	Local	Low	Not required	Partial	Partial	Partial
The get_instantiation_keyring function in security/keys/keyctl.c in the KEYS subsystem in the Linux kernel before 2.6.32-rc5 does not properly maintain the reference count of a keyring, which allows local users to gain privileges or cause a denial of service (OOPS) via vectors involving calls to this function without specifying a keyring by ID, as demonstrated by a series of keyctl request2 and keyctl list commands.
20	CVE-2009-3620	20	DoS +Priv	2009-10-22	2017-09-19	4.9	None	Local	Low	Not required	None	None	Complete
The ATI Rage 128 (aka r128) driver in the Linux kernel before 2.6.31-git11 does not properly verify Concurrent Command Engine (CCE) state initialization, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly gain privileges via unspecified ioctl calls.
21	CVE-2009-3613	399	DoS	2009-10-19	2017-09-19	7.8	None	Remote	Low	Not required	None	None	Complete
The swiotlb functionality in the r8169 driver in drivers/net/r8169.c in the Linux kernel before 2.6.27.22 allows remote attackers to cause a denial of service (IOMMU space exhaustion and system crash) by using jumbo frames for a large amount of network traffic, as demonstrated by a flood ping.
22	CVE-2009-2909	189	DoS	2009-10-20	2012-03-19	4.9	None	Local	Low	Not required	None	None	Complete
Integer signedness error in the ax25_setsockopt function in net/ax25/af_ax25.c in the ax25 subsystem in the Linux kernel before 2.6.31.2 allows local users to cause a denial of service (OOPS) via a crafted optlen value in an SO_BINDTODEVICE operation.
23	CVE-2009-2406	119	DoS Overflow +Priv	2009-07-31	2018-10-30	6.9	None	Local	Medium	Not required	Complete	Complete	Complete
Stack-based buffer overflow in the parse_tag_11_packet function in fs/ecryptfs/keystore.c in the eCryptfs subsystem in the Linux kernel before 2.6.30.4 allows local users to cause a denial of service (system crash) or possibly gain privileges via vectors involving a crafted eCryptfs file, related to not ensuring that the key signature length in a Tag 11 packet is compatible with the key signature buffer size.
24	CVE-2009-1439	119	DoS Overflow	2009-04-27	2018-10-10	7.8	None	Remote	Low	Not required	None	None	Complete
Buffer overflow in fs/cifs/connect.c in CIFS in the Linux kernel 2.6.29 and earlier allows remote attackers to cause a denial of service (crash) via a long nativeFileSystem field in a Tree Connect response to an SMB mount request.
25	CVE-2009-1389	119	DoS Overflow Mem. Corr.	2009-06-16	2018-10-30	7.8	None	Remote	Low	Not required	None	None	Complete
Buffer overflow in the RTL8169 NIC driver (drivers/net/r8169.c) in the Linux kernel before 2.6.30 allows remote attackers to cause a denial of service (kernel memory corruption and crash) via a long packet.
26	CVE-2009-1388	362	DoS	2009-07-05	2018-10-10	4.9	None	Local	Low	Not required	None	None	Complete
The ptrace_start function in kernel/ptrace.c in the Linux kernel 2.6.18 does not properly handle simultaneous execution of the do_coredump function, which allows local users to cause a denial of service (deadlock) via vectors involving the ptrace system call and a coredumping thread.
27	CVE-2009-1385	189	DoS	2009-06-04	2018-10-10	7.8	None	Remote	Low	Not required	None	None	Complete
Integer underflow in the e1000_clean_rx_irq function in drivers/net/e1000/e1000_main.c in the e1000 driver in the Linux kernel before 2.6.30-rc8, the e1000e driver in the Linux kernel, and Intel Wired Ethernet (aka e1000) before 7.5.5 allows remote attackers to cause a denial of service (panic) via a crafted frame size.
28	CVE-2009-1360		DoS	2009-04-22	2012-03-19	7.1	None	Remote	Medium	Not required	None	None	Complete
The __inet6_check_established function in net/ipv6/inet6_hashtables.c in the Linux kernel before 2.6.29, when Network Namespace Support (aka NET_NS) is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via vectors involving IPv6 packets.
29	CVE-2009-1338	264	Bypass	2009-04-22	2018-10-10	4.6	None	Local	Low	Not required	Partial	Partial	Partial
The kill_something_info function in kernel/signal.c in the Linux kernel before 2.6.28 does not consider PID namespaces when processing signals directed to PID -1, which allows local users to bypass the intended namespace isolation, and send arbitrary signals to all processes in all namespaces, via a kill command.
30	CVE-2009-1337	264		2009-04-22	2018-10-10	4.4	None	Local	Medium	Not required	Partial	Partial	Partial
The exit_notify function in kernel/exit.c in the Linux kernel before 2.6.30-rc1 does not restrict exit signals when the CAP_KILL capability is held, which allows local users to send an arbitrary signal to a process by running a program that modifies the exit_signal field and then uses an exec system call to launch a setuid application.
31	CVE-2009-1336	20	DoS	2009-04-22	2018-10-10	4.9	None	Local	Low	Not required	None	None	Complete
fs/nfs/client.c in the Linux kernel before 2.6.23 does not properly initialize a certain structure member that stores the maximum NFS filename length, which allows local users to cause a denial of service (OOPS) via a long filename, related to the encode_lookup function.
32	CVE-2009-1192		+Info	2009-04-24	2018-10-10	4.9	None	Local	Low	Not required	Complete	None	None
The (1) agp_generic_alloc_page and (2) agp_generic_alloc_pages functions in drivers/char/agp/generic.c in the agp subsystem in the Linux kernel before 2.6.30-rc3 do not zero out pages that may later be available to a user-space process, which allows local users to obtain sensitive information by reading these pages.
33	CVE-2009-1184	16	Bypass	2009-05-05	2012-03-19	4.4	None	Local	Medium	Not required	Partial	Partial	Partial
The selinux_ip_postroute_iptables_compat function in security/selinux/hooks.c in the SELinux subsystem in the Linux kernel before 2.6.27.22, and 2.6.28.x before 2.6.28.10, when compat_net is enabled, omits calls to avc_has_perm for the (1) node and (2) port, which allows local users to bypass intended restrictions on network traffic. NOTE: this was incorrectly reported as an issue fixed in 2.6.27.21.
34	CVE-2009-0778		DoS	2009-03-12	2020-08-28	7.1	None	Remote	Medium	Not required	None	None	Complete
The icmp_send function in net/ipv4/icmp.c in the Linux kernel before 2.6.25, when configured as a router with a REJECT route, does not properly manage the Protocol Independent Destination Cache (aka DST) in some situations involving transmission of an ICMP Host Unreachable message, which allows remote attackers to cause a denial of service (connectivity outage) by sending a large series of packets to many destination IP addresses within this REJECT route, related to an "rt_cache leak."
35	CVE-2009-0676	264	+Info	2009-02-22	2018-10-10	2.1	None	Local	Low	Not required	Partial	None	None
The sock_getsockopt function in net/core/sock.c in the Linux kernel before 2.6.28.6 does not initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel memory via an SO_BSDCOMPAT getsockopt request.
36	CVE-2009-0675	264		2009-02-22	2018-10-10	2.1	None	Local	Low	Not required	None	Partial	None
The skfp_ioctl function in drivers/net/skfp/skfddi.c in the Linux kernel before 2.6.28.6 permits SKFP_CLR_STATS requests only when the CAP_NET_ADMIN capability is absent, instead of when this capability is present, which allows local users to reset the driver statistics, related to an "inverted logic" issue.
37	CVE-2009-0605	119	DoS Overflow +Priv Mem. Corr.	2009-02-17	2012-03-19	4.9	None	Local	Low	Not required	None	None	Complete
Stack consumption vulnerability in the do_page_fault function in arch/x86/mm/fault.c in the Linux kernel before 2.6.28.5 allows local users to cause a denial of service (memory corruption) or possibly gain privileges via unspecified vectors that trigger page faults on a machine that has a registered Kprobes probe.
38	CVE-2009-0269	399	DoS Mem. Corr.	2009-01-26	2018-10-11	4.9	None	Local	Low	Not required	None	None	Complete
fs/ecryptfs/inode.c in the eCryptfs subsystem in the Linux kernel before 2.6.28.1 allows local users to cause a denial of service (fault or memory corruption), or possibly have unspecified other impact, via a readlink call that results in an error, leading to use of a -1 return value as an array index.
39	CVE-2009-0065	119	Overflow	2009-01-07	2017-09-29	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Buffer overflow in net/sctp/sm_statefuns.c in the Stream Control Transmission Protocol (sctp) implementation in the Linux kernel before 2.6.28-git8 allows remote attackers to have an unknown impact via an FWD-TSN (aka FORWARD-TSN) chunk with a large stream ID.
40	CVE-2009-0031	399	DoS	2009-01-21	2017-09-29	4.9	None	Local	Low	Not required	None	None	Complete
Memory leak in the keyctl_join_session_keyring function (security/keys/keyctl.c) in Linux kernel 2.6.29-rc2 and earlier allows local users to cause a denial of service (kernel memory consumption) via unknown vectors related to a "missing kfree."
41	CVE-2009-0028	264		2009-02-27	2018-10-11	2.1	None	Local	Low	Not required	None	None	Partial
The clone system call in the Linux kernel 2.6.28 and earlier allows local users to send arbitrary signals to a parent process from an unprivileged child process by launching an additional child process with the CLONE_PARENT flag, and then letting this new process exit.
42	CVE-2009-0024	264	DoS +Priv	2009-01-13	2012-03-19	7.2	None	Local	Low	Not required	Complete	Complete	Complete
The sys_remap_file_pages function in mm/fremap.c in the Linux kernel before 2.6.24.1 allows local users to cause a denial of service or gain privileges via unspecified vectors, related to the vm_file structure member, and the mmap_region and do_munmap functions.
43	CVE-2008-6107	399	DoS	2009-02-10	2017-08-08	4.9	None	Local	Low	Not required	None	None	Complete
The (1) sys32_mremap function in arch/sparc64/kernel/sys_sparc32.c, the (2) sparc_mmap_check function in arch/sparc/kernel/sys_sparc.c, and the (3) sparc64_mmap_check function in arch/sparc64/kernel/sys_sparc.c, in the Linux kernel before 2.6.25.4, omit some virtual-address range (aka span) checks when the mremap MREMAP_FIXED bit is not set, which allows local users to cause a denial of service (panic) via unspecified mremap calls, a related issue to CVE-2008-2137.
44	CVE-2008-5713	399	DoS	2008-12-24	2018-10-03	4.9	None	Local	Low	Not required	None	None	Complete
The __qdisc_run function in net/sched/sch_generic.c in the Linux kernel before 2.6.25 on SMP machines allows local users to cause a denial of service (soft lockup) by sending a large amount of network traffic, as demonstrated by multiple simultaneous invocations of the Netperf benchmark application in UDP_STREAM mode.
45	CVE-2008-5702	119	Overflow	2008-12-22	2018-10-03	7.2	None	Local	Low	Not required	Complete	Complete	Complete
Buffer underflow in the ibwdt_ioctl function in drivers/watchdog/ib700wdt.c in the Linux kernel before 2.6.28-rc1 might allow local users to have an unknown impact via a certain /dev/watchdog WDIOC_SETTIMEOUT IOCTL call.
46	CVE-2008-5700	399	DoS	2008-12-22	2018-10-11	1.9	None	Local	Medium	Not required	None	None	Partial
libata in the Linux kernel before 2.6.27.9 does not set minimum timeouts for SG_IO requests, which allows local users to cause a denial of service (Programmed I/O mode on drives) via multiple simultaneous invocations of an unspecified test program.
47	CVE-2008-5182	362	+Priv	2008-11-21	2018-10-11	6.9	None	Local	Medium	Not required	Complete	Complete	Complete
The inotify functionality in Linux kernel 2.6 before 2.6.28-rc5 might allow local users to gain privileges via unknown vectors related to race conditions in inotify watch removal and umount.
48	CVE-2008-5079	399	DoS	2008-12-09	2018-10-11	4.9	None	Local	Low	Not required	None	None	Complete
net/atm/svc.c in the ATM subsystem in the Linux kernel 2.6.27.8 and earlier allows local users to cause a denial of service (kernel infinite loop) by making two calls to svc_listen for the same socket, and then reading a /proc/net/atm/*vc file, related to corruption of the vcc table.
49	CVE-2008-5029		DoS	2008-11-10	2018-10-11	4.9	None	Local	Low	Not required	None	None	Complete
The __scm_destroy function in net/core/scm.c in the Linux kernel 2.6.27.4, 2.6.26, and earlier makes indirect recursive calls to itself through calls to the fput function, which allows local users to cause a denial of service (panic) via vectors related to sending an SCM_RIGHTS message through a UNIX domain socket and closing file descriptors.
50	CVE-2008-5025	119	DoS Overflow Mem. Corr.	2008-11-17	2017-09-29	7.8	None	Remote	Low	Not required	None	None	Complete
Stack-based buffer overflow in the hfs_cat_find_brec function in fs/hfs/catalog.c in the Linux kernel before 2.6.28-rc1 allows attackers to cause a denial of service (memory corruption or system crash) via an hfs filesystem image with an invalid catalog namelength field, a related issue to CVE-2008-4933.

Total number of vulnerabilities : 82 Page : 1 (This Page)2