Eugene Teo

The issue allows local users to obtain sensitive keystroke information via access to `/dev/pts/` and `/dev/tty*`. This is related to a component of the Linux kernel that is associated with information disclosure. Exploitation of this issue may allow an attacker to gain unauthorized access to protected information.

The issue allows local users to cause a denial of service, resulting in stack corruption and panic, via a crafted application that triggers certain lock contention. This is due to the int3 handler relying on a per-CPU debug stack.

Name of the Vulnerable Software and Affected Versions: Linux kernel versions 2.6.x through 4.x Description: The issue is a memory leak in the videobuf subsystem, specifically in the drivers/media/video/videobuf-core.c file. This allows local users to cause a denial of service by consuming memory through a series of mmap calls that require new allocations, leveraging access to /dev/video. As of 2016-06-18, this affects only 11 drivers that have not been updated to use videobuf2 instead of videobuf. Recommendations: For Linux kernel versions 2.6.x through 4.x, consider updating the affected drivers to use videobuf2 instead of videobuf to mitigate the risk of memory consumption. As a temporary workaround, restrict access to /dev/video to minimize the risk of exploitation.

The issue is related to a buffer overflow in the fuse do ioctl function in fs/fuse/file.c, which can be exploited by local users. This can lead to a denial of service or possibly have other unspecified impacts by leveraging the ability to operate a CUSE server.

The issue allows local users to cause a denial of service via incorrect iocb management in the kiocb batch free function.

The issue affects the net subsystem in the Linux kernel, where it does not properly restrict the use of the IFF TX SKB SHARING flag. This allows local users with the CAP NET ADMIN capability to cause a denial of service (panic) by accessing /proc/net/pktgen/pgctrl and then using the pktgen package in conjunction with a bridge device for a VLAN interface.

The issue is related to a double free vulnerability in the `xfrm6 tunnel rcv` function. This vulnerability can be exploited by remote attackers who send crafted IPv6 packets, potentially causing a denial of service (panic) when the `xfrm6 tunnel` module is enabled.

The issue allows user-assisted remote attackers to trigger inconsistent filesystem-groups data and possibly cause a denial of service via a malformed ext4 filesystem containing a super block with a large FLEX BG group size (aka s log groups per flex value). This problem exists because of an incomplete fix for a previous issue.

The issue allows local users to cause a denial of service, resulting in a system crash, by utilizing the mknod system call with a pathname on an NFSv4 filesystem. This is due to a problem in the encode share access function in fs/nfs/nfs4xdr.c.

The issue is related to the NFS implementation in the Linux kernel, where certain functions are called without properly initializing specific data. This can be exploited by local users to cause a denial of service, resulting in a NULL pointer dereference and O DIRECT oops. An example of exploitation is demonstrated using the diotest4 test from the LTP suite.

The issue allows remote DNS servers to cause a denial of service by not providing a valid response to a DNS query. This can trigger improper handling of error data within a DNS resolver key, resulting in a NULL pointer dereference and OOPS.

The issue is related to a certain Red Hat patch to the sctp sock migrate function in net/sctp/socket.c in the Linux kernel. It allows remote attackers to cause a denial of service via a crafted SCTP packet, resulting in a NULL pointer dereference and OOPS.

The issue allows local users to cause a denial of service, resulting in a system crash, by arranging for all resource groups to have too little free space. This is due to the gfs2 fallocate function in fs/gfs2/file.c not ensuring that the size of a chunk allocation is a multiple of the block size.

The issue is related to the handling of cpuid instruction emulation when exiting the VM. Local guest users can cause a denial of service, resulting in a guest crash, via unspecified vectors when using x86 Intel processors and the VMX virtualization extension is enabled.

The issue allows remote attackers to obtain potentially sensitive information from kernel stack memory by reading uninitialized data in the ah field of an Acorn Universal Networking (AUN) packet. This is due to a problem in the econet sendmsg function in net/econet/af econet.c on the x86 64 platform.

The issue is related to the cifs close function in the Linux kernel, which can cause a denial of service due to a NULL pointer dereference and BUG when the O DIRECT flag is set during an attempt to open a file on a CIFS filesystem. This could potentially have other unspecified impacts.

The issue is related to the `bond select queue` function in the Linux kernel, which does not properly restrict queue indexes when a network device with a large number of receive queues is installed but the default `tx queues` setting is used. This allows remote attackers to cause a denial of service, resulting in a system crash, or possibly have other unspecified impacts by sending network traffic.

The issue is related to the Reliable Datagram Sockets (RDS) subsystem in the Linux kernel, which does not properly handle congestion map updates. This can be exploited by local users to cause a denial of service, resulting in a system crash. The exploitation vectors involve either a loopback transmit operation or an InfiniBand transmit operation.

The issue allows local users to bypass Integrity Measurement Architecture (IMA) rules under certain circumstances when the Linux Security Modules (LSM) framework is disabled. This can happen when an administrator adds an IMA rule for LSM, and it can be exploited by local users in opportunistic situations.

The issue is related to the calculation of chunk lengths for INIT and INIT ACK chunks in the Linux kernel. When `addip enable` and `auth enable` are used, the amount of zero padding is not considered, allowing remote attackers to cause a denial of service via crafted packet data.