Dan Rosenberg

The issue is related to an integer signedness error in the `btrfs ioctl space info` function, which allows local users to cause a denial of service, specifically a heap-based buffer overflow, or possibly have other unspecified impacts. This can be achieved by using a crafted `slot` value.

The issue is related to the AX.25 daemon (ax25d) not checking the return value of a setuid call, which is responsible for dropping privileges. If the setuid call fails, the daemon continues to run with root privileges, potentially allowing privilege escalation.

The issue arises from an unchecked sscanf() call, which allows an insecure temporary settings file to overflow a static-sized buffer on the stack.

The issue is related to the improper handling of the file descriptor for the logger in the gdomap component of GNUstep Base. This can be exploited remotely, potentially leading to a denial of service. The exploitation may cause the service to abort when an invalid request is received.

The issue allows local users to create a read-write memory mapping for the entirety of kernel memory, and consequently gain privileges, via crafted /dev/graphics/fb0 mmap2 system calls. This is due to an integer overflow in the fb mmap function in drivers/video/fbmem.c. The Motochopper pwn program demonstrates this exploit.

The issue allows local users to unlock the bootloader by using kernel mode to perform crafted `0x9` and `0x2` SMC operations, due to the lack of verification of the association between a certain physical-address argument and a memory region.

The issue allows local users to gain privileges via a crafted program that makes packet-filter ioctl calls, due to the kernel dereferencing invalid pointers during the handling of packet-filter data structures.

The issue concerns the Berkeley Packet Filter (BPF) interpreter implementation in the kernel, which accesses uninitialized memory locations. This allows local users to obtain sensitive information about the layout of kernel memory via a crafted program that uses a BPF interface.

The issue is related to multiple stack-based buffer overflows in the Near Field Communication Controller Interface (NCI) in the Linux kernel. This can be exploited by remote attackers who send incoming frames with crafted length fields, potentially leading to a denial of service (crash) and possibly allowing the execution of arbitrary code.

The issue is related to multiple array index errors in the sound/oss/opl3.c file of the Linux kernel. This can be exploited by local users to cause a denial of service, resulting in heap memory corruption, or potentially gain privileges. The exploitation requires write access to /dev/sequencer.

The issue is related to the ROSE protocol implementation in the Linux kernel, where it fails to verify the consistency of certain data-length values with the amount of data sent. This could potentially allow remote attackers to obtain sensitive information from kernel memory or cause a denial of service through an out-of-bounds read by sending crafted data to a ROSE socket.

The issue is related to an array index error in the `rose parse national` function, which can be exploited by remote attackers to cause a denial of service or potentially have other unspecified impacts. This is achieved by composing FAC NATIONAL DIGIS data with a large number of digipeaters and sending it to a ROSE socket.

The issue is related to the `rose parse ccitt` function in the Linux kernel, which does not validate certain fields. This allows remote attackers to cause a denial of service or conduct stack-based buffer overflow attacks via specially crafted data sent to a ROSE socket.

The issue is related to an integer underflow in the Open Sound System (OSS) subsystem of the Linux kernel. This allows local users with write access to /dev/sequencer to cause a denial of service, resulting in memory corruption. The problem is specifically noted on non-x86 platforms.

The issue allows local users to gain privileges by writing a certain integer value to kernel memory due to the osf wait4 function in arch/alpha/kernel/osf sys.c using an incorrect pointer on the Alpha platform.

The issue is related to an integer overflow in the sys oabi semtimedop function, which can be exploited by local users to gain privileges or cause a denial of service, resulting in heap memory corruption. This can be achieved by providing a crafted argument and leveraging a race condition when CONFIG OABI COMPAT is enabled on the ARM platform.

The issue is related to an integer signedness error in the osf sysinfo function, which can allow local users to obtain sensitive information from kernel memory. This error is present in the Linux kernel on the Alpha platform.

The issue is related to the `osf getsysinfo` function in the Linux kernel, which does not properly restrict the data size for GSI GET HWRPB operations. This allows local users to obtain sensitive information from kernel memory via a crafted call.

The issue is related to an integer signedness error in the osf getdomainname function, which can allow local users to obtain sensitive information from kernel memory. This error is present in the Linux kernel on the Alpha platform.

The issue allows local users to obtain sensitive information from kernel memory locations. This is due to the ptrace setxregs function in arch/xtensa/kernel/ptrace.c not validating user-space pointers, enabling users to craft a PTRACE SETXTREGS request to access sensitive information.