[Forgot Password]
Login  Register Subscribe

30479

 
 

423868

 
 

248364

 
 

909

 
 

195388

 
 

282

Paid content will be excluded from the download.


Download | Alert*
OVAL

ALAS-2019-1214 --- kernel perf

ID: oval:org.secpod.oval:def:1601007Date: (C)2019-06-19   (M)2024-04-17
Class: PATCHFamily: unix




A flaw was found in the Linux kernel#039;s freescale hypervisor manager implementation. A parameter passed via to an ioctl was incorrectly validated and used in size calculations for the page size calculation. An attacker can use this flaw to crash the system or corrupt memory or, possibly, create other adverse security affects. The do_hidp_sock_ioctl function in net/bluetooth/hidp/sock.c in the Linux kernel before 5.0.15 allows a local user to obtain potentially sensitive information from kernel stack memory via a HIDPCONNADD command, because a name field may not end with a #039;\0#039; character. If the Wake-up on Wireless LAN functionality is configured in the brcmfmac driver, which only works with Broadcom FullMAC chipsets, a malicious event frame can be constructed to trigger a heap buffer overflow in the brcmf_wowl_nd_results function. This vulnerability can be exploited by compromised chipsets to compromise the host, or when used in combination with another brcmfmac driver flaw , can be used remotely. This can result in a remote denial of service . Due to the nature of the flaw, a remote privilege escalation cannot be fully ruled out. A new software page cache side channel attack scenario was discovered in operating systems that implement the very common #039;page cache#039; caching mechanism. A malicious user/process could use #039;in memory#039; page-cache knowledge to infer access timings to shared memory and gain knowledge which can be used to reduce effectiveness of cryptographic strength by monitoring algorithmic behavior, infer access patterns of memory to determine code paths taken, and exfiltrate data to a blinded attacker through page-granularity access times as a side-channel. A flaw was found in the Linux kernel#039;s vfio interface implementation that permits violation of the user#039;s locked memory limit. If a device is bound to a vfio driver, such as vfio-pci, and the local attacker is administratively granted ownership of the device, it may cause a system memory exhaustion and thus a denial of service

Platform:
Amazon Linux AMI
Product:
kernel
perf
Reference:
ALAS-2019-1214
CVE-2019-9500
CVE-2019-5489
CVE-2019-3882
CVE-2019-11884
CVE-2019-10142
CVE    5
CVE-2019-10142
CVE-2019-11884
CVE-2019-5489
CVE-2019-3882
...
CPE    2125
cpe:/o:linux:linux_kernel:2.4.27:pre5
cpe:/o:linux:linux_kernel:2.4.27:pre4
cpe:/o:linux:linux_kernel:2.4.27:pre1
cpe:/o:linux:linux_kernel:2.4.27:pre3
...

© SecPod Technologies