Vulnerabilities > Linux > Linux Kernel > 3.10.59

DATE CVE VULNERABILITY TITLE RISK
2016-12-08 CVE-2015-8967 Permissions, Privileges, and Access Controls vulnerability in multiple products
arch/arm64/kernel/sys.c in the Linux kernel before 4.0 allows local users to bypass the "strict page permissions" protection mechanism and modify the system-call table, and consequently gain privileges, by leveraging write access.
local
low complexity
google linux CWE-264
7.8
2016-12-08 CVE-2015-8966 Permissions, Privileges, and Access Controls vulnerability in Linux Kernel
arch/arm/kernel/sys_oabi-compat.c in the Linux kernel before 4.4 allows local users to gain privileges via a crafted (1) F_OFD_GETLK, (2) F_OFD_SETLK, or (3) F_OFD_SETLKW command in an fcntl64 system call.
local
low complexity
linux CWE-264
7.2
2016-12-08 CVE-2016-8655 Use After Free vulnerability in multiple products
Race condition in net/packet/af_packet.c in the Linux kernel through 4.8.12 allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging the CAP_NET_RAW capability to change a socket version, related to the packet_set_ring and packet_setsockopt functions.
local
low complexity
linux canonical CWE-416
7.8
2016-11-28 CVE-2016-9555 Out-of-bounds Read vulnerability in Linux Kernel
The sctp_sf_ootb function in net/sctp/sm_statefuns.c in the Linux kernel before 4.8.8 lacks chunk-length checking for the first chunk, which allows remote attackers to cause a denial of service (out-of-bounds slab access) or possibly have unspecified other impact via crafted SCTP data.
network
low complexity
linux CWE-125
critical
9.8
2016-11-28 CVE-2016-9191 Improper Input Validation vulnerability in Linux Kernel
The cgroup offline implementation in the Linux kernel through 4.8.11 mishandles certain drain operations, which allows local users to cause a denial of service (system hang) by leveraging access to a container environment for executing a crafted application, as demonstrated by trinity.
local
low complexity
linux CWE-20
4.9
2016-11-28 CVE-2016-9178 Information Exposure vulnerability in Linux Kernel
The __get_user_asm_ex macro in arch/x86/include/asm/uaccess.h in the Linux kernel before 4.7.5 does not initialize a certain integer variable, which allows local users to obtain sensitive information from kernel stack memory by triggering failure of a get_user_ex call.
local
low complexity
linux CWE-200
2.1
2016-11-28 CVE-2016-9084 Integer Overflow or Wraparound vulnerability in Linux Kernel
drivers/vfio/pci/vfio_pci_intrs.c in the Linux kernel through 4.8.11 misuses the kzalloc function, which allows local users to cause a denial of service (integer overflow) or have unspecified other impact by leveraging access to a vfio PCI device file.
local
low complexity
linux CWE-190
4.6
2016-11-28 CVE-2016-9083 Integer Overflow or Wraparound vulnerability in Linux Kernel
drivers/vfio/pci/vfio_pci.c in the Linux kernel through 4.8.11 allows local users to bypass integer overflow checks, and cause a denial of service (memory corruption) or have unspecified other impact, by leveraging access to a vfio PCI device file for a VFIO_DEVICE_SET_IRQS ioctl call, aka a "state machine confusion bug."
local
low complexity
linux CWE-190
7.8
2016-11-28 CVE-2016-8650 Resource Management Errors vulnerability in Linux Kernel
The mpi_powm function in lib/mpi/mpi-pow.c in the Linux kernel through 4.8.11 does not ensure that memory is allocated for limb data, which allows local users to cause a denial of service (stack memory corruption and panic) via an add_key system call for an RSA key with a zero exponent.
local
low complexity
linux CWE-399
5.5
2016-11-28 CVE-2016-8646 NULL Pointer Dereference vulnerability in Linux Kernel
The hash_accept function in crypto/algif_hash.c in the Linux kernel before 4.3.6 allows local users to cause a denial of service (OOPS) by attempting to trigger use of in-kernel hash algorithms for a socket that has received zero bytes of data.
local
low complexity
linux CWE-476
5.5