Vulnerabilities > Linux > Linux Kernel > 3.9.1

DATE CVE VULNERABILITY TITLE RISK
2017-05-18 CVE-2017-9059 Improper Resource Shutdown or Release vulnerability in Linux Kernel
The NFSv4 implementation in the Linux kernel through 4.11.1 allows local users to cause a denial of service (resource consumption) by leveraging improper channel callback shutdown when unmounting an NFSv4 filesystem, aka a "module reference and kernel daemon" leak.
local
low complexity
linux CWE-404
5.5
2017-05-15 CVE-2017-7495 Information Exposure vulnerability in Linux Kernel
fs/ext4/inode.c in the Linux kernel before 4.6.2, when ext4 data=ordered mode is used, mishandles a needs-flushing-before-commit list, which allows local users to obtain sensitive information from other users' files in opportunistic circumstances by waiting for a hardware reset, creating a new file, making write system calls, and reading this file.
local
low complexity
linux CWE-200
5.5
2017-05-14 CVE-2017-7487 Use After Free vulnerability in multiple products
The ipxitf_ioctl function in net/ipx/af_ipx.c in the Linux kernel through 4.11.1 mishandles reference counts, which allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via a failed SIOCGIFADDR ioctl call for an IPX interface.
local
low complexity
linux debian CWE-416
7.8
2017-05-12 CVE-2017-8925 Improper Resource Shutdown or Release vulnerability in multiple products
The omninet_open function in drivers/usb/serial/omninet.c in the Linux kernel before 4.10.4 allows local users to cause a denial of service (tty exhaustion) by leveraging reference count mishandling.
local
low complexity
linux debian CWE-404
5.5
2017-05-12 CVE-2017-8924 Integer Underflow (Wrap or Wraparound) vulnerability in multiple products
The edge_bulk_in_callback function in drivers/usb/serial/io_ti.c in the Linux kernel before 4.10.4 allows local users to obtain sensitive information (in the dmesg ringbuffer and syslog) from uninitialized kernel memory by using a crafted USB device (posing as an io_ti USB serial device) to trigger an integer underflow.
low complexity
linux debian CWE-191
4.6
2017-05-11 CVE-2017-7472 Improper Resource Shutdown or Release vulnerability in Linux Kernel
The KEYS subsystem in the Linux kernel before 4.10.13 allows local users to cause a denial of service (memory consumption) via a series of KEY_REQKEY_DEFL_THREAD_KEYRING keyctl_set_reqkey_keyring calls.
local
low complexity
linux CWE-404
5.5
2017-05-10 CVE-2017-8890 Double Free vulnerability in multiple products
The inet_csk_clone_lock function in net/ipv4/inet_connection_sock.c in the Linux kernel through 4.10.15 allows attackers to cause a denial of service (double free) or possibly have unspecified other impact by leveraging use of the accept system call.
local
low complexity
linux debian CWE-415
7.8
2017-05-08 CVE-2017-8831 Out-of-bounds Read vulnerability in multiple products
The saa7164_bus_get function in drivers/media/pci/saa7164/saa7164-bus.c in the Linux kernel through 4.11.5 allows local users to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact by changing a certain sequence-number value, aka a "double fetch" vulnerability.
high complexity
linux canonical debian CWE-125
6.4
2017-04-28 CVE-2017-7895 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
The NFSv2 and NFSv3 server implementations in the Linux kernel through 4.10.13 lack certain checks for the end of a buffer, which allows remote attackers to trigger pointer-arithmetic errors or possibly have unspecified other impact via crafted requests, related to fs/nfsd/nfs3xdr.c and fs/nfsd/nfsxdr.c.
network
low complexity
linux debian CWE-119
critical
9.8
2017-04-24 CVE-2010-5321 Missing Release of Resource after Effective Lifetime vulnerability in Linux Kernel
Memory leak in drivers/media/video/videobuf-core.c in the videobuf subsystem in the Linux kernel 2.6.x through 4.x allows local users to cause a denial of service (memory consumption) by leveraging /dev/video access for a series of mmap calls that require new allocations, a different vulnerability than CVE-2007-6761.
low complexity
linux CWE-772
4.3