Vulnerabilities > Linux > Linux Kernel > 4.2.7

DATE CVE VULNERABILITY TITLE RISK
2016-11-28 CVE-2016-9191 Improper Input Validation vulnerability in Linux Kernel
The cgroup offline implementation in the Linux kernel through 4.8.11 mishandles certain drain operations, which allows local users to cause a denial of service (system hang) by leveraging access to a container environment for executing a crafted application, as demonstrated by trinity.
local
low complexity
linux CWE-20
4.9
2016-11-28 CVE-2016-9178 Information Exposure vulnerability in Linux Kernel
The __get_user_asm_ex macro in arch/x86/include/asm/uaccess.h in the Linux kernel before 4.7.5 does not initialize a certain integer variable, which allows local users to obtain sensitive information from kernel stack memory by triggering failure of a get_user_ex call.
local
low complexity
linux CWE-200
2.1
2016-11-28 CVE-2016-9084 Integer Overflow or Wraparound vulnerability in Linux Kernel
drivers/vfio/pci/vfio_pci_intrs.c in the Linux kernel through 4.8.11 misuses the kzalloc function, which allows local users to cause a denial of service (integer overflow) or have unspecified other impact by leveraging access to a vfio PCI device file.
local
low complexity
linux CWE-190
4.6
2016-11-28 CVE-2016-9083 Integer Overflow or Wraparound vulnerability in Linux Kernel
drivers/vfio/pci/vfio_pci.c in the Linux kernel through 4.8.11 allows local users to bypass integer overflow checks, and cause a denial of service (memory corruption) or have unspecified other impact, by leveraging access to a vfio PCI device file for a VFIO_DEVICE_SET_IRQS ioctl call, aka a "state machine confusion bug."
local
low complexity
linux CWE-190
7.8
2016-11-28 CVE-2016-8650 Resource Management Errors vulnerability in Linux Kernel
The mpi_powm function in lib/mpi/mpi-pow.c in the Linux kernel through 4.8.11 does not ensure that memory is allocated for limb data, which allows local users to cause a denial of service (stack memory corruption and panic) via an add_key system call for an RSA key with a zero exponent.
local
low complexity
linux CWE-399
5.5
2016-11-28 CVE-2016-8646 NULL Pointer Dereference vulnerability in Linux Kernel
The hash_accept function in crypto/algif_hash.c in the Linux kernel before 4.3.6 allows local users to cause a denial of service (OOPS) by attempting to trigger use of in-kernel hash algorithms for a socket that has received zero bytes of data.
local
low complexity
linux CWE-476
5.5
2016-11-28 CVE-2016-8645 Improper Access Control vulnerability in Linux Kernel
The TCP stack in the Linux kernel before 4.8.10 mishandles skb truncation, which allows local users to cause a denial of service (system crash) via a crafted application that makes sendto system calls, related to net/ipv4/tcp_ipv4.c and net/ipv6/tcp_ipv6.c.
local
low complexity
linux CWE-284
5.5
2016-11-28 CVE-2016-8633 Improper Access Control vulnerability in Linux Kernel
drivers/firewire/net.c in the Linux kernel before 4.8.7, in certain unusual hardware configurations, allows remote attackers to execute arbitrary code via crafted fragmented packets.
low complexity
linux CWE-284
6.8
2016-11-28 CVE-2016-8632 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Linux Kernel
The tipc_msg_build function in net/tipc/msg.c in the Linux kernel through 4.8.11 does not validate the relationship between the minimum fragment length and the maximum packet size, which allows local users to gain privileges or cause a denial of service (heap-based buffer overflow) by leveraging the CAP_NET_ADMIN capability.
local
low complexity
linux CWE-119
7.8
2016-11-28 CVE-2016-8630 NULL Pointer Dereference vulnerability in Linux Kernel
The x86_decode_insn function in arch/x86/kvm/emulate.c in the Linux kernel before 4.8.7, when KVM is enabled, allows local users to cause a denial of service (host OS crash) via a certain use of a ModR/M byte in an undefined instruction.
local
low complexity
linux CWE-476
5.5