Vulnerabilities > Linux > Linux Kernel > 4.2.8

DATE CVE VULNERABILITY TITLE RISK
2016-12-28 CVE-2016-9588 7PK - Errors vulnerability in Linux Kernel
arch/x86/kvm/vmx.c in the Linux kernel through 4.9 mismanages the #BP and #OF exceptions, which allows guest OS users to cause a denial of service (guest OS crash) by declining to handle an exception thrown by an L2 guest.
local
low complexity
linux CWE-388
5.5
2016-12-28 CVE-2016-9576 Use After Free vulnerability in Linux Kernel
The blk_rq_map_user_iov function in block/blk-map.c in the Linux kernel before 4.8.14 does not properly restrict the type of iterator, which allows local users to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging access to a /dev/sg device.
local
low complexity
linux CWE-416
7.8
2016-12-28 CVE-2016-6213 Resource Exhaustion vulnerability in Linux Kernel
fs/namespace.c in the Linux kernel before 4.9 does not restrict how many mounts may exist in a mount namespace, which allows local users to cause a denial of service (memory consumption and deadlock) via MS_BIND mount system calls, as demonstrated by a loop that triggers exponential growth in the number of mounts.
local
linux CWE-400
4.7
2016-12-08 CVE-2016-9120 Use After Free vulnerability in Linux Kernel
Race condition in the ion_ioctl function in drivers/staging/android/ion/ion.c in the Linux kernel before 4.6 allows local users to gain privileges or cause a denial of service (use-after-free) by calling ION_IOC_FREE on two CPUs at the same time.
local
low complexity
linux CWE-416
7.8
2016-12-08 CVE-2015-8966 Permissions, Privileges, and Access Controls vulnerability in Linux Kernel
arch/arm/kernel/sys_oabi-compat.c in the Linux kernel before 4.4 allows local users to gain privileges via a crafted (1) F_OFD_GETLK, (2) F_OFD_SETLK, or (3) F_OFD_SETLKW command in an fcntl64 system call.
local
low complexity
linux CWE-264
7.2
2016-12-08 CVE-2016-8655 Use After Free vulnerability in multiple products
Race condition in net/packet/af_packet.c in the Linux kernel through 4.8.12 allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging the CAP_NET_RAW capability to change a socket version, related to the packet_set_ring and packet_setsockopt functions.
local
low complexity
linux canonical CWE-416
7.8
2016-11-28 CVE-2016-9555 Out-of-bounds Read vulnerability in Linux Kernel
The sctp_sf_ootb function in net/sctp/sm_statefuns.c in the Linux kernel before 4.8.8 lacks chunk-length checking for the first chunk, which allows remote attackers to cause a denial of service (out-of-bounds slab access) or possibly have unspecified other impact via crafted SCTP data.
network
low complexity
linux CWE-125
critical
9.8
2016-11-28 CVE-2016-9191 Improper Input Validation vulnerability in Linux Kernel
The cgroup offline implementation in the Linux kernel through 4.8.11 mishandles certain drain operations, which allows local users to cause a denial of service (system hang) by leveraging access to a container environment for executing a crafted application, as demonstrated by trinity.
local
low complexity
linux CWE-20
4.9
2016-11-28 CVE-2016-9178 Information Exposure vulnerability in Linux Kernel
The __get_user_asm_ex macro in arch/x86/include/asm/uaccess.h in the Linux kernel before 4.7.5 does not initialize a certain integer variable, which allows local users to obtain sensitive information from kernel stack memory by triggering failure of a get_user_ex call.
local
low complexity
linux CWE-200
2.1
2016-11-28 CVE-2016-9084 Integer Overflow or Wraparound vulnerability in Linux Kernel
drivers/vfio/pci/vfio_pci_intrs.c in the Linux kernel through 4.8.11 misuses the kzalloc function, which allows local users to cause a denial of service (integer overflow) or have unspecified other impact by leveraging access to a vfio PCI device file.
local
low complexity
linux CWE-190
4.6