linux linux kernel 2.6.22.17 vulnerabilities and exploits

(subscribe to this query)

The utimensat system call (sys_utimensat) in Linux kernel 2.6.22 and other versions prior to 2.6.25.3 does not check file permissions when certain UTIME_NOW and UTIME_OMIT combinations are used, which allows local users to modify file times of arbitrary files, possibly leading to...

The tcp_sacktag_write_queue function in net/ipv4/tcp_input.c in Linux kernel 2.6.21 up to and including 2.6.23.7, and 2.6.24-rc up to and including 2.6.24-rc2, allows remote malicious users to cause a denial of service (crash) via crafted ACK responses that trigger a NULL pointer...

The generic_file_splice_write function in fs/splice.c in the Linux kernel prior to 2.6.19 does not properly strip setuid and setgid bits when there is a write to a file, which allows local users to gain the privileges of a different group, and obtain sensitive information or poss...

The do_splice_from function in fs/splice.c in the Linux kernel prior to 2.6.27 does not reject file descriptors that have the O_APPEND flag set, which allows local users to bypass append mode and make arbitrary changes to other locations in the file.

Race condition in the do_setlk function in fs/nfs/file.c in the Linux kernel prior to 2.6.26 allows local users to cause a denial of service (crash) via vectors resulting in an interrupted RPC call that leads to a stray FL_POSIX lock, related to improper handling of a race betwee...

sctp in Linux kernel prior to 2.6.25.18 allows remote malicious users to cause a denial of service (OOPS) via an INIT-ACK that states the peer does not support AUTH, which causes the sctp_process_init function to clean up active transports and triggers the OOPS when the T1-Init t...

The sctp_auth_ep_set_hmacs function in net/sctp/auth.c in the Stream Control Transmission Protocol (sctp) implementation in the Linux kernel prior to 2.6.26.4, when the SCTP-AUTH extension is enabled, does not verify that the identifier index is within the bounds established by S...

The sctp_getsockopt_hmac_ident function in net/sctp/socket.c in the Stream Control Transmission Protocol (sctp) implementation in the Linux kernel prior to 2.6.26.4, when the SCTP-AUTH extension is enabled, relies on an untrusted length value to limit copying of data from kernel ...

1 EDB exploit

The __scm_destroy function in net/core/scm.c in the Linux kernel 2.6.27.4, 2.6.26, and previous versions makes indirect recursive calls to itself through calls to the fput function, which allows local users to cause a denial of service (panic) via vectors related to sending an SC...

1 2 3 4 5 6 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook