Dan Carpenter

19 exploits Active since Nov 2013
CVE-2016-8636 WRITEUP HIGH WRITEUP
Linux kernel <4.9.10 - Memory Corruption
Integer overflow in the mem_check_range function in drivers/infiniband/sw/rxe/rxe_mr.c in the Linux kernel before 4.9.10 allows local users to cause a denial of service (memory corruption), obtain sensitive information from kernel memory, or possibly have unspecified other impact via a write or read request involving the "RDMA protocol over infiniband" (aka Soft RoCE) technology.
CVSS 7.8
CVE-2017-8797 WRITEUP HIGH WRITEUP
Linux Kernel < 4.11.3 - Denial of Service via NFSv4 pNFS GETDEVICEINFO or LAYOUTGET Operand
The NFSv4 server in the Linux kernel before 4.11.3 does not properly validate the layout type when processing the NFSv4 pNFS GETDEVICEINFO or LAYOUTGET operand in a UDP packet from a remote attacker. This type value is uninitialized upon encountering certain error conditions. This value is used as an array index for dereferencing, which leads to an OOPS and eventually a DoS of knfsd and a soft-lockup of the whole system.
CVSS 7.5
CVE-2012-6703 WRITEUP HIGH WRITEUP
Linux Kernel 3.3-3.6 - Integer Overflow in ALSA Compress Offload Buffer Allocation
Integer overflow in the snd_compr_allocate_buffer function in sound/core/compress_offload.c in the ALSA subsystem in the Linux kernel before 3.6-rc6-next-20120917 allows local users to cause a denial of service (insufficient memory allocation) or possibly have unspecified other impact via a crafted SNDRV_COMPRESS_SET_PARAMS ioctl call.
CVSS 7.8
CVE-2013-4512 WRITEUP WRITEUP
Linux kernel <3.12 - Buffer Overflow
Buffer overflow in the exitcode_proc_write function in arch/um/kernel/exitcode.c in the Linux kernel before 3.12 allows local users to cause a denial of service or possibly have unspecified other impact by leveraging root privileges for a write operation.
CVE-2013-4513 WRITEUP WRITEUP
Linux kernel <3.12 - Buffer Overflow
Buffer overflow in the oz_cdev_write function in drivers/staging/ozwpan/ozcdev.c in the Linux kernel before 3.12 allows local users to cause a denial of service or possibly have unspecified other impact via a crafted write operation.
CVE-2013-4514 WRITEUP WRITEUP
Linux kernel <3.12 - Buffer Overflow
Multiple buffer overflows in drivers/staging/wlags49_h2/wl_priv.c in the Linux kernel before 3.12 allow local users to cause a denial of service or possibly have unspecified other impact by leveraging the CAP_NET_ADMIN capability and providing a long station-name string, related to the (1) wvlan_uil_put_info and (2) wvlan_set_station_nickname functions.
CVE-2013-4515 WRITEUP WRITEUP
Linux kernel <3.12 - Info Disclosure
The bcm_char_ioctl function in drivers/staging/bcm/Bcmchar.c in the Linux kernel before 3.12 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory via an IOCTL_BCM_GET_DEVICE_DRIVER_INFO ioctl call.
CVE-2013-4516 WRITEUP WRITEUP
Linux kernel <3.12 - Info Disclosure
The mp_get_count function in drivers/staging/sb105x/sb_pci_mp.c in the Linux kernel before 3.12 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via a TIOCGICOUNT ioctl call.
CVE-2015-4036 WRITEUP WRITEUP
Linux Kernel < 4.0 - Memory Corruption via VHOST_SCSI_SET_ENDPOINT ioctl
Array index error in the tcm_vhost_make_tpg function in drivers/vhost/scsi.c in the Linux kernel before 4.0 might allow guest OS users to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted VHOST_SCSI_SET_ENDPOINT ioctl call. NOTE: the affected function was renamed to vhost_scsi_make_tpg before the vulnerability was announced.
CVE-2016-7425 WRITEUP HIGH WRITEUP
Linux Kernel < 3.2.84 - Local Privilege Escalation via ARCMSR_MESSAGE_WRITE_WQBUFFER Buffer Overflow
The arcmsr_iop_message_xfer function in drivers/scsi/arcmsr/arcmsr_hba.c in the Linux kernel through 4.8.2 does not restrict a certain length field, which allows local users to gain privileges or cause a denial of service (heap-based buffer overflow) via an ARCMSR_MESSAGE_WRITE_WQBUFFER control code.
CVSS 7.8
CVE-2017-7487 WRITEUP HIGH WRITEUP
Linux kernel <4.11.1 - Use After Free
The ipxitf_ioctl function in net/ipx/af_ipx.c in the Linux kernel through 4.11.1 mishandles reference counts, which allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via a failed SIOCGIFADDR ioctl call for an IPX interface.
CVSS 7.8
CVE-2018-10940 WRITEUP MEDIUM WRITEUP
Linux Kernel < 4.16.6 - Local Memory Read via CDROM_MEDIA_CHANGED ioctl
The cdrom_ioctl_media_changed function in drivers/cdrom/cdrom.c in the Linux kernel before 4.16.6 allows local attackers to use a incorrect bounds check in the CDROM driver CDROM_MEDIA_CHANGED ioctl to read out kernel memory.
CVSS 5.5
CVE-2019-16714 WRITEUP HIGH WRITEUP
Linux kernel <5.2.14 - Info Disclosure
In the Linux kernel before 5.2.14, rds6_inc_info_copy in net/rds/recv.c allows attackers to obtain sensitive information from kernel stack memory because tos and flags fields are not initialized.
CVSS 7.5
CVE-2020-12652 WRITEUP MEDIUM WRITEUP
Linux kernel <5.4.14 - Privilege Escalation
The __mptctl_ioctl function in drivers/message/fusion/mptctl.c in the Linux kernel before 5.4.14 allows local users to hold an incorrect lock during the ioctl operation and trigger a race condition, i.e., a "double fetch" vulnerability, aka CID-28d76df18f0a. NOTE: the vendor states "The security impact of this bug is not as bad as it could have been because these operations are all privileged and root already has enormous destructive power."
CVSS 4.1
CVE-2021-3744 WRITEUP MEDIUM WRITEUP
Linux Kernel < 5.15 - Use-After-Free in ccp_run_aes_gcm_cmd
A memory leak flaw was found in the Linux kernel in the ccp_run_aes_gcm_cmd() function in drivers/crypto/ccp/ccp-ops.c, which allows attackers to cause a denial of service (memory consumption). This vulnerability is similar with the older CVE-2019-18808.
CVSS 5.5
CVE-2021-3764 WRITEUP MEDIUM WRITEUP
Linux Kernel < 5.14.20 - Memory Leak in ccp_run_aes_gcm_cmd
A memory leak flaw was found in the Linux kernel's ccp_run_aes_gcm_cmd() function that allows an attacker to cause a denial of service. The vulnerability is similar to the older CVE-2019-18808. The highest threat from this vulnerability is to system availability.
CVSS 5.5
CVE-2022-3077 WRITEUP MEDIUM WRITEUP
Linux kernel Intel's iSMT SMBus host controller - Buffer Overflow
A buffer overflow vulnerability was found in the Linux kernel Intel’s iSMT SMBus host controller driver in the way it handled the I2C_SMBUS_BLOCK_PROC_CALL case (via the ioctl I2C_SMBUS) with malicious input data. This flaw could allow a local user to crash the system.
CVSS 5.5
CVE-2022-3170 WRITEUP HIGH WRITEUP
Linux Kernel - Out-of-bounds Read via Sound Subsystem ioctl Interface
An out-of-bounds access issue was found in the Linux kernel sound subsystem. It could occur when the 'id->name' provided by the user did not end with '\0'. A privileged local user could pass a specially crafted name through ioctl() interface and crash the system or potentially escalate their privileges on the system.
CVSS 7.8
CVE-2024-0607 WRITEUP MEDIUM WRITEUP
Linux Kernel < 6.7 - Denial of Service via Netfilter nft_byteorder_eval Buffer Overwrite
A flaw was found in the Netfilter subsystem in the Linux kernel. The issue is in the nft_byteorder_eval() function, where the code iterates through a loop and writes to the `dst` array. On each iteration, 8 bytes are written, but `dst` is an array of u32, so each element only has space for 4 bytes. That means every iteration overwrites part of the previous element corrupting this array of u32. This flaw allows a local user to cause a denial of service or potentially break NetFilter functionality.
CVSS 6.6