what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New
Showing 1 - 13 of 13 RSS Feed

CVE-2015-1593

Status Candidate

Overview

The stack randomization feature in the Linux kernel before 3.19.1 on 64-bit platforms uses incorrect data types for the results of bitwise left-shift operations, which makes it easier for attackers to bypass the ASLR protection mechanism by predicting the address of the top of the stack, related to the randomize_stack_top function in fs/binfmt_elf.c and the stack_maxrandom_size function in arch/x86/mm/mmap.c.

Related Files

Red Hat Security Advisory 2019-3517-01
Posted Nov 6, 2019
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2019-3517-01 - The kernel packages contain the Linux kernel, the core of any Linux operating system. Issues addressed include denial of service, heap overflow, information leakage, and use-after-free vulnerabilities.

tags | advisory, denial of service, overflow, kernel, vulnerability
systems | linux, redhat
advisories | CVE-2015-1593, CVE-2018-16884, CVE-2018-19854, CVE-2018-19985, CVE-2018-20169, CVE-2019-10126, CVE-2019-10207, CVE-2019-10638, CVE-2019-11599, CVE-2019-11833, CVE-2019-11884, CVE-2019-13233, CVE-2019-14821, CVE-2019-15916, CVE-2019-3459, CVE-2019-3460, CVE-2019-3874, CVE-2019-3882, CVE-2019-3900, CVE-2019-5489, CVE-2019-7222, CVE-2019-9506
SHA-256 | 03447a52c4980f374df664e7374cea8800a1174c9ab4df5eb1f470f7db1d6d0b
Red Hat Security Advisory 2015-1221-01
Posted Jul 16, 2015
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2015-1221-01 - The kernel packages contain the Linux kernel, the core of any Linux operating system. A NULL pointer dereference flaw was found in the way the Linux kernel's virtual console implementation handled reference counting when accessing pseudo-terminal device files. A local, unprivileged attacker could use this flaw to crash the system. It was found that the Linux kernel's ping socket implementation did not properly handle socket unhashing during spurious disconnects, which could lead to a use-after-free flaw. On x86-64 architecture systems, a local user able to create ping sockets could use this flaw to crash the system. On non-x86-64 architecture systems, a local user able to create ping sockets could use this flaw to escalate their privileges on the system.

tags | advisory, x86, kernel, local
systems | linux, redhat
advisories | CVE-2011-5321, CVE-2015-1593, CVE-2015-2830, CVE-2015-2922, CVE-2015-3636
SHA-256 | 8394d513775323a5411dce831989986059917715783fc2505ddab157a8940038
Red Hat Security Advisory 2015-1139-01
Posted Jun 23, 2015
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2015-1139-01 - The kernel-rt packages contain the Linux kernel, the core of any Linux operating system. It was found that the Linux kernel's implementation of vectored pipe read and write functionality did not take into account the I/O vectors that were already processed when retrying after a failed atomic access operation, potentially resulting in memory corruption due to an I/O vector array overrun. A local, unprivileged user could use this flaw to crash the system or, potentially, escalate their privileges on the system.

tags | advisory, overflow, kernel, local
systems | linux, redhat
advisories | CVE-2014-9420, CVE-2014-9529, CVE-2014-9584, CVE-2015-1573, CVE-2015-1593, CVE-2015-1805, CVE-2015-2830
SHA-256 | edf6a2a888e1f12e7dc662266281129cfaba312336e0fc5b027d706bd9acab86
Red Hat Security Advisory 2015-1137-01
Posted Jun 23, 2015
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2015-1137-01 - The kernel packages contain the Linux kernel, the core of any Linux operating system. It was found that the Linux kernel's implementation of vectored pipe read and write functionality did not take into account the I/O vectors that were already processed when retrying after a failed atomic access operation, potentially resulting in memory corruption due to an I/O vector array overrun. A local, unprivileged user could use this flaw to crash the system or, potentially, escalate their privileges on the system.

tags | advisory, overflow, kernel, local
systems | linux, redhat
advisories | CVE-2014-9420, CVE-2014-9529, CVE-2014-9584, CVE-2015-1573, CVE-2015-1593, CVE-2015-1805, CVE-2015-2830
SHA-256 | b0d41a4e75261540327de9609c7f84e2f2c54a7eabc27611a2cfb4708a7cd5fd
Red Hat Security Advisory 2015-1138-01
Posted Jun 23, 2015
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2015-1138-01 - The kernel-rt packages contain the Linux kernel, the core of any Linux operating system. It was found that the Linux kernel's implementation of vectored pipe read and write functionality did not take into account the I/O vectors that were already processed when retrying after a failed atomic access operation, potentially resulting in memory corruption due to an I/O vector array overrun. A local, unprivileged user could use this flaw to crash the system or, potentially, escalate their privileges on the system.

tags | advisory, overflow, kernel, local
systems | linux, redhat
advisories | CVE-2014-9420, CVE-2014-9529, CVE-2014-9584, CVE-2015-1573, CVE-2015-1593, CVE-2015-1805, CVE-2015-2830
SHA-256 | bc6b92e674b8c59bb4c70d6ba01e90053bbee07767a1b4dc571aa00572108c9e
Ubuntu Security Notice USN-2565-1
Posted Apr 9, 2015
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 2565-1 - An integer overflow was discovered in the stack randomization feature of the Linux kernel on 64 bit platforms. A local attacker could exploit this flaw to bypass the Address Space Layout Randomization (ASLR) protection mechanism. An information leak was discovered in the Linux Kernel's handling of userspace configuration of the link layer control (LLC). A local user could exploit this flaw to read data from other sysctl settings. Various other issues were also addressed.

tags | advisory, overflow, kernel, local
systems | linux, ubuntu
advisories | CVE-2015-1593, CVE-2015-2041, CVE-2015-2042
SHA-256 | 45367e0ecb6fdf13b6f707fbe0aa7b08eb00219f55533ddb3f943355617b7375
Ubuntu Security Notice USN-2564-1
Posted Apr 9, 2015
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 2564-1 - An integer overflow was discovered in the stack randomization feature of the Linux kernel on 64 bit platforms. A local attacker could exploit this flaw to bypass the Address Space Layout Randomization (ASLR) protection mechanism. An information leak was discovered in the Linux Kernel's handling of userspace configuration of the link layer control (LLC). A local user could exploit this flaw to read data from other sysctl settings. Various other issues were also addressed.

tags | advisory, overflow, kernel, local
systems | linux, ubuntu
advisories | CVE-2015-1593, CVE-2015-2041, CVE-2015-2042
SHA-256 | b4b5729a8b3105060a97d50bfcaf3b153c00ee7647386935333eed9d44313e11
Ubuntu Security Notice USN-2563-1
Posted Apr 9, 2015
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 2563-1 - Sun Baoliang discovered a use after free flaw in the Linux kernel's SCTP (Stream Control Transmission Protocol) subsystem during INIT collisions. A remote attacker could exploit this flaw to cause a denial of service (system crash) or potentially escalate their privileges on the system. Marcelo Leitner discovered a flaw in the Linux kernel's routing of packets to too many different dsts/too fast. A remote attacker can exploit this flaw to cause a denial of service (system crash). Various other issues were also addressed.

tags | advisory, remote, denial of service, kernel, protocol
systems | linux, ubuntu
advisories | CVE-2015-1421, CVE-2015-1465, CVE-2015-1593, CVE-2015-2041, CVE-2015-2042
SHA-256 | 5dafdca9ed571fcd6801dd6f0d5967baba32409d329a23f6e9674061e54eb37c
Ubuntu Security Notice USN-2560-1
Posted Apr 9, 2015
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 2560-1 - An integer overflow was discovered in the stack randomization feature of the Linux kernel on 64 bit platforms. A local attacker could exploit this flaw to bypass the Address Space Layout Randomization (ASLR) mitigation mechanism. An information leak was discovered in the Linux kernel's handling of userspace configuration of the link layer control (LLC). A local user could exploit this flaw to read data from other sysctl settings. Various other issues were also addressed.

tags | advisory, overflow, kernel, local
systems | linux, ubuntu
advisories | CVE-2015-1593, CVE-2015-2041, CVE-2015-2042
SHA-256 | 342f94cb1aabaa7a970f11ca1c034e73d616bd82981312d40732665c7748928b
Ubuntu Security Notice USN-2562-1
Posted Apr 9, 2015
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 2562-1 - Sun Baoliang discovered a use after free flaw in the Linux kernel's SCTP (Stream Control Transmission Protocol) subsystem during INIT collisions. A remote attacker could exploit this flaw to cause a denial of service (system crash) or potentially escalate their privileges on the system. Marcelo Leitner discovered a flaw in the Linux kernel's routing of packets to too many different dsts/too fast. A remote attacker can exploit this flaw to cause a denial of service (system crash). Various other issues were also addressed.

tags | advisory, remote, denial of service, kernel, protocol
systems | linux, ubuntu
advisories | CVE-2015-1421, CVE-2015-1465, CVE-2015-1593, CVE-2015-2041, CVE-2015-2042
SHA-256 | be127130c407df608bf557e516cba75d80dd022ba633f89a98b2e1cf1698a549
Ubuntu Security Notice USN-2561-1
Posted Apr 9, 2015
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 2561-1 - It was discovered that the Linux kernel's Infiniband subsystem did not properly sanitize its input parameters while registering memory regions from userspace. A local user could exploit this flaw to cause a denial of service (system crash) or to potentially gain administrative privileges. An integer overflow was discovered in the stack randomization feature of the Linux kernel on 64 bit platforms. A local attacker could exploit this flaw to bypass the Address Space Layout Randomization (ASLR) mitigation mechanism. Various other issues were also addressed.

tags | advisory, denial of service, overflow, kernel, local
systems | linux, ubuntu
advisories | CVE-2014-8159, CVE-2015-1593, CVE-2015-2041, CVE-2015-2042
SHA-256 | 8aef8dc5ce0c1d2950a6515a77b071d9261bb137d80010ab9989173c9845de2d
Debian Security Advisory 3170-1
Posted Feb 26, 2015
Authored by Debian | Site debian.org

Debian Linux Security Advisory 3170-1 - Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service, information leaks or privilege escalation.

tags | advisory, denial of service, kernel, vulnerability
systems | linux, debian
advisories | CVE-2013-7421, CVE-2014-7822, CVE-2014-8160, CVE-2014-8559, CVE-2014-9585, CVE-2014-9644, CVE-2014-9683, CVE-2015-0239, CVE-2015-1420, CVE-2015-1421, CVE-2015-1593
SHA-256 | bd8c99b2ab449bf19ff881a59d02a9213bd109f150a9ca0142efa66f7d734b69
Linux ASLR Improper Randomization
Posted Feb 16, 2015
Authored by Hector Marco

A bug in Linux ASLR implementation for versions prior to 3.19-rc3 has been found. The issue is that the stack for processes is not properly randomized on some 64 bit architectures due to an integer overflow.

tags | advisory, overflow
systems | linux
advisories | CVE-2015-1593
SHA-256 | 9890952521e3cd5f5015f68364d858db61068493b180f85994b13d9035ba96b2
Page 1 of 1
Back1Next

File Archive:

August 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    20 Files
  • 2
    Aug 2nd
    4 Files
  • 3
    Aug 3rd
    6 Files
  • 4
    Aug 4th
    55 Files
  • 5
    Aug 5th
    16 Files
  • 6
    Aug 6th
    0 Files
  • 7
    Aug 7th
    0 Files
  • 8
    Aug 8th
    13 Files
  • 9
    Aug 9th
    13 Files
  • 10
    Aug 10th
    34 Files
  • 11
    Aug 11th
    16 Files
  • 12
    Aug 12th
    5 Files
  • 13
    Aug 13th
    0 Files
  • 14
    Aug 14th
    0 Files
  • 15
    Aug 15th
    0 Files
  • 16
    Aug 16th
    0 Files
  • 17
    Aug 17th
    0 Files
  • 18
    Aug 18th
    0 Files
  • 19
    Aug 19th
    0 Files
  • 20
    Aug 20th
    0 Files
  • 21
    Aug 21st
    0 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close