QID 198709

The cgroups implementation in thelinux kernel did not properly restrict access to the cgroups v1release_agent feature.
The xen subsystem within the linux kernel didnot adequately limit the number of events driver domains (unprivileged pvbackends) could send to other guest vms.
The xen network backend driver in the linuxkernel did not adequately limit the amount of queued packets when a guestdid not process them.
The simulated networking device driver for the linuxkernel did not properly initialize memory in certain situations.
The marvell wifi-ex usb device driverin the linux kernel did not properly handle some error conditions.
The arm trusted execution environment (tee)subsystem in the linux kernel contained a race condition leading to a use-after-free vulnerability.
The phone network protocol (phonet) implementationin the linux kernel did not properly perform reference counting in someerror conditions.
The reliable datagram sockets (rds) protocolimplementation in the linux kernel did not properly deallocate memory insome error conditions.
The transparent inter-process communication(tipc) protocol implementation in the linux kernel contained a stack-basedbuffer overflow.
The kvm implementation for s390 systems in the linuxkernel did not properly prevent memory operations on pvm guests that werein non-protected mode.

A local attacker could use this to gainadministrative privileges.
An attacker in a driver domaincould use this to cause a denial of service in other guest vms.
An attacker in a guest vm can use this to cause adenial of service (excessive kernel memory consumption) in the networkbackend domain.
A localattacker could use this to expose sensitive information (kernel memory).
Aphysically proximate attacker could use this to cause a denial of service(system crash).
A local attacker could use this to cause a denialof service or possibly execute arbitrary code.
A local attacker could possibly use this to cause adenial of service (memory exhaustion).
A local attacker could possibly use this to cause adenial of service (memory exhaustion).
A remote attacker could use this to cause a denial ofservice (system crash) for systems that have a tipc bearer configured.
A local attacker could use this to obtainunauthorized memory write access.