QID 198731

The bpf verifier in the linux kernel did notproperly restrict pointer types in certain situations.
The network traffic control implementation in thelinux kernel contained a use-after-free vulnerability.
The cgroups implementation in thelinux kernel did not properly restrict access to the cgroups v1release_agent feature.
The xen subsystem within the linux kernel didnot adequately limit the number of events driver domains (unprivileged pvbackends) could send to other guest vms.
The xen network backend driver in the linuxkernel did not adequately limit the amount of queued packets when a guestdid not process them.
The usb gadget subsystem in the linuxkernel did not properly restrict the size of control requests for certaingadget types, leading to possible out of bounds reads or writes.
A race condition existed in the poll implementationin the linux kernel, resulting in a use-after-free vulnerability.
The simulated networking device driver for the linuxkernel did not properly initialize memory in certain situations.
The cgroup process migration implementationin the linux kernel did not perform permission checks correctly in somesituations.
The aquantia aqtion ethernet devicedriver in the linux kernel did not properly validate meta-data coming fromthe device.
The arm trusted execution environment (tee)subsystem in the linux kernel contained a race condition leading to a use-after-free vulnerability.
The phone network protocol (phonet) implementationin the linux kernel did not properly perform reference counting in someerror conditions.
The ebpf verifier in the linux kernel did notproperly perform bounds checking on mov32 operations.
The reliable datagram sockets (rds) protocolimplementation in the linux kernel did not properly deallocate memory insome error conditions.
The bpf subsystem in the linux kernel did notproperly track pointer types on atomic fetch operations in some situations.
The tipc protocol implementation in the linux kerneldid not properly initialize memory in some situations.
The transparent inter-process communication(tipc) protocol implementation in the linux kernel contained a stack-basedbuffer overflow.
The kvm implementation for s390 systems in the linuxkernel did not properly prevent memory operations on pvm guests that werein non-protected mode.
The icmpv6 implementation in the linux kernel didnot properly deallocate memory in certain situations.
The ipsec implementation in the linux kernel did notproperly allocate enough memory when performing esp transformations,leading to a heap-based buffer overflow.

A local attackercould use this to cause a denial of service (system crash) or possiblyexecute arbitrary code.
A local attackercould use this to cause a denial of service (system crash) or possiblyexecute arbitrary code.
A local attacker could use this to gainadministrative privileges.
An attacker in a driver domaincould use this to cause a denial of service in other guest vms.
An attacker in a guest vm can use this to cause adenial of service (excessive kernel memory consumption) in the networkbackend domain.
A localattacker could use this to cause a denial of service (system crash) orpossibly execute arbitrary code.
A localattacker could use this to cause a denial of service (system crash) orpossibly execute arbitrary code.
A localattacker could use this to expose sensitive information (kernel memory).
A local attacker could possibly use this to gain administrativeprivileges.
A local attacker who can control an emulated device can usethis to cause a denial of service (system crash) or possibly executearbitrary code.
A local attacker could use this to cause a denialof service or possibly execute arbitrary code.
A local attacker could possibly use this to cause adenial of service (memory exhaustion).
A local attackercould use this to expose sensitive information (kernel pointer addresses).
A local attacker could possibly use this to cause adenial of service (memory exhaustion).
A local attacker could use this to expose sensitive information (kernelpointer addresses).
A local attackercould use this to expose sensitive information (kernel memory).
A remote attacker could use this to cause a denial ofservice (system crash) for systems that have a tipc bearer configured.
A local attacker could use this to obtainunauthorized memory write access.
A remote attackercould possibly use this to cause a denial of service (memory exhaustion).
A local attacker could use this tocause a denial of service (system crash) or possibly execute arbitrarycode.