https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 06:56:10 +0000 https://vulnerability.circl.lu/vuln/cve-2023-0386 <p><strong>Affected:</strong> Kernel</p> <p>A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system.</p> <p><strong>Affected:</strong> Kernel</p> <p>A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system.</p> https://vulnerability.circl.lu/vuln/cve-2023-0386 https://vulnerability.circl.lu/vuln/lsn-0095-1 <p><strong>Affected:</strong> Ubuntu:Pro:18.04:LTS: linux-aws-5.4, Ubuntu:Pro:18.04:LTS: linux-azure-5.4, Ubuntu:Pro:18.04:LTS: linux-gcp-5.4, Ubuntu:Pro:18.04:LTS: linux-gke-5.4, Ubuntu:Pro:18.04:LTS: linux-gkeop-5.4, Ubuntu:Pro:18.04:LTS: linux-ibm-5.4, Ubuntu:Pro:18.04:LTS: linux-hwe-5.4, Ubuntu:Pro:20.04:LTS: linux-aws, Ubuntu:Pro:20.04:LTS: linux-aws-5.15, Ubuntu:Pro:20.04:LTS: linux-azure and 14 more</p> <p>It was discovered that the OverlayFS implementation in the Linux kernel did not properly handle copy up operation in some conditions. A local attacker could possibly use this to gain elevated privileges.(CVE-2023-0386)</p> <p>It was discovered that the Broadcom FullMAC USB WiFi driver in the Linux kernel did not properly perform data buffer size validation in some situations. A physically proximate attacker could use this to craft a malicious USB device that when inserted, could cause a denial of service (system crash) or possibly expose sensitive information.(CVE-2023-1380)</p> <p>It was discovered that a race condition existed in the io_uring subsystem in the Linux kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-2023-1872)</p> <p>Jean-Baptiste Cayrou discovered that the shiftfs file system in the Ubuntu Linux kernel contained a race condition when handling inode locking in some situations. A local attacker could use this to cause a denial of service (kernel deadlock).(CVE-2023-2612)</p> <p>Gwangun Jung discovered that the Quick Fair Queueing scheduler implementation in the Linux kernel contained an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-2023-31436)</p> <p>Patryk Sondej and Piotr Krysiuk discovered that a race condition existed in the netfilter subsystem of the Linux kernel…</p> <p><strong>Affected:</strong> Ubuntu:Pro:18.04:LTS: linux-aws-5.4, Ubuntu:Pro:18.04:LTS: linux-azure-5.4, Ubuntu:Pro:18.04:LTS: linux-gcp-5.4, Ubuntu:Pro:18.04:LTS: linux-gke-5.4, Ubuntu:Pro:18.04:LTS: linux-gkeop-5.4, Ubuntu:Pro:18.04:LTS: linux-ibm-5.4, Ubuntu:Pro:18.04:LTS: linux-hwe-5.4, Ubuntu:Pro:20.04:LTS: linux-aws, Ubuntu:Pro:20.04:LTS: linux-aws-5.15, Ubuntu:Pro:20.04:LTS: linux-azure and 14 more</p> <p>It was discovered that the OverlayFS implementation in the Linux kernel did not properly handle copy up operation in some conditions. A local attacker could possibly use this to gain elevated privileges.(CVE-2023-0386)</p> <p>It was discovered that the Broadcom FullMAC USB WiFi driver in the Linux kernel did not properly perform data buffer size validation in some situations. A physically proximate attacker could use this to craft a malicious USB device that when inserted, could cause a denial of service (system crash) or possibly expose sensitive information.(CVE-2023-1380)</p> <p>It was discovered that a race condition existed in the io_uring subsystem in the Linux kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-2023-1872)</p> <p>Jean-Baptiste Cayrou discovered that the shiftfs file system in the Ubuntu Linux kernel contained a race condition when handling inode locking in some situations. A local attacker could use this to cause a denial of service (kernel deadlock).(CVE-2023-2612)</p> <p>Gwangun Jung discovered that the Quick Fair Queueing scheduler implementation in the Linux kernel contained an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.(CVE-2023-31436)</p> <p>Patryk Sondej and Piotr Krysiuk discovered that a race condition existed in the netfilter subsystem of the Linux kernel…</p> https://vulnerability.circl.lu/vuln/lsn-0095-1