IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API
7.1Alta

CVE-2026-46333ptrace: slightly saner 'get_dumpable()' logic

Linux Linux; Red Hat NVIDIA for RHEL 10; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support Publicada: (hace 6 meses)

Descripción

In the Linux kernel, the following vulnerability has been resolved: ptrace: slightly saner 'get_dumpable()' logic The 'dumpability' of a task is fundamentally about the memory image of the task - the concept comes from whether it can core dump or not - and makes no sense when you don't have an associated mm. And almost all users do in fact use it only for the case where the task has a mm pointer. But we have one odd special case: ptrace_may_access() uses 'dumpable' to check various other things entirely independently of the MM (typically explicitly using flags like PTRACE_MODE_READ_FSCREDS). Including for threads that no longer have a VM (and maybe never did, like most kernel threads). It's not what this flag was designed for, but it is what it is. The ptrace code does check that the uid/gid matches, so you do have to be uid-0 to see kernel thread details, but this means that the traditional "drop capabilities" model doesn't make any difference for this all. Make it all make a *bit* more sense by saying that if you don't have a MM pointer, we'll use a cached "last dumpability" flag if the thread ever had a MM (it will be zero for kernel threads since it is never set), and require a proper CAP_SYS_PTRACE capability to override.

Debilidad (CWE): CWE-269

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

FabricanteProductoVersiones
debian debian linux 11.0
enterprise linux 8 —
enterprise linux nvidia 10 —
Linux Linux 3.16.52 – < 3.17, 4.4.40 – < 4.5, 4.8.16 – < 4.9, 4.9.1 – < 4.10
linux linux kernel 4.10 – < 5.10.256
openshift 4.20 —
Red Hat NVIDIA for RHEL 10 all versions
Red Hat Red Hat Enterprise Linux 10 all versions
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support all versions
Red Hat Red Hat Enterprise Linux 6 —
Red Hat Red Hat Enterprise Linux 7 —
Red Hat Red Hat Enterprise Linux 8 all versions
Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support all versions
Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On all versions
Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support all versions
Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service all versions
Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions all versions
Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service all versions
Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions all versions
Red Hat Red Hat Enterprise Linux 9 all versions
Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions all versions
Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions all versions
Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support all versions
Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions —
Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support all versions
Red Hat Red Hat OpenShift Container Platform 4 all versions
Red Hat Red Hat OpenShift Container Platform 4.20 all versions
rhel e4s 9.0 —
rhel e4s 9.2 —
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) V3.1.6
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) V3.1.6
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) V3.1.6
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) V3.1.6
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) V3.1.6

Referencias y parches

Coincidencias CPE (NVD) (14)
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* ≥ 3.16.52 < 3.17
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* ≥ 4.4.40 < 4.5
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* ≥ 4.8.16 < 4.9
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* ≥ 4.9.1 < 5.10.256
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* ≥ 5.11 < 5.15.207
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* ≥ 5.16 < 6.1.173
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* ≥ 6.2 < 6.6.139
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* ≥ 6.7 < 6.12.89
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* ≥ 6.13 < 6.18.31
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* ≥ 6.19 < 7.0.8
  • cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*
  • cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*
  • cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*
  • cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

CVE recientes del mismo producto — Debian

9.2Crítica
CVE-2026-111497 KEV

Out-of-Bounds Write in Google Brotli Decoder

Google Brotli; Siemens Calibre; Siemens Calibre ICE; Siemens Capital

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause …

83%EPSS
8.4Alta
CVE-2026-77118

Out-of-bounds write in GraphicsMagick PCD decoder

GraphicsMagick Group GraphicsMagick; Debian graphicsmagick; Fedora Project GraphicsMagick

A heap out-of-bounds write exists in the Photo CD (PCD) decoder of GraphicsMagick. In DecodeImage() (coders/pcd.c), the Huffman delta loop advances its output pointer with q++ after every decoded delta and never checks it against the end of the heap-allocated…

6.0Media
CVE-2026-12996
OpenVPN OpenVPN

A use-after-free in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry

3.7Baja
CVE-2026-56968
GNU GNU SASL

GNU SASL before 2.2.4 lacks sanitization of a short challenge in _gsasl_ntlm_client_step in the NTLM client, which could result in memory disclosure via a crafted server.

7.5Alta
CVE-2026-49975

Apache HTTP Server: mod_http2 denial of service

Apache Software Foundation Apache HTTP Server; Red Hat JBoss Core Services for RHEL 8; Red Hat JBoss Core Services on RHEL 7; Red Hat Red Hat Enterprise Linux 10

Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.

33%EPSS