IBM AIX Privilege Permission and Access Control Issue Vulnerability (CNVD-2022-03206)

IBM AIX is an open standards-based UNIX operating system developed by IBM for the IBM Power architecture. IBM AIX is vulnerable to privilege licensing and access control issues, which stem from the fact that the vulnerability exists due to a mount command error. A local user can execute arbitrary...

CVE-2021-38990

CVE-2021-38990 affects IBM AIX 7.1, 7.2, and VIOS 3.1 where a vulnerability in the mount command can be exploited by a non-privileged local user to achieve code execution. Root cause is related to the mount utility; affected filesets are bos.rte.filesystem (AIX TLs 7.1.5.x, 7.2.4.x, 7.2.5.x) and ...

CVE-2021-38990

IBM AIX 7.1, 7.2, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the mount command which could lead to code execution. IBM X-Force ID: 212952...

Vulnerability fixed in IBM AIX

IBM has fixed a vulnerability in AIX. A local malicious party can, through manipulation of the mount command execute arbitrary code, possibly with elevated privileges up to root privileges. IBM has released updates to fix the vulnerability in AIX v 7.1 and 7.2. For more information, see:...

AIX (IJ35826)

The version of AIX installed on the remote host is prior to APAR IJ35826. It is, therefore, affected by a vulnerability as referenced in the IJ35826 advisory. - IBM AIX 7.1, 7.2, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the mount command which could lead ...

AIX (IJ35620)

The version of AIX installed on the remote host is prior to APAR IJ35620. It is, therefore, affected by a vulnerability as referenced in the IJ35620 advisory. - IBM AIX 7.1, 7.2, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the mount command which could lead ...

There is a vulnerability in the mount command that affects AIX.,There is a vulnerability in the mount command that affects VIOS.

IBM SECURITY ADVISORY First Issued: Thu Jan 6 09:30:39 CST 2022 The most recent version of this document is available here: http://aix.software.ibm.com/aix/efixes/security/mountadvisory.asc https://aix.software.ibm.com/aix/efixes/security/mountadvisory.asc...

IBM AIX 权限许可和访问控制问题漏洞

IBM AIX is an open standards-based UNIX operating system developed by IBM for the IBM Power architecture. IBM AIX is vulnerable to privilege licensing and access control issues, which stem from the fact that the vulnerability exists due to a mount command error. A local user can execute arbitrary...

Design/Logic Flaw

containerd is an open source container runtime. On installations using SELinux, such as EL8 CentOS, RHEL, Fedora, or SUSE MicroOS, with containerd since v1.5.0-beta.0 as the backing container runtime interface CRI, an unprivileged pod scheduled to the node may bind mount, via hostPath volume, any...

PT-2022-11912

Name of the Vulnerable Software and Affected Versions: containerd versions 1.5.0-beta.0 through 1.5.8 Description: The issue affects installations using SELinux, such as EL8 CentOS, RHEL, Fedora, or SUSE MicroOS, with containerd as the backing container runtime interface CRI. An unprivileged pod...

PT-2021-8070 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to the finish mount kattr function in the Linux kernel's mount kattr component. It is caused by an error in the function's operation, which can lead to leaking...

OPENSUSE-SU-2021:1625-1 Security update for runc

This update for runc fixes the following issues: Update to runc v1.0.3. CVE-2021-43784: Fixed a potential vulnerability related to the internal usage of netlink, which is believed to not be exploitable with any released versions of runc bsc1193436 Fixed inability to start a container with...

Security update for runc (moderate)

openSUSE Security Update: Security update for runc Announcement ID: openSUSE-SU-2021:1625-1 Rating: moderate References: 1193436 Cross-References: CVE-2021-43784 CVSS scores: CVE-2021-43784 NVD : 6 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L Affected Products: openSUSE Leap 15.2 An update that...

OPENSUSE-SU-2021:4171-1 Security update for runc

This update for runc fixes the following issues: Update to runc v1.0.3. CVE-2021-43784: Fixed a potential vulnerability related to the internal usage of netlink, which is believed to not be exploitable with any released versions of runc bsc1193436 Fixed inability to start a container with...

Security update for runc (moderate)

openSUSE Security Update: Security update for runc Announcement ID: openSUSE-SU-2021:4171-1 Rating: moderate References: 1193436 Cross-References: CVE-2021-43784 CVSS scores: CVE-2021-43784 NVD : 6 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L Affected Products: openSUSE Leap 15.3 An update that...

CLSA-2021-1639681613 Fix CVE(s): CVE-2021-2388

Fix CVE-2021-2388 OpenJDK: Incorrect comparison during range check elimination Add JDK-8165323.diff: fs Files.getFileStore fails with "Mount point not found" in chroot environment...

In NTFS-3G versions < 2021.8.22 when a specially crafted NTFS attribute is supplied to the function ntfs_get_attribute_value a heap buffer overflow can occur allowing for memory disclosure or denial of service. The vulnerability is caused by an out-of-bound buffer access which can be triggered by mounting a crafted ntfs partition. The root cause is a missing consistency check after reading an MFT record : the "bytes_in_use" field should be less than the "bytes_allocated" field. When it is not the parsing of the records proceeds into the wild.

...

Google Android 安全漏洞

Google Android is a Linux-based open source operating system from Google Inc. in the United States. A security vulnerability in the vold incremental-fs APIs of Google Android could cause systemserver to trigger a mount on a directory that should not be under the control of systemserver...

PT-2021-24000 · Hashicorp · Hashicorp Vault +1

Name of the Vulnerable Software and Affected Versions: HashiCorp Vault and Vault Enterprise versions 0.11.0 through 1.7.5 HashiCorp Vault and Vault Enterprise version 1.8.4 Description: The issue arises when templated ACL policies in HashiCorp Vault and Vault Enterprise match the first-created...

Vault's Templated ACL Policies Matched First-Created Alias Per Entity and Auth Backend

Summary Vault and Vault Enterprise “Vault” templated ACL policies would always match the first-created entity alias if multiple entity aliases existed for a specified entity and mount combination, potentially resulting in incorrect policy enforcement. This vulnerability, CVE-2021-43998, was fixed...