Ruby: Arbitrary heap overread in strscan on 32 bit Ruby, patch included

ruby require 'strscan' x = 'x' 0x7FFFFFFE s = StringScanner.newx s.pos = 0x7FFFFFFD t = s.peek40000 t.eachbyte do |i| if i != 0 print i.chr end end Run: sh ./ruby r.rb | strings My output: @ ;@VTdBE...

Dynamic Instrumentation Tool Platform: DynamoRIO

Dynamic Instrumentation Tool Platform DynamoRIO is a runtime code manipulation system that supports code transformations on any part of a program, while it executes. DynamoRIO exports an interface for building dynamic tools for a wide variety of uses: program analysis and understanding, profiling...

Tor: potential memory corruption in or/buffers.c (particularly on 32 bit)

In or/buffer.s.c: c / Return the allocation size we'd like to use to hold target bytes. / static inline sizet preferredchunksizesizet target sizet sz = MINCHUNKALLOC; while CHUNKSIZEWITHALLOCsz include define FLEXIBLEARRAYMEMBER // define DEBUGCHUNKALLOC / A single chunk on a buffer. / typedef...

UAF vulnerability description-vulnerability warning-the black bar safety net

UAF Use After Freevulnerability is a memory corruption vulnerability,usually present in the browser. Recently,the browser's new version Added a series of controls,which also makes use of these vulnerabilities becomes more difficult. Nevertheless,they still seem to exist. This article mainly will ...

Microsoft Windows Kernel 'Win32k.sys' CVE-2016-3310 Local Privilege Escalation Vulnerability

Description Microsoft Windows is prone to a local privilege-escalation vulnerability that occurs in the Windows kernel. A local attacker can exploit this issue to execute arbitrary code in kernel mode with elevated privileges. Technologies Affected Microsoft Windows 10 Version 1607 for 32-bit...

Microsoft Windows Kernel 'Win32k.sys' CVE-2016-3311 Local Privilege Escalation Vulnerability

Description Microsoft Windows is prone to a local privilege-escalation vulnerability that occurs in the Windows kernel. A local attacker can exploit this issue to execute arbitrary code in kernel mode with elevated privileges. Technologies Affected Microsoft Windows 10 Version 1607 for 32-bit...

Dolby Audio X2 (DAX2) privilege escalation

A vulnerability has been identified with the file permissions for the Dolby DAX2 application programming interface API that could allow a local user to run files with system level privileges. Mitigation Strategy for Customers what you should do to protect yourself: Lenovo is currently working wit...

CVE-2016-6259

Xen 4.5.x through 4.7.x do not implement Supervisor Mode Access Prevention SMAP whitelisting in 32-bit exception and event delivery, which allows local 32-bit PV guest OS kernels to cause a denial of service hypervisor and VM crash by triggering a safety check...

CVE-2016-6259

Xen 4.5.x through 4.7.x do not implement Supervisor Mode Access Prevention SMAP whitelisting in 32-bit exception and event delivery, which allows local 32-bit PV guest OS kernels to cause a denial of service hypervisor and VM crash by triggering a safety check...

CVE-2016-6258

The PV pagetable code in arch/x86/mm.c in Xen 4.7.x and earlier allows local 32-bit PV guest OS administrators to gain host OS privileges by leveraging fast-paths for updating pagetable entries...

Design/Logic Flaw

Xen 4.5.x through 4.7.x do not implement Supervisor Mode Access Prevention SMAP whitelisting in 32-bit exception and event delivery, which allows local 32-bit PV guest OS kernels to cause a denial of service hypervisor and VM crash by triggering a safety check...

CVE-2016-6258

The PV pagetable code in arch/x86/mm.c in Xen 4.7.x and earlier allows local 32-bit PV guest OS administrators to gain host OS privileges by leveraging fast-paths for updating pagetable entries...

CVE-2016-6259

CVE-2016-6259 affects Xen 4.5.x–4.7.x where SMAP whitelisting is not implemented for 32-bit exception/event delivery. This enables local 32-bit PV guests to trigger a safety check that can crash the hypervisor or VMs (DoS). The root cause is missing Supervisor Mode Access Prevention whitelisting ...

CVE-2016-6259

Xen 4.5.x through 4.7.x do not implement Supervisor Mode Access Prevention SMAP whitelisting in 32-bit exception and event delivery, which allows local 32-bit PV guest OS kernels to cause a denial of service hypervisor and VM crash by triggering a safety check...

FreeBSD : xen-kernel -- x86: Missing SMAP whitelisting in 32-bit exception / event delivery (04cf89e3-5854-11e6-b334-002590263bf5)

The Xen Project reports : Supervisor Mode Access Prevention is a hardware feature designed to make an Operating System more robust, by raising a pagefault rather than accidentally following a pointer into userspace. However, legitimate accesses into userspace require whitelisting, and the excepti...

WebKit - TypedArray.fill Memory Corruption

WebKit - TypedArray.fill Memory Corruption length; unsigned begin = argumentClampedIndexFromStartOrEndexec, 1, length; unsigned end = argumentClampedIndexFromStartOrEndexec, 2, length, length; if end thisValue; if !thisObject-setRangeToValueexec, begin, end, valueToInsert return...

WebKit - TypedArray.fill Memory Corruption

length; unsigned begin = argumentClampedIndexFromStartOrEndexec, 1, length; unsigned end = argumentClampedIndexFromStartOrEndexec, 2, length, length; if end thisValue; if !thisObject-setRangeToValueexec, begin, end, valueToInsert return JSValue::encodejsUndefined; argumentClampedIndexFromStartOrE...

Xen Denial of Service Vulnerability (CNVD-2016-05534)

Xen is an open source virtual machine monitor product developed at the University of Cambridge in the United Kingdom. Xen has a denial-of-service vulnerability, which can be exploited by an attacker using a PV-mode x86 32-bit hardware platform to trigger a security check that will cause the VM...

x86: Missing SMAP whitelisting in 32-bit exception / event delivery

ISSUE DESCRIPTION Supervisor Mode Access Prevention is a hardware feature designed to make an Operating System more robust, by raising a pagefault rather than accidentally following a pointer into userspace. However, legitimate accesses into userspace require whitelisting, and the exception...

xen-kernel -- x86: Missing SMAP whitelisting in 32-bit exception / event delivery

The Xen Project reports: Supervisor Mode Access Prevention is a hardware feature designed to make an Operating System more robust, by raising a pagefault rather than accidentally following a pointer into userspace. However, legitimate accesses into userspace require whitelisting, and the exceptio...