GSD-2021-1002430 aio: fix use-after-free due to missing POLLFREE handling

aio: fix use-after-free due to missing POLLFREE handling This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.221 by commit...

QEMU heap buffer overflow vulnerability (CNVD-2021-00892)

QEMU is a set of simulation processors written by Fabrice Bellard and distributed with source code under the GPL license, widely used on the GNU/Linux platform. A heap buffer overflow vulnerability exists in iscsiaioioctlcb in block/iscsi.c in QEMU 4.1.0. An attacker can exploit this vulnerabilit...

SQL Injection Vulnerability in Ke Rong AIO Management System of Shenzhen Ke Rong Software Co.(CNVD-2020-59806)

Ke Rong AIO Management System is an enterprise management system developed by Ke Rong AIO Enterprises, which solves the personalized problems of upstream and downstream, cross-departmental, multi-functional, and changing needs of many enterprise customers in the process of informatization through...

SQL Injection Vulnerability in Ke Rong AIO Management System of Shenzhen Ke Rong Software Co.

Ke Rong AIO Management System is an enterprise management system developed by Ke Rong AIO Enterprises, which solves the personalized problems of upstream and downstream, cross-departmental, multi-functional, and changing needs of many enterprise customers in the process of informatization through...

kernel security and bug fix update

3.10.0-1127.18.2.OL7 - Oracle Linux certificates Ilya Okomin - Oracle Linux RHCK Module Signing Key was compiled into kernel [email protected] - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and shim-x64 setlease be called without ilock Jeff Layton...

aio-group.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1122470 Security Researcher kun-fly Helped patch 801 vulnerabilities Received 7 Coordinated Disclosure badges Received 44 recommendations , a holder of 7 badges for responsible and coordinated disclosure, found a security vulnerability affecting aio-group.com website and i...

PT-2020-6467

Name of the Vulnerable Software and Affected Versions QEMU version 4.1.0 Description The issue is related to a heap-based buffer over-read in the iscsi aio ioctl cb function in the block/iscsi.c file. This may disclose unrelated information from process memory to an attacker. The vulnerability is...

CVE-2019-1020016

ASH-AIO before 2.0.0.3 allows an open redirect...

CVE-2019-1020016

ASH-AIO before 2.0.0.3 allows an open redirect...

Open redirect

ASH-AIO before 2.0.0.3 allows an open redirect...

CVE-2019-1020016

ASH-AIO before 2.0.0.3 allows an open redirect...

CVE-2019-1020016

CVE-2019-1020016 affects ASH-AIO, specifically versions before 2.0.0.3, and is described as an open redirect vulnerability. The connected sources consistently identify the issue as an open redirect but do not provide exploit details or a confirmed remediation within the supplied documents. There ...

OracleVM 3.4 : Unbreakable / etc (OVMSA-2019-0015)

The remote OracleVM system is missing necessary patches to address critical security updates : - x86/apic: Make archsetuphwirq NUMA node aware Henry Willard Orabug: 29534769 - KEYS: encrypted: fix buffer overread in validmasterdesc Eric Biggers Orabug: 29591025 CVE-2017-13305 - scsi: target: remo...

Denial Of Service (DoS)

The kernel-rt packages contain the Linux kernel, the core of any Linux operating system. A flaw was found in the way the Linux kernel's futex subsystem handled the requeuing of certain Priority Inheritance PI futexes. A local, unprivileged user could use this flaw to escalate their privileges on...

Denial Of Service (DoS)

The kernel-rt packages contain the Linux kernel, the core of any Linux operating system. A flaw was found in the way the Linux kernel's futex subsystem handled the requeuing of certain Priority Inheritance PI futexes. A local, unprivileged user could use this flaw to escalate their privileges on...

Information Disclosure

The kernel-rt packages contain the Linux kernel, the core of any Linux operating system. A flaw was found in the way the Linux kernel's futex subsystem handled the requeuing of certain Priority Inheritance PI futexes. A local, unprivileged user could use this flaw to escalate their privileges on...

Linux - (page->_refcount) Overflow via FUSE Exploit

Linux: page-refcount overflow via FUSE with 140GiB RAM usage Tested on: Debian Buster distro kernel "4.19.0-1-amd64 1 SMP Debian 4.19.12-1 2018-12-22" KVM guest with 160000MiB RAM A while back, there was some discussion about possible overflows of the mapcount in struct page, started by Daniel...

Linux kernel code injection vulnerability

Linux kernel is the kernel used by Linux, the open source operating system released by the Linux Foundation in the United States. A security vulnerability exists in the 'aiopoll' function in the fs/aio.c file in Linux kernel 5.0.4 and earlier versions. No details of the vulnerability are provided...

Denial Of Service (DoS)

Linux kernel is vulnerable to denial of service. The AIO interface permitted reading or writing 2 GB of data or more in a single chunk, which could lead to an integer overflow in the aiosetupsinglevector function in fs/aio.c when applied to certain filesystems, socket or device types...

Denial Of Service (DoS)

kernel is vulnerable to denial of service DoS attacks. The vulnerability exists as an integer overflow in fs/aio.c in the Linux kernel before 3.4.1 allows local users to cause a denial of service or possibly have unspecified other impact via a large AIO iovec...