x86 software interrupt injection mis-handled

ISSUE DESCRIPTION There are two closely-related bugs. When Xen emulates instructions which generate software interrupts it needs to perform a privilege check involving an IDT lookup. This check is sometimes erroneously conducted as if the IDT had the format for a 32-bit guest, when in fact it is ...

x86 task switch to VM86 mode mis-handled

ISSUE DESCRIPTION LDTR, just like TR, is purely a protected mode facility. Hence even when switching to a VM86 mode task, LDTR loading needs to follow protected mode semantics. This was violated by the code. IMPACT On SVM AMD hardware: a malicious unprivileged guest process can escalate its...

x86 null segments not always treated as unusable

ISSUE DESCRIPTION The Xen x86 emulator erroneously failed to consider the unusability of segments when performing memory accesses. The intended behaviour is as follows: The user data segment %ds, %es, %fs and %gs selectors may be NULL in 32-bit to prevent access. In 64-bit, NULL has a special...

xen-kernel -- x86 null segments not always treated as unusable

The Xen Project reports: The Xen x86 emulator erroneously failed to consider the unusability of segments when performing memory accesses. The intended behaviour is as follows: The user data segment %ds, %es, %fs and %gs selectors may be NULL in 32-bit to prevent access. In 64-bit, NULL has a...

Debian DLA-698-1 : qemu security update

Several vulnerabilities were discovered in qemu, a fast processor emulator. The Common Vulnerabilities and Exposures project identifies the following problems : CVE-2016-7909 Quick EmulatorQemu built with the AMD PC-Net II emulator support is vulnerable to an infinite loop issue. It could occur...

Debian DLA-689-1 : qemu-kvm security update

Multiple vulnerabilities have been discovered in qemu-kvm, a full virtualization solution on x86 hardware based on Quick EmulatorQemu. The Common Vulnerabilities and Exposures project identifies the following problems : CVE-2016-7909 Quick EmulatorQemu built with the AMD PC-Net II emulator suppor...

[SECURITY] [DLA 689-1] qemu-kvm security update

Package : qemu-kvm Version : 1.1.2+dfsg-6+deb7u18 CVE ID : CVE-2016-7909 CVE-2016-8909 CVE-2016-8910 Debian Bug : 839834 841950 841955 842455 842463 Multiple vulnerabilities have been discovered in qemu-kvm, a full virtualization solution on x86 hardware based on Quick EmulatorQemu. The Common...

openSUSE Security Update : Chromium (openSUSE-2016-1080)

Chromium was updated to 53.0.2785.101 to fix a number of security issues and bugs. The following vulnerabilities were fixed: boo996648 - CVE-2016-5147: Universal XSS in Blink. - CVE-2016-5148: Universal XSS in Blink. - CVE-2016-5149: Script injection in extensions. - CVE-2016-5150: Use after free...

Mac OS X 10.11.x < 10.11.5 Multiple Vulnerabilities

Binary data 9392.prm...

The vulnerability of the Mac OS X operating system allows a perpetrator to execute arbitrary code in privileged context or cause a service failure.

The vulnerability of the AMD subsystem in the Mac OS X operating system arises due to buffer overflow. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in privileged context, or trigger a service failure memory corruption through a specially created application...

The vulnerability of the Mac OS X operating system allows a perpetrator to gain access to protected information in the kernel’s memory.

The vulnerability of the AMD subsystem of the Mac OS X operating system is related to the lack of protection for system data. Exploiting this vulnerability allows a malicious actor, operating remotely, to gain access to protected information in the kernel’s memory through a specially created...

Apple OS X El Capitan AMD Arbitrary Code Execution Vulnerability

Apple OS X El Capitan is an operating system on Apple devices. A security vulnerability in AMD in Apple OS X El Capitan allows attackers to exploit the vulnerability to execute arbitrary code with kernel privileges...

CVE-2016-1792

The AMD subsystem in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service memory corruption via a crafted app...

Memory corruption

The AMD subsystem in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service memory corruption via a crafted app...

Memory corruption

The AMD subsystem in Apple OS X before 10.11.5 allows attackers to obtain sensitive kernel memory-layout information via a crafted app...

CVE-2016-1791

The AMD subsystem in Apple OS X before 10.11.5 allows attackers to obtain sensitive kernel memory-layout information via a crafted app...

CVE-2016-1792

CVE-2016-1792 affects OS X El Capitan (AMD subsystem). The vulnerability allows an attacker to execute arbitrary code with kernel privileges or cause a memory corruption issue via a crafted app. Apple’s security content for OS X El Capitan v10.11.5 (Security Update 2016-003) addresses this with a...

CVE-2016-1791

CVE-2016-1791 concerns the AMD subsystem in macOS OS X El Capitan . The vulnerability could allow an attacker to disclose sensitive information about the kernel memory layout via a crafted app, potentially aiding further exploitation. Apple’s security content indicates this was addressed in OS X ...

CVE-2016-1792

The AMD subsystem in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service memory corruption via a crafted app...

CVE-2016-1791: Exposure of Sensitive Information to an Unauthorized Actor

The AMD subsystem in Apple OS X before 10.11.5 allows attackers to obtain sensitive kernel memory-layout information via a crafted app...