arm: The cache may not be cleaned for newly allocated scrubbed pages

ISSUE DESCRIPTION On Arm, a guest is allowed to control whether memory access bypass the cache. This means that Xen needs to ensure that all writes such as the ones during scrubbing have reached memory before handing over the page to a guest. Unfortunately the operation to clean the cache happens...

HPE Apollo 70 Buffer Overflow Vulnerability (CNVD-2021-10575)

The HPE Apollo 70 system is an Arm-based platform that provides the density and scalability required for large HPC cluster deployments. A local buffer overflow vulnerability exists in the libifc.so webupdatecomponent function in the Baseboard Management Controller BMC firmware in HPE Apollo 70...

Microsoft Windows Installer Security Feature Issue Vulnerability

Microsoft Windows Installer is a component of the Windows operating system from Microsoft. It provides a standard basis for installing and uninstalling software. A security feature vulnerability exists in Microsoft Windows Installer. The following products and editions are affected: Windows 10...

Reverse Engineering Keys from Firmware. A how-to

TL;DR It is possible to reverse engineer keys from firmware with some tips: 1. Always looks for strings/constants. 2. Make guesses about the original source. 3. Find a function you can recognise and work backwards to identify other functions. 4. It helps if they use open-source code so you can cr...

OSV-2021-307 UNKNOWN READ in cpu_arm_exec_armeb

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30444 Crash type: UNKNOWN READ Crash state: cpuarmexecarmeb resumeallvcpusarmeb vmstartarmeb...

HPE Apollo 安全漏洞

The HPE Apollo 70 system is an Arm-based platform that provides the density and scalability required for large HPC cluster deployments. A local buffer overflow vulnerability exists in the libifc.so webstartflash function in the Baseboard Management Controller BMC firmware in HPE Apollo 70 version...

HPE Apollo 70 资源管理错误漏洞

The HPE Apollo 70 system is an Arm-based platform that delivers the density and scalability required for large HPC cluster deployments. A local buffer overflow vulnerability exists in the libifc.so webgetactivexcfg function in the Baseboard Management Controller BMC firmware in HPE Apollo 70...

glibc security and bug fix update

2.17-322.0.2 - merge RH el7 u9 errata patches with Oracle patches Review-exception: Simple merge - merge RH el7 u9 patches with Oracle patches Review-exception: Simple merge - Four patches to match 3rd patch bundle from Marvell - modify MIPS values in elf/elf.h - add sysdeps/aarch64/sys/ifunc.h -...

CVE-2021-20221

An out-of-bounds heap buffer access issue was found in the ARM Generic Interrupt Controller emulator of QEMU on aarch64 platform. The issue occurs because while writing an interrupt ID to the controller memory area, it is not masked to be 4 bits wide. It may lead to the said issue while updating...

Moderate: Red Hat Security Advisory: qemu-kvm-ma security update

An update for qemu-kvm-ma is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...

Updated glibc packages fix security vulnerability

Security fixes: - fix buffer overrun in EUC-KR conversion module bz 2497 CVE-2019-25013 - arm: CVE-2020-6096: Fix multiarch memcpy for negative length BZ 25620 - arm: CVE-2020-6096: fix memcpy and memmove for negative length BZ 25620 - iconv: Fix incorrect UCS4 inner loop bounds BZ 26923...

SUSE SLED15 / SLES15 Security Update : wavpack (SUSE-SU-2021:0186-1)

This update for wavpack fixes the following issues : Update to version 5.4.0 - CVE-2020-35738: Fixed an out-of-bounds write in WavpackPackSamples bsc1180414 - fixed: disable A32 asm code when building for Apple silicon - fixed: issues with Adobe-style floating-point WAV files - added:...

In-the-Wild Series: Android Post-Exploitation

This is part 5 of a 6-part series detailing a set of vulnerabilities found by Project Zero being exploited in the wild. To read the other parts of the series, see the introduction post. Posted by Maddie Stone, Project Zero A deep-dive into the implant used by a high-tier attacker against Android...

Microsoft Windows Kernel Security Vulnerability

Microsoft Windows Kernel is the kernel of the Windows operating system by Microsoft Corporation USA. A security vulnerability exists in the Microsoft Windows Kernel. The following products and editions are affected:Windows 10 Version 2004 for ARM64-based Systems,Windows 10 Version 2004 for 32-bit...

Huawei EulerOS: Security Advisory for libvirt (EulerOS-SA-2021-1045)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for libxml2 (EulerOS-SA-2021-1047)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for augeas (EulerOS-SA-2021-1042)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for perl-DBD-MySQL (EulerOS-SA-2021-1053)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS Virtualization for ARM 64 3.0.2.0 : libxml2 (EulerOS-SA-2021-1047)

According to the version of the libxml2 packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at...

EulerOS Virtualization for ARM 64 3.0.2.0 : xorg-x11-server (EulerOS-SA-2021-1048)

According to the versions of the xorg-x11-server packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - A flaw was found in X.Org Server before xorg-x11-server 1.20.9. An Out-Of-Bounds access in XkbSetNames functi...