missed flush in XSA-321 backport

ISSUE DESCRIPTION An oversight was made when backporting XSA-321, leading entries in the IOMMU not being properly updated under certain circumstances. IMPACT A malicious guest may be able to retain read/write DMA access to frames returned to Xen's free pool, and later reused for another purpose...

Stack overflow

A stack-based buffer overflow vulnerability has been reported to affect QNAP NAS devices running Surveillance Station. If exploited, this vulnerability allows attackers to execute arbitrary code. QNAP have already fixed this vulnerability in the following versions: Surveillance Station 5.1.5.4.3...

ALPINE-CVE-2021-26933

An issue was discovered in Xen 4.9 through 4.14.x. On Arm, a guest is allowed to control whether memory accesses are bypassing the cache. This means that Xen needs to ensure that all writes such as the ones during scrubbing have reached the memory before handing over the page to a guest...

DEBIAN-CVE-2021-26933

An issue was discovered in Xen 4.9 through 4.14.x. On Arm, a guest is allowed to control whether memory accesses are bypassing the cache. This means that Xen needs to ensure that all writes such as the ones during scrubbing have reached the memory before handing over the page to a guest...

CVE-2021-26933

An issue was discovered in Xen 4.9 through 4.14.x. On Arm, a guest is allowed to control whether memory accesses are bypassing the cache. This means that Xen needs to ensure that all writes such as the ones during scrubbing have reached the memory before handing over the page to a guest...

CVE-2021-26933

An issue was discovered in Xen 4.9 through 4.14.x. On Arm, a guest is allowed to control whether memory accesses are bypassing the cache. This means that Xen needs to ensure that all writes such as the ones during scrubbing have reached the memory before handing over the page to a guest...

CVE-2021-26933

An issue was discovered in Xen 4.9 through 4.14.x. On Arm, a guest is allowed to control whether memory accesses are bypassing the cache. This means that Xen needs to ensure that all writes such as the ones during scrubbing have reached the memory before handing over the page to a guest...

UBUNTU-CVE-2021-26933

An issue was discovered in Xen 4.9 through 4.14.x. On Arm, a guest is allowed to control whether memory accesses are bypassing the cache. This means that Xen needs to ensure that all writes such as the ones during scrubbing have reached the memory before handing over the page to a guest...

CVE-2021-26933

An issue was discovered in Xen 4.9 through 4.14.x. On Arm, a guest is allowed to control whether memory accesses are bypassing the cache. This means that Xen needs to ensure that all writes such as the ones during scrubbing have reached the memory before handing over the page to a guest...

CVE-2021-26933

CVE-2021-26933 affects the Xen hypervisor (Xen 4.9–4.14.x) on ARM: a guest can influence cache-bypass behavior, and cache-cleaning may occur before scrub verification, so there is no guarantee that all writes have reached memory before handing the page to the guest. The practical consequence is p...

CVE-2021-26933

An issue was discovered in Xen 4.9 through 4.14.x. On Arm, a guest is allowed to control whether memory accesses are bypassing the cache. This means that Xen needs to ensure that all writes such as the ones during scrubbing have reached the memory before handing over the page to a guest...

CVE-2021-26933

An issue was discovered in Xen 4.9 through 4.14.x. On Arm, a guest is allowed to control whether memory accesses are bypassing the cache. This means that Xen needs to ensure that all writes such as the ones during scrubbing have reached the memory before handing over the page to a guest...

Linux: grant mapping error handling issues

ISSUE DESCRIPTION Grant mapping operations often occur in batch hypercalls, where a number of operations are done in a single hypercall, the success or failure of each one reported to the backend driver, and the backend driver then loops over the results, performing follow-up actions based on the...

arm: The cache may not be cleaned for newly allocated scrubbed pages

ISSUE DESCRIPTION On Arm, a guest is allowed to control whether memory access bypass the cache. This means that Xen needs to ensure that all writes such as the ones during scrubbing have reached memory before handing over the page to a guest. Unfortunately the operation to clean the cache happens...

HPE Apollo 70 Buffer Overflow Vulnerability (CNVD-2021-10575)

The HPE Apollo 70 system is an Arm-based platform that provides the density and scalability required for large HPC cluster deployments. A local buffer overflow vulnerability exists in the libifc.so webupdatecomponent function in the Baseboard Management Controller BMC firmware in HPE Apollo 70...

Microsoft Windows Installer Security Feature Issue Vulnerability

Microsoft Windows Installer is a component of the Windows operating system from Microsoft. It provides a standard basis for installing and uninstalling software. A security feature vulnerability exists in Microsoft Windows Installer. The following products and editions are affected: Windows 10...

Reverse Engineering Keys from Firmware. A how-to

TL;DR It is possible to reverse engineer keys from firmware with some tips: 1. Always looks for strings/constants. 2. Make guesses about the original source. 3. Find a function you can recognise and work backwards to identify other functions. 4. It helps if they use open-source code so you can cr...

OSV-2021-307 UNKNOWN READ in cpu_arm_exec_armeb

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=30444 Crash type: UNKNOWN READ Crash state: cpuarmexecarmeb resumeallvcpusarmeb vmstartarmeb...

HPE Apollo 70 资源管理错误漏洞

The HPE Apollo 70 system is an Arm-based platform that delivers the density and scalability required for large HPC cluster deployments. A local buffer overflow vulnerability exists in the libifc.so webgetactivexcfg function in the Baseboard Management Controller BMC firmware in HPE Apollo 70...

HPE Apollo 安全漏洞

The HPE Apollo 70 system is an Arm-based platform that provides the density and scalability required for large HPC cluster deployments. A local buffer overflow vulnerability exists in the libifc.so webstartflash function in the Baseboard Management Controller BMC firmware in HPE Apollo 70 version...