NULL pointer deref in event channel poll

ISSUE DESCRIPTION When polling event channels, in general arbitrary port numbers can be specified. Specifically, there is no requirement that a polled event channel ports has ever been created. When the code was generalised from an earlier implementation, introducing some intermediate pointers, a...

page transfer may allow PV guest to elevate privilege

ISSUE DESCRIPTION Domains controlling other domains are permitted to map pages owned by the domain being controlled. If the controlling domain unmaps such a page without flushing the TLB, and if soon after the domain being controlled transfers this page to another PV domain via GNTTABOPtransfer o...

ARM guest disabling interrupt may crash Xen

ISSUE DESCRIPTION Virtual interrupt injection could be triggered by a guest when sending an SGI e.g IPI to any vCPU or by configuring timers. When the virtual interrupt is masked, a missing check in the injection path may result in reading invalid hardware register or crashing the host. IMPACT A...

arm: vgic: Out-of-bound access when sending SGIs

ISSUE DESCRIPTION ARM guests can send SGI i.e. IPI targeting a list of vCPUs using the MMIO register GICDSGIR GICv2 or System Register ICCSGI1R GICv3. However, the emulation code does not sanitize the list and will directly access an array without checking whether the array index is within bounds...

stale P2M mappings due to insufficient error checking

ISSUE DESCRIPTION Certain actions require removing pages from a guest's P2M Physical-to-Machine mapping. When large pages are in use to map guest pages in the 2nd-stage page tables, such a removal operation may incur a memory allocation to replace a large mapping with individual smaller ones. If...

Foscam IP Video Camera CGIProxy.fcgi DNS2 Address Configuration Command Injection Vulnerability

Summary An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary shell characters during manual network configurati...

Foscam IP Video Camera CGIProxy.fcgi SMTP Test Host Parameter Configuration Command Injection Vulnerability

Summary An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary data in the “msmtprc” configuration file resulting...

Foscam IP Video Camera CGIProxy.fcgi Account Creation Command Injection Vulnerability

Summary An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary shell characters during account creation resulting...

Foscam IP Video Camera CGIProxy.fcgi SMTP Test Sender Parameter Configuration Command Injection Vulnerability

Summary An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary data in the “msmtprc” configuration file resulting...

ARM Trusted Firmware Denial of Service Vulnerability

ARM Trusted Firmware is a set of interface standards that provide an ARMv8-A secure software implementation. A security vulnerability exists in ARM Trusted Firmware versions 1.3 and earlier. An attacker could exploit this vulnerability to cause a denial of service...

ARM Trusted Firmware MT_EXECUTE_NEVER Protection Mechanism Bypass Vulnerability

ARM Trusted Firmware is a set of interface standards that provide an ARMv8-A secure software implementation. A security vulnerability exists in ARM Trusted Firmware version 1.3. An attacker can exploit this vulnerability to bypass the MTEXECUTENEVER protection mechanism...

LG MRA58K - Out-of-Bounds Heap Read in CAVIFileParser::Destroy Resulting in Invalid Free

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1221 Similar to the previously reported issue 1206 , when parsing AVI files the CAVIFileParser object contains a fixed-size array of what appears to be pointer/length pairs, used I suppose to store the data for each stream. This is...

openSUSE Security Update : the Linux Kernel (openSUSE-2017-666)

The openSUSE Leap 42.2 kernel was updated to 4.4.70 to receive various security and bugfixes. The following security bugs were fixed : - CVE-2017-9076: The dccpv6requestrecvsock function in net/dccp/ipv6.c in the Linux kernel mishandled inheritance, which allowed local users to cause a denial of...

Security update for the Linux Kernel (important)

The openSUSE Leap 42.2 kernel was updated to 4.4.70 to receive various security and bugfixes. The following security bugs were fixed: - CVE-2017-9076: The dccpv6requestrecvsock function in net/dccp/ipv6.c in the Linux kernel mishandled inheritance, which allowed local users to cause a denial of...

CVE-2017-7563

In ARM Trusted Firmware 1.3, RO memory is always executable at AArch64 Secure EL1, allowing attackers to bypass the MTEXECUTENEVER protection mechanism. This issue occurs because of inconsistency in the number of execute-never bits one bit versus two bits...

Authentication flaw

In ARM Trusted Firmware through 1.3, the secure self-hosted invasive debug interface allows normal world attackers to cause a denial of service secure world panic via vectors involving debug exceptions and debug registers...

Code injection

In ARM Trusted Firmware 1.3, RO memory is always executable at AArch64 Secure EL1, allowing attackers to bypass the MTEXECUTENEVER protection mechanism. This issue occurs because of inconsistency in the number of execute-never bits one bit versus two bits...

CVE-2017-7564

In ARM Trusted Firmware through 1.3, the secure self-hosted invasive debug interface allows normal world attackers to cause a denial of service secure world panic via vectors involving debug exceptions and debug registers...

CVE-2017-7563

In ARM Trusted Firmware 1.3, RO memory is always executable at AArch64 Secure EL1, allowing attackers to bypass the MTEXECUTENEVER protection mechanism. This issue occurs because of inconsistency in the number of execute-never bits one bit versus two bits...

CVE-2017-7564

In ARM Trusted Firmware through 1.3, the secure self-hosted invasive debug interface allows normal world attackers to cause a denial of service secure world panic via vectors involving debug exceptions and debug registers...