CVE-2017-0327

An elevation of privilege vulnerability in the NVIDIA crypto driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel...

CVE-2017-0330

An information disclosure vulnerability in the NVIDIA crypto driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel 3.10...

CVE-2017-0339

CVE-2017-0339 is an NVIDIA Tegra crypto-dev driver IOCTL handling vulnerability. The issue arises when a value is passed to the kernel driver without proper validation, potentially causing array index issues. Affected are NVIDIA Tegra-based platforms running Linux for Tegra in Android, notably Je...

CVE-2017-0328

Summary (CVE-2017-0328) An information-disclosure vulnerability in the NVIDIA crypto driver could allow a local malicious Android process to access data outside its permission levels. Affected software: Android on kernel 3.10. Exploitation requires a privileged process, so impact is limited to lo...

CVE-2017-0327

CVE-2017-0327 affects the NVIDIA crypto driver in the Android/Tegr­a kernel. The connected document notes that the vulnerability arises because an input buffer is copied to an output buffer without validating the input size, which may lead to memory corruption and a denial of service (the NVIDIA ...

CVE-2017-0328

An information disclosure vulnerability in the NVIDIA crypto driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel 3.10...

CVE-2017-0332

CVE-2017-0332 affects the NVIDIA crypto driver in Android kernels (NVIDIA Tegra). The vulnerability arises from a heap-allocated buffer overwrite in the cryptodev path, which could allow a local attacker to execute arbitrary code in kernel context (privilege escalation). Android’s public bulletin...

CVE-2017-0332

An elevation of privilege vulnerability in the NVIDIA crypto driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel...

CVE-2017-0330

CVE-2017-0330 affects NVIDIA’s Tegra kernel via the NVIDIA crypto driver. The connected NVIDIA security bulletin details that the vulnerability arises from a user-supplied pointer not being correctly validated in the crypto driver, potentially enabling denial of service or privilege escalation. A...

Linux kernel content misreference vulnerability

The Linux kernel is the kernel used by the operating system Linux, released by the Linux Foundation in the United States. A content misreference vulnerability exists in fs/crypto/ in Linux kernel versions prior to 4.10.7. A local attacker can exploit this vulnerability to cause a denial of servic...

PT-2017-4225 · Go · Golang.Org/X/Crypto/Ssh

Name of the Vulnerable Software and Affected Versions: golang.org/x/crypto/ssh versions prior to the version that includes commit e4e2799 Description: The issue is related to the default behavior of the Go SSH library, which does not verify host keys. This facilitates man-in-the-middle attacks if...

Elevation of privilege vulnerability in Qualcomm crypto engine driver(CVE-2017-0576)

No description provided by source. include include include include include include include include include include / PoC By Scott Bauer Bug found by derrek / static const char dev = "/dev/qce"; define QCEDEVMAXKEYSIZE 64 define QCEDEVMAXIVSIZE 32 define QCEDEVMAXBUFFERS 16 struct bufinfo union...

Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2017-3533)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-3533 advisory. - Revert 'x86/mm: Expand the exception table logic to allow new handling options' Brian Maly Orabug: 25790387 CVE-2016-9644 - Revert 'fix minor...

CVE-2016-10230

A remote code execution vulnerability in the Qualcomm crypto driver. Product: Android. Versions: Android kernel. Android ID: A-34389927. References: QC-CR1091408...

CVE-2017-7374

Use-after-free vulnerability in fs/crypto/ in the Linux kernel before 4.10.7 allows local users to cause a denial of service NULL pointer dereference or possibly gain privileges by revoking keyring keys being used for ext4, f2fs, or ubifs encryption, causing cryptographic transform objects to be...

CVE-2017-7374

Use-after-free vulnerability in fs/crypto/ in the Linux kernel before 4.10.7 allows local users to cause a denial of service NULL pointer dereference or possibly gain privileges by revoking keyring keys being used for ext4, f2fs, or ubifs encryption, causing cryptographic transform objects to be...

Unbreakable Enterprise kernel security update

kernel-uek 4.1.12-61.1.33 - Revert 'x86/mm: Expand the exception table logic to allow new handling options' Brian Maly Orabug: 25790387 CVE-2016-9644 - Revert 'fix minor infoleak in getuserex' Brian Maly Orabug: 25790387 CVE-2016-9644 4.1.12-61.1.32 - x86/mm: Expand the exception table logic to...

OracleVM 3.3 / 3.4 : gnutls (OVMSA-2017-0054)

The remote OracleVM system is missing necessary patches to address critical security updates : - Upgraded to 2.12.23 to incorporate multiple TLS 1.2 fixes 1326389, 1326073, 1323215, 1320982, 1328205, 1321112 - Modified gnutls-serv to accept --sni-hostname 1333521 - Modified gnutls-serv to always...

OracleVM 3.3 / 3.4 : openssh (OVMSA-2017-0053)

The remote OracleVM system is missing necessary patches to address critical security updates : - Allow to use ibmca crypto hardware 1397547 - CVE-2015-8325: privilege escalation via user's PAM environment and UseLogin=yes 1405374 - Fix missing hmac-md5-96 from server offer 1373836 - Prevent...

Integer overflow

Integer overflow in hw/virtio/virtio-crypto.c in QEMU aka Quick Emulator allows local guest OS privileged users to cause a denial of service QEMU process crash or possibly execute arbitrary code on the host via a crafted virtio-crypto request, which triggers a heap-based buffer overflow...