virt: guest to host DoS by triggering an infinite loop in microcode via #DB exception

It was found that the x86 ISA Instruction Set Architecture is prone to a denial of service attack inside a virtualized environment in the form of an infinite loop in the microcode due to the way sequential delivering of benign exceptions such as DB debug exception is handled. A privileged user...

FreeBSD : qemu -- denial of service vulnerability in VNC (67feba97-b1b5-11e5-9728-002590263bf5)

Prasad J Pandit, Red Hat Product Security Team, reports : Qemu emulator built with the VNC display driver support is vulnerable to an arithmetic exception flaw. It occurs on the VNC server side while processing the 'SetPixelFormat' messages from a client. A privileged remote client could use this...

Advanced Encryption Package - Buffer Overflow (Denial of Service) (PoC)

Advanced Encryption Package - Buffer Overflow Denial of Service PoC Dear List, Greetings from vishnu @dH4wk 1. Vulnerable Product - Advanced Encryption Package - Company http://www.aeppro.com/ 2. Vulnerability Information A Buffer OverFlow Impact: Attacker gains administrative access Remotely...

USN-2843-2 linux-lts-wily vulnerabilities

Jan Beulich discovered that the KVM svm hypervisor implementation in the Linux kernel did not properly catch Debug exceptions on AMD processors. An attacker in a guest virtual machine could use this to cause a denial of service system crash in the host OS. CVE-2015-8104 郭永刚 discovered that the pp...

USN-2844-1 linux-lts-utopic vulnerabilities

Jan Beulich discovered that the KVM svm hypervisor implementation in the Linux kernel did not properly catch Debug exceptions on AMD processors. An attacker in a guest virtual machine could use this to cause a denial of service system crash in the host OS. CVE-2015-8104 郭永刚 discovered that the pp...

virt: guest to host DoS by triggering an infinite loop in microcode via #DB exception

It was found that the x86 ISA Instruction Set Architecture is prone to a denial of service attack inside a virtualized environment in the form of an infinite loop in the microcode due to the way sequential delivering of benign exceptions such as DB debug exception is handled. A privileged user...

virt: guest to host DoS by triggering an infinite loop in microcode via #AC exception

It was found that the x86 ISA Instruction Set Architecture is prone to a denial of service attack inside a virtualized environment in the form of an infinite loop in the microcode due to the way sequential delivering of benign exceptions such as AC alignment check exception is handled. A privileg...

virt: guest to host DoS by triggering an infinite loop in microcode via #DB exception

It was found that the x86 ISA Instruction Set Architecture is prone to a denial of service attack inside a virtualized environment in the form of an infinite loop in the microcode due to the way sequential delivering of benign exceptions such as DB debug exception is handled. A privileged user...

virt: guest to host DoS by triggering an infinite loop in microcode via #DB exception

It was found that the x86 ISA Instruction Set Architecture is prone to a denial of service attack inside a virtualized environment in the form of an infinite loop in the microcode due to the way sequential delivering of benign exceptions such as DB debug exception is handled. A privileged user...

virt: guest to host DoS by triggering an infinite loop in microcode via #AC exception

It was found that the x86 ISA Instruction Set Architecture is prone to a denial of service attack inside a virtualized environment in the form of an infinite loop in the microcode due to the way sequential delivering of benign exceptions such as AC alignment check exception is handled. A privileg...

Khan Academy: Escaping the iframe via exceptions

You can throw an object with an html property to run arbitrary js Here is an example program that modifies a user's profile. I made the program as private as possible by saving it with nouser and drawing nothing in the hopes that it will be ignored, but if you want me to delete it, I will. The...

Multiple Huawei eSpace switch denial of service vulnerabilities

Huawei eSpace U1910, eSpace U1911, eSpace U1930, eSpace U1960, eSpace U1980, and eSpace U1981 are eSpace U1900 series switch products from Huawei, China. A security vulnerability exists in the exception handling mechanism in the CLI Module of several Huawei eSpace switches, which allows remote...

Code injection

The exception handling mechanism in the CLI Module in Huawei eSpace U1910, U1911, U1930, U1960, U1980, and U1981 unified gateways with software before V100R001C20SPH605 allows remote attackers to cause a denial of service CLI outage via crafted SSH packets...

CVE-2015-7845

The exception handling mechanism in the CLI Module in Huawei eSpace U1910, U1911, U1930, U1960, U1980, and U1981 unified gateways with software before V100R001C20SPH605 allows remote attackers to cause a denial of service CLI outage via crafted SSH packets...

CVE-2015-8104

CVE-2015-8104 affects the KVM/Hypervisor stack in Linux kernel up to 4.2.6 and Xen up to 4.6.x. The issue arises from handling of Debug (DB) exceptions in svm.c, allowing a guest OS user to trigger many DBs to cause a host denial-of-service (panic/hang). Connected CNA/records also show a link to ...

x86: CPU lockup during exception delivery

ISSUE DESCRIPTION When a benign exception occurs while delivering another benign exception, it is architecturally specified that these would be delivered sequentially. There are, however, cases where this results in an infinite loop inside the CPU, which in the virtualized case can be broken only...

Python 2.7 strop.replace() Integer Overflow Vulnerability

Python version 2.7 strop.replace method suffers from an integer overflow that can be exploited to write outside the bounds of the string buffer and potentially achieve code execution. The issue can be triggered by performing a large substitution that overflows the arithmetic used in mymemreplace ...

Keybase: Un-handled exception leads to Information Disclosure

Steps: 1. Login to https://keybase.io/ 2. Click on Me icon from top-right button https://keybase.io/username 3. Click on Edit picture button https://keybase.io/usernameedit-me 4. Intercept the traffic using proxy tool e,g, Burp Suite 5. Click on "Prove my Twitter identity" link 6. In the request,...

CVE-2009-4004

Buffer overflow in the kvmvcpuioctlx86setupmce function in arch/x86/kvm/x86.c in the KVM subsystem in the Linux kernel before 2.6.32-rc7 allows local users to cause a denial of service memory corruption or possibly gain privileges via a KVMX86SETUPMCE IOCTL request that specifies a large number o...

Infinite Automation Mango Automation Information Disclosure Vulnerability (CNVD-2015-07169)

Infinite Automation Mango Automation is the United States Infinite Automation Systems, Inc. of a set of open source Web-based SCADA data acquisition and supervisory control, HMI and automation software. Infinite Automation Mango Automation 2.5.x and 2.6.x prior to 2.6.0, build 430, suffers from a...