PT-2022-30901

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.18.3 Description The issue concerns a double free of io acct set bioset. It was introduced in version v5.17 and fixed in version v5.18.3. The actual impact and attack plausibility have not yet been proven...

PT-2022-31459

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to 5.15.47 Description The issue is related to a potential security vulnerability in the Linux Kernel, where an io hung occurs while disconnecting a device. The actual impact and attack plausibility have not yet bee...

PT-2022-30916

Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.0 through v5.18.2 Description The issue is related to inflight count imbalances and IO hangs on offline devices. It was introduced in version v5.0 and fixed in version v5.18.3. The actual impact and attack plausibility...

PT-2022-30798

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.18.4 Description The issue is related to a potential security vulnerability in the Linux Kernel, where an io hung occurs while disconnecting a device. The actual impact and attack plausibility have not yet bee...

PT-2022-31808

Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.0 through v5.10.120 Description The issue is related to inflight count imbalances and IO hangs on offline devices. It was introduced in version v5.0 and fixed in version v5.10.121. The actual impact and attack...

Siemens EN100 Ethernet Module Improper Restriction of Operations Within the Bounds of a Memory Buffer (CVE-2022-30937)

A vulnerability has been identified in EN100 Ethernet module DNP3 IP variant All versions, EN100 Ethernet module IEC 104 variant All versions, EN100 Ethernet module IEC 61850 variant All versions V4.37, EN100 Ethernet module Modbus TCP variant All versions, EN100 Ethernet module PROFINET IO varia...

CLSA-2022-1655822512 Fixed 6 CVEs in kernel

net: qrtr: fix another OOB Read in qrtrendpointpost CVE-2021-3743 - vt: keyboard: avoid signed integer overflow in kascii CVE-2020-13974 - pNFS/flexfiles: fix incorrect size check in decodenfsfh CVE-2021-4157 - esp: Fix possible buffer overflow in ESP transformation CVE-2022-27666 - sock: remove...

CLSA-2022-1655821334 Fixed 6 CVEs in kernel

net: qrtr: fix another OOB Read in qrtrendpointpost CVE-2021-3743 - vt: keyboard: avoid signed integer overflow in kascii CVE-2020-13974 - pNFS/flexfiles: fix incorrect size check in decodenfsfh CVE-2021-4157 - esp: Fix possible buffer overflow in ESP transformation CVE-2022-27666 - sock: remove...

Malicious code in xendke-io (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 08c5500b7eef8bfb2a53d208d318fb9bd090cb1f6b7faa85f4238b4577a95579 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

OESA-2022-1714 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: An out-of-bound write vulnerability was identified within the netfilter subsystem which can be exploited to achieve privilege escalation to root.CVE-2022-1972 A use-after-free flaw was found in the Linux kernel's NFC core...

IBM AIX 安全漏洞

IBM AIX is an open standards-based UNIX operating system developed by IBM for the IBM Power architecture. IBM AIX versions 7.1, 7.2, 7.3 and VIOS version 3.1 have a denial-of-service vulnerability that stems from failure to properly process incoming error messages, which can be exploited by...

CVE-2022-1976

A flaw was found in the Linux kernel’s implementation of IO-URING. This flaw allows an attacker with local executable permission to create a string of requests that can cause a use-after-free flaw within the kernel. This issue leads to memory corruption and possible privilege escalation. Mitigati...

CVE-2022-30937

A vulnerability has been identified in EN100 Ethernet module DNP3 IP variant All versions, EN100 Ethernet module IEC 104 variant All versions, EN100 Ethernet module IEC 61850 variant All versions V4.37, EN100 Ethernet module Modbus TCP variant All versions, EN100 Ethernet module PROFINET IO varia...

CVE-2022-30937

A vulnerability has been identified in EN100 Ethernet module DNP3 IP variant All versions, EN100 Ethernet module IEC 104 variant All versions, EN100 Ethernet module IEC 61850 variant All versions V4.37, EN100 Ethernet module Modbus TCP variant All versions, EN100 Ethernet module PROFINET IO varia...

Memory corruption

A vulnerability has been identified in EN100 Ethernet module DNP3 IP variant All versions, EN100 Ethernet module IEC 104 variant All versions, EN100 Ethernet module IEC 61850 variant All versions V4.37, EN100 Ethernet module Modbus TCP variant All versions, EN100 Ethernet module PROFINET IO varia...

CVE-2022-30937

CVE-2022-30937 affects Siemens EN100 Ethernet Module variants: DNP3 IP, IEC 104, IEC 61850 (all versions prior to 4.37), Modbus TCP, and PROFINET IO. The issue is a memory corruption vulnerability in the HTTP parsing of the /txtrace endpoint, which could crash the affected application and cause a...

Linux io-workqueue DoS

The vulnerability in the io-workqueue implementation of the Linux operating system is related to the lack of protection for service data. Exploiting this vulnerability can allow an attacker to cause a service failure...

Siemens EN100 Ethernet Module

1. EXECUTIVE SUMMARY CVSS v3 8.6 ATTENTION: Exploitable remotely/low attack complexity Vendor: Siemens Equipment: EN100 Ethernet Module Vulnerability: Improper Restriction of Operations within the Bounds of a Memory Buffer 2. RISK EVALUATION Successful exploitation of this vulnerability could...

This Week in Spring - June 7th, 2022

Hi, Spring fans! Welcome to another installment of This Week in Spring! Ive just landed in tantalizing Toronto, Canada, for the SpringOne Tour Toronto show. Im so excited to be here, at long last, after so long away from one of my favorite countries. Ill be doing two talks - my usual, Kubernetes...

CVE-2022-1786

A use-after-free flaw was found in the Linux kernel’s iouring subsystem in the way a user sets up a ring with IORINGSETUPIOPOLL with more than one task completing submissions on this ring. This flaw allows a local user to crash or escalate their privileges on the system...