Lenovo Power Management Driver Buffer Overflow

Exploit Title: Lenovo Power Management Driver "pmdrvs.sys" - Buffer Overflow Date: 11/12/2019 Exploit Author: Nassim Asrir Contact: [email protected] | https://www.linkedin.com/in/nassim-asrir-b73a57122/ CVE: CVE-2019-6192 Tested On: Windows 1064bit | ThinkPad T470p Vendor :...

PT-2020-6467

Name of the Vulnerable Software and Affected Versions QEMU version 4.1.0 Description The issue is related to a heap-based buffer over-read in the iscsi aio ioctl cb function in the block/iscsi.c file. This may disclose unrelated information from process memory to an attacker. The vulnerability is...

CVE-2015-7892

Stack-based buffer overflow in the m2m1shotcompatioctl32 function in the Samsung m2m1shot driver framework, as used in Samsung S6 Edge, allows local users to have unspecified impact via a large data.bufout.numplanes value in an ioctl call...

Stack overflow

Stack-based buffer overflow in the m2m1shotcompatioctl32 function in the Samsung m2m1shot driver framework, as used in Samsung S6 Edge, allows local users to have unspecified impact via a large data.bufout.numplanes value in an ioctl call...

CVE-2011-2480

Information Disclosure vulnerability in the 802.11 stack, as used in FreeBSD before 8.2 and NetBSD when using certain non-x86 architectures. A signedness error in the IEEE80211IOCCHANINFO ioctl allows a local unprivileged user to cause the kernel to copy large amounts of kernel memory back to the...

DEBIAN-CVE-2019-10207

A flaw was found in the Linux kernel's Bluetooth implementation of UART, all versions kernel 3.x.x before 4.18.0 and kernel 5.x.x. An attacker with local access and write permissions to the Bluetooth hardware could use this flaw to issue a specially crafted ioctl function call and cause the syste...

CVE-2019-10207

A flaw was found in the Linux kernel's Bluetooth implementation of UART, all versions kernel 3.x.x before 4.18.0 and kernel 5.x.x. An attacker with local access and write permissions to the Bluetooth hardware could use this flaw to issue a specially crafted ioctl function call and cause the syste...

CVE-2019-10207

A flaw was found in the Linux kernel's Bluetooth implementation of UART, all versions kernel 3.x.x before 4.18.0 and kernel 5.x.x. An attacker with local access and write permissions to the Bluetooth hardware could use this flaw to issue a specially crafted ioctl function call and cause the syste...

Advantech WebAccess SCADA Buffer Overflow (CVE-2019-3953)

A stack buffer overflow exists in Advantech WebAccess SCADA. The vulnerability is due to improper validation of user-supplied data in the request submitted to the target server with IOCTL 10012. Successful exploitation could lead to arbitrary code execution under context of Administrator...

CVE-2019-19197

IOCTL Handling in the kyrld.sys driver in Kyrol Internet Security 9.0.6.9 allows an attacker to achieve privilege escalation, denial-of-service, and code execution via usermode because 0x9C402401 using METHODNEITHER results in a read primitive...

CVE-2019-19197

IOCTL Handling in the kyrld.sys driver in Kyrol Internet Security 9.0.6.9 allows an attacker to achieve privilege escalation, denial-of-service, and code execution via usermode because 0x9C402401 using METHODNEITHER results in a read primitive...

CVE-2019-19197

CVE-2019-19197 relates to IOCTL handling in the kyrld.sys driver of Kyrol Internet Security 9.0.6.9. The vulnerability arises when 0x9C402401 is issued via METHOD_NEITHER, leading to a read primitive that enables local privilege escalation, denial of service, and potential code execution in userm...

Linux kernel resource management error vulnerability (CNVD-2019-41705)

Linux kernel is the kernel used by Linux, the open source operating system released by the Linux Foundation in the United States. A resource management error vulnerability exists in the 'v3dsubmitclioctl' function in the drivers/gpu/drm/v3d/v3dgem.c file in versions of Linux kernel prior to 5.3.1...

systemd security, bug fix, and enhancement update

239-18.0.1 - fix netdev is missing for iscsi entry in /etc/fstab [email protected] Orabug: 25897792 - set 'RemoveIPC=no' in logind.conf as default for OL7.2 Orabug: 22224874 - allow dm remove ioctl to co-operate with UEK3 Vaughan Cao Orabug: 18467469 - add hv dynamic memory support Jerry...

hw: Intel GPU Denial Of Service while accessing MMIO in lower power state

A flaw was found in Intel graphics hardware GPU where a local attacker with the ability to issue an ioctl could trigger a hardware level crash if MMIO registers were read while the graphics card was in a low-power state. This creates a denial of service situation and the GPU and connected display...

kernel: null-pointer dereference in hci_uart_set_flow_control

A flaw was found in the Linux kernel’s Bluetooth implementation of UART. An attacker with local access and write permissions to the Bluetooth hardware could use this flaw to issue a specially crafted ioctl function call and cause the system to crash...

CVE-2005-4890

There is a possible tty hijacking in shadow 4.x before 4.1.5 and sudo 1.x before 1.7.4 via "su - user -c program". The user session can be escaped to the parent session by using the TIOCSTI ioctl to push characters into the input buffer to be read by the next process...

CVE-2005-4890

There is a possible tty hijacking in shadow 4.x before 4.1.5 and sudo 1.x before 1.7.4 via "su - user -c program". The user session can be escaped to the parent session by using the TIOCSTI ioctl to push characters into the input buffer to be read by the next process...

CVE-2005-4890

There is a possible tty hijacking in shadow 4.x before 4.1.5 and sudo 1.x before 1.7.4 via "su - user -c program". The user session can be escaped to the parent session by using the TIOCSTI ioctl to push characters into the input buffer to be read by the next process...

CVE-2005-4890

There is a possible tty hijacking in shadow 4.x before 4.1.5 and sudo 1.x before 1.7.4 via "su - user -c program". The user session can be escaped to the parent session by using the TIOCSTI ioctl to push characters into the input buffer to be read by the next process...