kernel: arp: Prevent overflow in arp_req_get().

A vulnerability was found in the arpreqget function in the Linux kernel when handling the SIOCGARP ioctl input/output control request. This function copies data over into a fixed-length buffer which could result in a buffer overflow and cause memory corruption, undefined behavior, or crashes...

PT-2024-12274 · Amd · Amd Μprof

Name of the Vulnerable Software and Affected Versions: AMD μProf affected versions not specified Description: The issue is due to insufficient validation of the Input Output Control IOCTL input buffer in AMD μProf, which may allow an authenticated attacker to cause an out-of-bounds write. This...

kernel: vfio/pci: Lock external INTx masking ops

In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Lock external INTx masking ops Mask operations through config space changes to DisINTx may race INTx configuration changes via ioctl. Create wrappers that add locking for paths outside of the core interrupt code. In...

PT-2024-25066 · Qualcomm · Snapdragon +123

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue involves memory corruption that occurs while processing an IOCTL call to set metainfo. This suggests a problem with how the system handles...

UBUNTU-CVE-2024-42156

In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Wipe copies of clear-key structures on failure Wipe all sensitive data from stack for all IOCTLs, which convert a clear-key into a protected- or secure-key...

The vulnerability of the AsInsHelp64.sys driver, part of the DeviceIoControl utility in ASUS’ ASUS Fan Xpert computer and laptop fan control software, allows a hacker to execute arbitrary code, increase their privileges, or disclose sensitive information.

The vulnerability of the AsInsHelp64.sys driver, which is part of the DeviceIoControl utility in the ASUS ASUS Fan Xpert speed control software, relates to operations that go beyond the buffer limits in memory. Exploiting this vulnerability allows an attacker to execute arbitrary code, gain...

CVE-2024-5680

CWE-129: Improper Validation of Array Index vulnerability exists that could cause local denial-of-service when a malicious actor with local user access crafts a script/program using an IOCTL call in the Foxboro.sys driver...

PT-2024-5154 · Unknown · Foxboro.Sys

Name of the Vulnerable Software and Affected Versions: Foxboro.sys driver affected versions not specified Description: The issue is related to an Out-of-Bounds Write vulnerability that could cause local denial-of-service or kernel memory leak. A malicious actor with local user access can craft a...

PT-2024-5178 · Schneider Electric · Ecostruxure Foxboro Dcs Control Core Services

Name of the Vulnerable Software and Affected Versions: EcoStruxureTM Foxboro DCS Control Core Services affected versions not specified Description: The issue is related to insufficient input validation in the Foxboro.sys driver, which could allow an attacker to cause a denial-of-service,...

ThundeRobot Control Center Security Vulnerability

ThundeRobot Control Center is a gaming product driver control center from Chinese company ThundeRobot. A security vulnerability exists in ThundeRobot Control Center version 2.0.0.10, which originated from a vulnerability that allows an attacker to access sensitive information, execute arbitrary...

PT-2024-19848 · Qualcomm · Snapdragon +98

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue involves memory corruption that occurs when invoking an IOCTL call for GPU memory allocation. This happens when the size parameter is greater...

The vulnerability of the ioctl component of the application management tools and Flatpak environments, which allows a hacker to trigger a service failure

The vulnerability of the ioctl device for application and Flatpak environments relates to the copying of text from the virtual console and its insertion into the command buffer, from which commands can be executed after the Flatpak application is closed. Exploiting this vulnerability could allow ...

SUSE CVE-2022-2153

A flaw was found in the Linux kernel's KVM when attempting to set a SynIC IRQ. This issue makes it possible for a misbehaving VMM to write to SYNIC/STIMER MSRs, causing a NULL pointer dereference. This flaw allows an unprivileged local attacker on the host to issue specific ioctl calls, causing a...

The vulnerability of the development package for integrating cloud services and communication functions in IoT devices. The Kalay SDK, a microprogramming software for video surveillance cameras like Owlet Cam v1 and Owlet Cam v2, has a flaw related to the failure to eliminate special elements used in the operating system’s command set. This allows attackers to execute arbitrary commands and increase their privileges.

The vulnerability of the development package for integrating cloud services and communication functions in IoT devices is related to the failure to remove special elements used in the operating system’s command set when executing system calls like IOCTL during the unpacking of updates. Exploiting...

CVE-2024-33220

An issue in the component AslO364.sys of ASUSTeK Computer Inc AISuite3 v3.03.36 3.03.36 allows attackers to escalate privileges and execute arbitrary code via sending crafted IOCTL requests...

PT-2024-25164 · Insyde · Seg Windows Driver

Name of the Vulnerable Software and Affected Versions: Insyde Software Corp SEG Windows Driver version 100.00.07.02 Description: An issue in the component segwindrvx64.sys allows attackers to escalate privileges and execute arbitrary code via sending crafted IOCTL requests. Recommendations: For...

Nicomsoft WinI2C/DDC 安全漏洞

Nicomsoft WinI2C/DDC is a professional tool from Nicomsoft that allows you to control display devices via the DDC/CI protocol in a Windows environment. A security vulnerability exists in Nicomsoft WinI2C/DDC version v3.7.4.0, which originates from a security flaw in the component ddcdrv.sys. The...

Realtek Semiconductor Corp Realtek lO Driver 安全漏洞

Realtek Semiconductor Corp Realtek lO Driver is a driver from Realtek Semiconductor Corp, China. A security vulnerability exists in Realtek Semiconductor Corp Realtek lO Driver version v1.008.0823.2017, which stems from a security flaw in the component rtkio64.sys. An attacker can exploit the...

PT-2024-25159 · Asus · Asus Atszio Driver

Name of the Vulnerable Software and Affected Versions: ASUS ATSZIO Driver version 0.2.1.7 Description: An issue in the component ATSZIO64.sys of the ASUS ATSZIO Driver allows attackers to escalate privileges and execute arbitrary code via sending crafted IOCTL requests. Recommendations: For versi...

PT-2024-25161 · Realtek Semiconductor · Realtek High Definition Audio Function Driver

Name of the Vulnerable Software and Affected Versions: Realtekr High Definition Audio Function Driver version 6.0.9549.1 Description: An issue in the component RTKVHD64.sys of Realtek Semiconductor Corp Realtekr High Definition Audio Function Driver allows attackers to escalate privileges and...