CVE-2022-40137

A buffer overflow in the WMI SMI Handler in some Lenovo models may allow an attacker with local access and elevated privileges to execute arbitrary code...

kernel: s390/idle: mark arch_cpu_idle() noinstr

A kernel warning vulnerability was found in the s390 architecture idle handling in the Linux kernel. The archcpuidle function was not marked as noinstr no instrumentation, causing RCU and tracing warnings when ftrace is enabled. This can trigger kernel warnings and potential issues with tracing i...

Targeted Fuzzing for Unsafe Rust Code: Leveraging Selective Instrumentation

Rust is a promising programming language that focuses on concurrency, usability, and security. It is used in production code by major industry players and got recommended by government bodies. Rust provides strong security guarantees achieved by design utilizing the concepts of ownership and...

PatchFuzz: Patch Fuzzing for JavaScript Engines

Patch fuzzing is a technique aimed at identifying vulnerabilities that arise from newly patched code. While researchers have made efforts to apply patch fuzzing to testing JavaScript engines with considerable success, these efforts have been limited to using ordinary test cases or publicly...

American Fuzzy Lop plus plus 4.32c

Google's American Fuzzy Lop is a brute-force fuzzer coupled with an exceedingly simple but rock-solid instrumentation-guided genetic algorithm. afl++ is a superior fork to Google's afl. It has more speed, more and better mutations, more and better instrumentation, custom module support, etc...

DoS Vulnerability in TraceContextPropagator.Extract - OpenTelemetry.Api

Impact What kind of vulnerability is it? Who is impacted? A vulnerability in OpenTelemetry.Api package 1.10.0 to 1.11.1 could cause a Denial of Service DoS when a tracestate and traceparent header is received. These versions are used in OpenTelemetry .NET Automatic Instrumentation 1.10.0-beta.1 a...

Linux Distros Unpatched Vulnerability : CVE-2022-21698

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - clientgolang is the instrumentation library for Go applications in Prometheus, and the promhttp package in clientgolang provides tooling around HTTP servers and...

PT-2025-2713 · Qualcomm · Snapdragon +138

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: Memory corruption may occur when stopping the WLAN interface after processing a WMI command from the interface. This issue is related to the processing ...

Simple macOS kernel extension fuzzing in userspace with IDA and TinyInst

Posted by Ivan Fratric, Google Project Zero Recently, one of the projects I was involved in had to do with video decoding on Apple platforms, specifically AV1 decoding. On Apple devices that support AV1 video format starting from Apple A17 iOS / M3 macOS, decoding is done in hardware. However,...

Observing Spin Apps with OpenTelemetry and the .NET Aspire Dashboard

Observe Spin apps locally using automatic instrumentation, the otel plug-in, and the .NET Aspire dashboard for logs, metrics, and traces...

PT-2024-27989 · Qualcomm · Snapdragon +23

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue is related to memory corruption that occurs when an IOCLT is called while a device is in an invalid state. This happens because the WMI comman...

MAL-2024-9670 Malicious code in instrumentation-pg (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-9668 Malicious code in instrumentation-grpc (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-9667 Malicious code in instrumentation-express (npm)

--- -= Per source details. Do not edit below this line.=-...

kernel: platform/x86: wmi: Fix opening of char device

In the Linux kernel, the following vulnerability has been resolved: platform/x86: wmi: Fix opening of char device Since commit fa1f68db6ca7 "drivers: misc: pass miscdevice pointer via file private data", the miscdevice stores a pointer to itself inside filp-privatedata, which means that privateda...

Microsoft Warns of New INC Ransomware Targeting U.S. Healthcare Sector

Microsoft has revealed that a financially motivated threat actor has been observed using a ransomware strain called INC for the first time to target the healthcare sector in the U.S. The tech giant's threat intelligence team is tracking the activity under the name Vanilla Tempest formerly DEV-083...

DEBIAN-CVE-2024-46768

In the Linux kernel, the following vulnerability has been resolved: hwmon: hp-wmi-sensors Check if WMI event data exists The BIOS can choose to return no event data in response to a WMI event, so the ACPI object passed to the WMI notify handler can be NULL. Check for such a situation and ignore t...

UBUNTU-CVE-2024-46768

In the Linux kernel, the following vulnerability has been resolved: hwmon: hp-wmi-sensors Check if WMI event data exists The BIOS can choose to return no event data in response to a WMI event, so the ACPI object passed to the WMI notify handler can be NULL. Check for such a situation and ignore t...

kernel: platform/x86: wmi: Fix opening of char device

In the Linux kernel, the following vulnerability has been resolved: platform/x86: wmi: Fix opening of char device Since commit fa1f68db6ca7 "drivers: misc: pass miscdevice pointer via file private data", the miscdevice stores a pointer to itself inside filp-privatedata, which means that privateda...

kernel: platform/x86: wmi: Fix opening of char device

In the Linux kernel, the following vulnerability has been resolved: platform/x86: wmi: Fix opening of char device Since commit fa1f68db6ca7 "drivers: misc: pass miscdevice pointer via file private data", the miscdevice stores a pointer to itself inside filp-privatedata, which means that privateda...