mmiotic

mmiotic MMIO タイミングを探索するためのツール — 任意の物理アドレスを計時し、レイテンシからハードウェアを解析します。 ハードウェアリバースエンジニアリング、ハイパーバイザーのフィンガープリンティング、デバイスアクティビティのサイドチャネル解析、レジスタ特性評価、悪意あるトリガーの校正、そして冗長極まりないマシン命令の作成に、驚くほど役立ちます。 例 メモリ範囲のリバースエンジニアリング 物理メモリの最初の 1 メガバイトは、その構造が既によく知られているにもかかわらず、始めるのに手頃な例です。...

cve-2023-46813-poc

CVE-2023-46813 PoC 1. host-patches フォルダ内のパッチを Linux ホストと QEMU に適用します。 2. SEV-SNP VM を起動します。 3. このリポジトリ内のコードを実行し、「waiting for the hypervisor to change memory to MMIO」というメッセージを待ちます。 4. QEMU で attack コマンドを数回連打します。 5. エクスプロイトが自身のメモリの一部の型が MMIO に変更されたことを検出すると、その脆弱性を利用して自身の資格情報を init タスクの資格情報と交換します。...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

A vulnerability was discovered in the Linux kernel before version 6.5.9. This vulnerability could be exploited by local users who have access to MMIO registers through the user space. Incorrect access checks in the VC handler, along with improper emulation of MMIO accesses using the SEV-ES...

kernel: drm/xe: Open-code GGTT MMIO access protection

A flaw was found in the drm/xe component of the Linux kernel. This vulnerability involves insufficient protection of Graphics Translation Table GGTT Memory-Mapped I/O MMIO access. When the driver fails to load or during certain cleanup operations, the system's memory access protection is...

UBUNTU-CVE-2026-89596

In the Linux kernel, the following vulnerability has been resolved: forcedeth: fix off-by-one when saving/restoring non-PCI config space nvsuspend and nvresume walk the non-PCI configuration space with for i = 0; i registersize/sizeofu32; i++ which runs one iteration too many. savedconfigspace is...

Linux Distros Unpatched Vulnerability : CVE-2026-89438

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - platform/x86: ISST: Validate logical CPU id and clos id Validate max CLOS ID and logical CPU ID for core power feature. Reject any clos level or logical CPU...

Linux Distros Unpatched Vulnerability : CVE-2026-89596

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - forcedeth: fix off-by-one when saving/restoring non-PCI config space nvsuspend and nvresume walk the non-PCI configuration space with for i = 0; i...

Linux Distros Unpatched Vulnerability : CVE-2026-89441

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mmc: via-sdmmc: cancel card-detect work on remove Disabling the device interrupt and freeing the IRQ prevents new card-detect work from being queued, but...

CVE-2026-89438

A flaw was found in the Linux kernel, specifically within the Intel Speed Select Technology ISST component. This vulnerability arises from insufficient validation of input values, such as logical CPU ID and CLOS ID, used in the core power feature. A local attacker could exploit this by providing...

DEBIAN-CVE-2026-89596

In the Linux kernel, the following vulnerability has been resolved: forcedeth: fix off-by-one when saving/restoring non-PCI config space nvsuspend and nvresume walk the non-PCI configuration space with for i = 0; i registersize/sizeofu32; i++ which runs one iteration too many. savedconfigspace is...

AZL-100386 CVE-2026-89596 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: forcedeth: fix off-by-one when saving/restoring non-PCI config space nvsuspend and nvresume walk the non-PCI configuration space with for i = 0; i registersize/sizeofu32; i++ which runs one iteration too many. savedconfigspace is...

CVE-2026-89596

In the Linux kernel, the following vulnerability has been resolved: forcedeth: fix off-by-one when saving/restoring non-PCI config space nvsuspend and nvresume walk the non-PCI configuration space with for i = 0; i registersize/sizeofu32; i++ which runs one iteration too many. savedconfigspace is...

DEBIAN-CVE-2026-89438

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate logical CPU id and clos id Validate max CLOS ID and logical CPU ID for core power feature. Reject any clos level or logical CPU number greater than the supported maximum. These are used to calculate...

CVE-2026-89438

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate logical CPU id and clos id Validate max CLOS ID and logical CPU ID for core power feature. Reject any clos level or logical CPU number greater than the supported maximum. These are used to calculate...

CVE-2026-89441

In the Linux kernel, the following vulnerability has been resolved: mmc: via-sdmmc: cancel card-detect work on remove Disabling the device interrupt and freeing the IRQ prevents new card-detect work from being queued, but carddetwork already queued by the handler can still run after viasdremove...

AZL-100674 CVE-2026-89438 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Validate logical CPU id and clos id Validate max CLOS ID and logical CPU ID for core power feature. Reject any clos level or logical CPU number greater than the supported maximum. These are used to calculate...

CVE-2026-89731 cxl/ras: Fix cxl_rch_get_aer_info() out-of-bounds AER register read

In the Linux kernel, the following vulnerability has been resolved: cxl/ras: Fix cxlrchgetaerinfo out-of-bounds AER register read cxlrchgetaerinfo copies the RCH Downstream Port AER capability from the RCRB MMIO block using a readl loop bounded by sizeofstruct aercapabilityregs. This struct is a...

CVE-2026-89596

CVE-2026-89596 affects the Linux kernel's forcedeth driver (NVIDIA). An off-by-one error in nv_suspend() and nv_resume() causes an out-of-bounds write one element past the saved_config_space array during system suspend and resume (S3). The bug is triggered by a loop using <= instead of <. W...

CVE-2026-89596 forcedeth: fix off-by-one when saving/restoring non-PCI config space

In the Linux kernel, the following vulnerability has been resolved: forcedeth: fix off-by-one when saving/restoring non-PCI config space nvsuspend and nvresume walk the non-PCI configuration space with for i = 0; i registersize/sizeofu32; i++ which runs one iteration too many. savedconfigspace is...

EUVD-2026-76508

In the Linux kernel, the following vulnerability has been resolved: forcedeth: fix off-by-one when saving/restoring non-PCI config space nvsuspend and nvresume walk the non-PCI configuration space with for i = 0; i registersize/sizeofu32; i++ which runs one iteration too many. savedconfigspace is...