x86 PV guests may gain access to internally used pages

ISSUE DESCRIPTION Memory management for PV guests builds on page ownership and page attributes. A domain can always map, at least r/o, pages of which it is the owner. Certain fields in the control structure of a page are used for different purposes in the main PV memory management code and in cod...

Linux Kernel Local Contention Condition Vulnerability

Linux kernel is the kernel used by Linux, the open source operating system released by the Linux Foundation in the United States. A local contention condition vulnerability exists in the 'touchpmd' function of the THP implementation in Linux Kernel versions 2.6.38 through 4.14, which stems from t...

Memory leak vulnerability in multiple Huawei products (CNVD-2017-35719)

Huawei DP300/RP200 and TE series are all-in-one desktop and HD video conferencing terminals launched by Huawei for high-end customers. A memory leak vulnerability exists in multiple Huawei products due to the XML parser failing to free memory when processing certain nodes. An attacker could explo...

PT-2017-3622 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 4.14.4 Description: The issue is related to the oom reap task mm function in mm/oom kill.c, which mishandles gather operations. This can allow attackers to cause a denial of service, such as a TLB entry leak or...

Linux Memory Cryptographic Keys Extractor: CryKeX

Some work has been already published regarding the subject of cryptograhic keys security within DRAM. Basically, we need to find something that looks like a key entropic and specific length and then confirm its nature by analyzing the memory structure around it C data types. The idea is to dump...

Circle with Disney Apid Use-Between-Reallocs Information Disclosure Vulnerability

Summary An exploitable information disclosure vulnerability exists in the apid daemon of the Circle with Disney running firmware 2.0.1. A specially crafted set of packets can make the Disney Circle dump strings from an internal database into an HTTP response. An attacker needs network connectivit...

CVE-2017-13683

In Symantec Endpoint Encryption before SEE 11.1.3HF3, a kernel memory leak is a type of resource leak that can occur when a computer program incorrectly manages memory allocations in such a way that memory which is no longer needed is not released. In object-oriented programming, a memory leak ma...

Xen - Pagetable De-typing Unbounded Recursion

Xen allows pagetables of the same level to map each other as readonly in PV domains. This is useful if a guest wants to use the self-referential pagetable trick for easy access to pagetables by mapped virtual address. When cleaning up a pagetable after the last typed reference to it has been...

The vulnerabilities of Microsoft Edge and Internet Explorer involve improper memory management by JavaScript mechanisms when displaying content, allowing attackers to execute arbitrary code.

Vulnerability of browsers Internet Explorer and Microsoft Edge, where JavaScript memory-management mechanisms malfunction when displaying content. Exploiting this vulnerability allows a remote attacker to execute arbitrary code in the context of the current user...

DEBIAN-CVE-2017-12188

arch/x86/kvm/mmu.c in the Linux kernel through 4.13.5, when nested virtualisation is used, does not properly traverse guest pagetable entries to resolve a guest virtual address, which allows L1 guest OS users to execute arbitrary code on the host OS or cause a denial of service incorrect index...

USN-3444-1 linux, linux-aws, linux-gke, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities

Jan H. Schönherr discovered that the Xen subsystem did not properly handle block IO merges correctly in some situations. An attacker in a guest vm could use this to cause a denial of service host crash or possibly gain administrative privileges in the host. CVE-2017-12134 Andrey Konovalov...

UBUNTU-CVE-2017-7819

A use-after-free vulnerability can occur in design mode when image objects are resized if objects referenced during the resizing have been freed from memory. This results in a potentially exploitable crash. This vulnerability affects Firefox 56, Firefox ESR 52.4, and Thunderbird 52.4...

CVE-2017-12238

A vulnerability in the Virtual Private LAN Service VPLS code of Cisco IOS 15.0 through 15.4 for Cisco Catalyst 6800 Series Switches could allow an unauthenticated, adjacent attacker to cause a C6800-16P10G or C6800-16P10G-XL type line card to crash, resulting in a denial of service DoS condition...

Race condition

A vulnerability in the Virtual Private LAN Service VPLS code of Cisco IOS 15.0 through 15.4 for Cisco Catalyst 6800 Series Switches could allow an unauthenticated, adjacent attacker to cause a C6800-16P10G or C6800-16P10G-XL type line card to crash, resulting in a denial of service DoS condition...

CVE-2017-12238

A vulnerability in the Virtual Private LAN Service VPLS code of Cisco IOS 15.0 through 15.4 for Cisco Catalyst 6800 Series Switches could allow an unauthenticated, adjacent attacker to cause a C6800-16P10G or C6800-16P10G-XL type line card to crash, resulting in a denial of service DoS condition...

CVE-2017-12238

A vulnerability in the Virtual Private LAN Service VPLS code of Cisco IOS 15.0 through 15.4 for Cisco Catalyst 6800 Series Switches could allow an unauthenticated, adjacent attacker to cause a C6800-16P10G or C6800-16P10G-XL type line card to crash, resulting in a denial of service DoS condition...

CVE-2017-12238

A vulnerability in the Virtual Private LAN Service VPLS code of Cisco IOS 15.0 through 15.4 for Cisco Catalyst 6800 Series Switches could allow an unauthenticated, adjacent attacker to cause a C6800-16P10G or C6800-16P10G-XL type line card to crash, resulting in a denial of service DoS condition...

CVE-2017-12238

Cisco IOS on Catalyst 6800 Series switches (Cisco 6800-16P10G/16P10G-XL with Supervisor Engine 6T) is affected by CVE-2017-12238. The vulnerability stems from a memory management flaw in the VPLS code, exploitable by an unauthenticated, adjacent attacker who can flood the MAC address table with V...

Cisco IOS Software for Cisco Catalyst 6800 Series Switches VPLS Denial of Service Vulnerability

A vulnerability in the Virtual Private LAN Service VPLS code of Cisco IOS Software for Cisco Catalyst 6800 Series Switches could allow an unauthenticated, adjacent attacker to cause a C6800-16P10G or C6800-16P10G-XL type line card to crash, resulting in a denial of service DoS condition. The...

RHEL 6 : kernel (RHSA-2017:2760)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2017:2760 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: It was found that stacking a file system over...