Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel, which originates in the rawnand submodule of the mtd module, where the allocation of the "user" pointer in the...

PT-2025-40081

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.1.82 Description The Linux kernel mtd subsystem, specifically the STM32 FMC2 NAND controller, contained a flaw where overlapping mappings could occur on the ECC buffer. This issue was addressed by utilizing a...

The vulnerability of the gpmi_nfc_exec_op() function (drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c) in the Linux kernel’s MTD driver allows a attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the gpminfcexecop function drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c in Linux kernel-based drivers is related to incorrect updates of link counters. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of...

SUSE CVE-2022-48778

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: gpmi: don't leak PM reference in error path If gpminfcapplytimings fails, the PM runtime usage counter must be dropped...

CVE-2023-30024

The MagicJack device, a VoIP solution for internet phone calls, contains a hidden NAND flash memory partition allowing unauthorized read/write access. Attackers can exploit this by replacing the original software with a malicious version, leading to ransomware deployment on the host computer...

CVE-2023-30024

The MagicJack device, a VoIP solution for internet phone calls, contains a hidden NAND flash memory partition allowing unauthorized read/write access. Attackers can exploit this by replacing the original software with a malicious version, leading to ransomware deployment on the host computer...

CVE-2023-30024

The MagicJack device, a VoIP solution for internet phone calls, contains a hidden NAND flash memory partition allowing unauthorized read/write access. Attackers can exploit this by replacing the original software with a malicious version, leading to ransomware deployment on the host computer...

CVE-2023-30024

CVE-2023-30024 concerns the MagicJack A921 USB Phone Jack. The vulnerability stems from a hidden NAND flash memory partition that allows unauthorized read/write access, enabling an attacker to replace the firmware with a malicious version and trigger ransomware deployment on the host computer. Af...

CVE-2023-30024

The MagicJack device, a VoIP solution for internet phone calls, contains a hidden NAND flash memory partition allowing unauthorized read/write access. Attackers can exploit this by replacing the original software with a malicious version, leading to ransomware deployment on the host computer...

CVE-2023-30024: Improper Privilege Management

The MagicJack device, a VoIP solution for internet phone calls, contains a hidden NAND flash memory partition allowing unauthorized read/write access. Attackers can exploit this by replacing the original software with a malicious version, leading to ransomware deployment on the host computer...

CVE-2022-45552

An Insecure Permissions vulnerability in Shenzhen Zhiboton Electronics ZBT WE1626 Router v 21.06.18 allows attackers to obtain sensitive information via SPI bus interface connected to pinout of the NAND flash memory...

CVE-2022-45552

An Insecure Permissions vulnerability in Shenzhen Zhiboton Electronics ZBT WE1626 Router v 21.06.18 allows attackers to obtain sensitive information via SPI bus interface connected to pinout of the NAND flash memory...

Design/Logic Flaw

An Insecure Permissions vulnerability in Shenzhen Zhiboton Electronics ZBT WE1626 Router v 21.06.18 allows attackers to obtain sensitive information via SPI bus interface connected to pinout of the NAND flash memory...

CVE-2022-45552

An Insecure Permissions vulnerability in Shenzhen Zhiboton Electronics ZBT WE1626 Router v 21.06.18 allows attackers to obtain sensitive information via SPI bus interface connected to pinout of the NAND flash memory...

CVE-2022-45552

CVE-2022-45552 concerns an Insecure Permissions vulnerability in Shenzhen Zhiboton Electronics ZBT WE1626 Router v21.06.18. The issue arises from exposure of the NAND flash memory via the SPI bus interface, coupled with insecure permissions, allowing an attacker to read sensitive information from...

CVE-2022-45552: Incorrect Default Permissions

An Insecure Permissions vulnerability in Shenzhen Zhiboton Electronics ZBT WE1626 Router v 21.06.18 allows attackers to obtain sensitive information via SPI bus interface connected to pinout of the NAND flash memory...

Hands-On IoT Hacking: Rapid7 at DEF CON 30 IoT Village, Part 1

Rapid7 was back this year at DEF CON 30 participating at the IoT Village with another hands-on hardware hacking exercise, with the goal of teaching attendees' various concepts and methods for IoT hacking. Over the years, these exercises have covered several different embedded device topics,...

PT-2022-31387

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.17.14 Description The issue is related to a possible null pointer dereference in the cadence nand dt probe function. This problem was introduced in version v5.5 and is fixed in version v5.17.14. The actual...

PT-2022-31384

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.17.14 Description The issue is related to a possible null pointer dereference in the ebu nand probe function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kerne...

PT-2022-31679

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.46 Description The issue is related to a possible null pointer dereference in the ebu nand probe function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kerne...