Windows Hyper-V Privilege Escalation

The vulnerability of the Windows Hyper-V hardware virtualization system in Windows operating systems is related to the execution of operations beyond the buffer in memory. Exploiting this vulnerability can allow an attacker to gain increased privileges...

firmware: cs_dsp: Prevent buffer overrun when processing V2 alg headers

...

CVE-2021-46746

Lack of stack protection exploit mechanisms in ASP Secure OS Trusted Execution Environment TEE may allow a privileged attacker with access to AMD signing keys to c006Frrupt the return address, causing a stack-based buffer overrun, potentially leading to a denial of service...

CVE-2021-46746

CVE-2021-46746 : The AMD ASP/TEE stack protection gap allows a privileged attacker with access to AMD signing keys to corrupt the return address via a stack-based buffer overrun, potentially causing a denial of service. This aligns with AMD’s CVE entry (base score 5.2, local access, high attack c...

CVE-2021-46746

Lack of stack protection exploit mechanisms in ASP Secure OS Trusted Execution Environment TEE may allow a privileged attacker with access to AMD signing keys to c006Frrupt the return address, causing a stack-based buffer overrun, potentially leading to a denial of service...

CVE-2021-46746: Buffer Copy without Checking Size of Input

Lack of stack protection exploit mechanisms in ASP Secure OS Trusted Execution Environment TEE may allow a privileged attacker with access to AMD signing keys to c006Frrupt the return address, causing a stack-based buffer overrun, potentially leading to a denial of service...

ROS-20240812-16

Vulnerability of the dovccioctl function in the net/atm/ioctl.c module of the ATM Asynchronous Transfer Mode network protocol implementation of the Linux kernel is related to the reuse of a previously exploited ATM protocol. Asynchronous Transfer Mode kernel of the Linux operating system is relat...

PT-2024-35570

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.65 Description The issue is related to a buffer overrun in the ima eventdigest init common function. The ima eventdigest init function calls ima eventdigest init common with HASH ALGO LAST, which is then used...

TOTOLINK CP450 Router Loginauth Function Injection

The vulnerability of the loginauth function in the /cgi-bin/cstecgi.cgi script of the TOTOLINK CP450 router’s microprogramming system is related to the issue of data being written outside the buffer in memory when processing the httphost parameter. Exploiting this vulnerability allows a malicious...

Linux kernel RISC-V Function Use-After-Free

The vulnerability of the functions sbicpustart in the module arch/riscv/kernel/cpuopssbi.c and cpuupdatesecondarybootdata in the module arch/riscv/kernel/cpuopsspinwait.c in the Linux operating system’s kernel on RISC-V processors is related to memory writing beyond the allocated buffer...

Linux kdb_read() Buffer Overflow

The vulnerability of the kdbread function in the kernel/debug/kdb/kdbio.c file of the Linux operating system is related to memory writing beyond the bounds of the allocated buffer. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibilit...

SUSE CVE-2024-41038

In the Linux kernel, the following vulnerability has been resolved: firmware: csdsp: Prevent buffer overrun when processing V2 alg headers Check that all fields of a V2 algorithm header fit into the available firmware data buffer. The wmfw V2 format introduced variable-length strings in the...

SUSE CVE-2024-41056

In the Linux kernel, the following vulnerability has been resolved: firmware: csdsp: Use strnlen on name fields in V1 wmfw files Use strnlen instead of strlen on the algorithm and coefficient name string arrays in V1 wmfw files. In V1 wmfw files the name is a NUL-terminated string in a fixed-size...

SUSE CVE-2024-41086

In the Linux kernel, the following vulnerability has been resolved: bcachefs: Fix sbfielddowngrade validation - bch2sbdowngradevalidate wasn't checking for a downgrade entry extending past the end of the superblock section - foreachdowngradeentry is used in totext and needs to work on malformed...

SUSE CVE-2024-42117

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: ASSERT when failing to find index by plane/stream id WHY finddispcfgidxbyplaneid and finddispcfgidxbystreamid returns an array index and they return -1 when not found; however, -1 is not a valid index number. HOW...

SUSE CVE-2024-42118

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Do not return negative stream id for array WHY resourcestreamtostreamidx returns an array index and it return -1 when not found; however, -1 is not a valid array index number. HOW When this happens, call ASSERT,...

SUSE CVE-2024-42119

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Skip finding free audio for unknown engineid WHY ENGINEIDUNKNOWN = -1 and can not be used as an array index. Plus, it also means it is uninitialized and does not need free audio. HOW Skip and return NULL. This...

SUSE CVE-2024-42120

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check pipe offset before setting vblank pipectx has a size of MAXPIPES so checking its index before accessing the array. This fixes an OVERRUN issue reported by Coverity...

PT-2024-33833

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.58 Description: A string buffer overrun vulnerability has been resolved in the Linux kernel. The issue occurs when copying media name and if name to name parts, which may overwrite the destination. This is d...

PT-2024-17901 · Ashlar Vellum · Ashlar-Vellum Cobalt

Name of the Vulnerable Software and Affected Versions: Ashlar-Vellum Cobalt affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability, as t...