Over The Air - Vol. 2, Pt. 3: Exploiting The Wi-Fi Stack on Apple Devices

Posted by Gal Beniamini, Project Zero In this blog post we’ll complete our goal of achieving remote kernel code execution on the iPhone 7, by means of Wi-Fi communication alone. After developing a Wi-Fi firmware exploit in the previous blog post, we are left with the task of using our newly...

Apple: Multiple Race Conditions in PCIe Message Ring protocol leading to OOB Write and OOB Read(CVE-2017-7115)

Broadcom produces Wi-Fi HardMAC SoCs which are used to handle the PHY and MAC layer processing. These chips are present in both mobile devices and Wi-Fi routers, and are capable of handling many Wi-Fi related events without delegating to the host OS. On iOS, the "AppleBCMWLANBusInterfacePCIe"...

Apple PCIe Message Ring Protocol Race Conditions Vulnerability

Exploit for macOS platform in category dos / poc Apple: Multiple Race Conditions in PCIe Message Ring protocol leading to OOB Write and OOB Read CVE-2017-7115 Broadcom produces Wi-Fi HardMAC SoCs which are used to handle the PHY and MAC layer processing. These chips are present in both mobile...

Memory corruption

In all Qualcomm products with Android releases from CAF using the Linux kernel, using a debugfs node, a write to a PCIe register can cause corruption of kernel memory...

CVE-2017-10997

In all Qualcomm products with Android releases from CAF using the Linux kernel, using a debugfs node, a write to a PCIe register can cause corruption of kernel memory...

CVE-2017-10997

In all Qualcomm products with Android releases from CAF using the Linux kernel, using a debugfs node, a write to a PCIe register can cause corruption of kernel memory...

CVE-2017-10997

CVE-2017-10997 affects Qualcomm PCIe (PCI driver) in CAF Android builds. The root cause is a write to a PCIe register via a debugfs node that can corrupt kernel memory, as described for all Qualcomm products with CAF Linux kernels. The vulnerability detail specifies the component as the PCI drive...

CVE-2017-10997: Improper Restriction of Operations within the Bounds of a Memory Buffer

In all Qualcomm products with Android releases from CAF using the Linux kernel, using a debugfs node, a write to a PCIe register can cause corruption of kernel memory...

[SECURITY] [DSA 3927-1] linux security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3927-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso August 07, 2017 https://www.debian.org/security/faq -...

Important: Red Hat Security Advisory: kernel-aarch64 security and bug fix update

An update for kernel-aarch64 is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

Mageia: Security Advisory (MGASA-2015-0435)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Privilege Elevation Issue Affecting Some Intel® Solid-State Drive Data Center Family for PCIe Products

Summary: A customer feature was added to the Intel® Solid-State Drive Data Center Family for PCIe, improving device management in the field. The initial implementation allowed for a potential privilege elevation. Description: A customer feature was added to the Intel® Solid-State Drive Data Cente...

CVE-2014-6529

Unspecified vulnerability in Oracle Sun Solaris 11 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Hermon HCA PCIe driver...

Design/Logic Flaw

Unspecified vulnerability in Oracle Sun Solaris 11 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Hermon HCA PCIe driver...

CVE-2014-6529

CVE-2014-6529 affects Oracle Solaris 11, with the Hermon HCA PCIe driver as the vulnerable component. The vulnerability is described as unspecified in the driver, enabling remote attackers to impact confidentiality, integrity, and availability. The linked Oracle Oct2014 CPU advisory (and the Sola...

CVE-2014-6529

Unspecified vulnerability in Oracle Sun Solaris 11 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Hermon HCA PCIe driver...

CVE-2014-6529: Undefined Security Weakness

Unspecified vulnerability in Oracle Sun Solaris 11 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Hermon HCA PCIe driver...

kernel, perf, python security update

CentOS Errata and Security Advisory CESA-2014:1281 Updated kernel packages that fix one security issue and several bugs are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS...

RHEL 7 : kernel (RHSA-2014:1281)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2014:1281 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. An out-of-bounds memory access flaw was found in the Linux...

CentOS 7 : kernel (CESA-2014:1281)

Updated kernel packages that fix one security issue and several bugs are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, ...