CVE-2024-36056: Improper Privilege Management

Hw64.sys in Marvin Test HW.exe before 5.0.5.0 allows unprivileged user-mode processes to arbitrarily map physical memory via IOCTL 0x9c406490 for IoAllocateMdl, MmBuildMdlForNonPagedPool, and MmMapLockedPages, leading to NT AUTHORITY\SYSTEM privilege escalation...

CVE-2021-47277

In the Linux kernel, the following vulnerability has been resolved: kvm: avoid speculation-based attacks from out-of-range memslot accesses KVM's mechanism for accessing guest memory translates a guest physical address gpa to a host virtual address using the right-shifted gpa also known as gfn an...

CVE-2021-47277

CVE-2021-47277 affects the Linux kernel KVM path for guest memory translation. The issue arises when speculative execution may use an invalid guest frame number (gfn) to compute an out-of-bounds host virtual address (hva) in __gfn_to_hva_memslot, enabling a potential two-read Spectre gadget where...

CVE-2024-20021: Improper Privilege Management

In atf spm, there is a possible way to remap physical memory to virtual memory due to a logic error. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08584568; Issue ID: MSV-1249...

CVE-2024-27048 wifi: brcm80211: handle pmk_op allocation failure

In the Linux kernel, the following vulnerability has been resolved: wifi: brcm80211: handle pmkop allocation failure The kzalloc in brcmfpmksav3op will return null if the physical memory has run out. As a result, if we dereference the null value, the null pointer dereference bug will happen. Retu...

CVE-2024-27048

In the Linux kernel, the following vulnerability has been resolved: wifi: brcm80211: handle pmkop allocation failure The kzalloc in brcmfpmksav3op will return null if the physical memory has run out. As a result, if we dereference the null value, the null pointer dereference bug will happen. Retu...

CVE-2024-26795 riscv: Sparse-Memory/vmemmap out-of-bounds fix

In the Linux kernel, the following vulnerability has been resolved: riscv: Sparse-Memory/vmemmap out-of-bounds fix Offset vmemmap so that the first page of vmemmap will be mapped to the first page of physical memory in order to ensure that vmemmap’s bounds will be respected during...

CVE-2024-26795

CVE-2024-26795 concerns a Linux kernel riscv issue where the Sparse-Memory/vmemmap was out-of-bounds due to misoffsetting of vmemmap. The fix maps the first page of vmemmap to the first page of physical memory to ensure vmemmap bounds are respected during pfn_to_page() and page_to_pfn() operation...

CVE-2024-26795 riscv: Sparse-Memory/vmemmap out-of-bounds fix

In the Linux kernel, the following vulnerability has been resolved: riscv: Sparse-Memory/vmemmap out-of-bounds fix Offset vmemmap so that the first page of vmemmap will be mapped to the first page of physical memory in order to ensure that vmemmap’s bounds will be respected during...

CVE-2024-26795 riscv: Sparse-Memory/vmemmap out-of-bounds fix

In the Linux kernel, the following vulnerability has been resolved: riscv: Sparse-Memory/vmemmap out-of-bounds fix Offset vmemmap so that the first page of vmemmap will be mapped to the first page of physical memory in order to ensure that vmemmap’s bounds will be respected during...

CVE-2024-26795

In the Linux kernel, the following vulnerability has been resolved: riscv: Sparse-Memory/vmemmap out-of-bounds fix Offset vmemmap so that the first page of vmemmap will be mapped to the first page of physical memory in order to ensure that vmemmap’s bounds will be respected during...

[SECURITY] Fedora 39 Update: rust-vm-memory-0.14.0-1.fc39

Safe abstractions for accessing the VM physical memory...

Fedora: Security Advisory for rust-vm-memory (FEDORA-2024-04877592b7)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Linux 5.6 io_uring Cred Refcount Overflow Exploit

Linux versions 5.6 and above appear to suffer from a cred refcount overflow when handling approximately 39 gigabytes of memory usage via iouring. Linux =5.6: cred refcount overflow at 39 GiB memory usage via iouring see also my related prior bug reports about overflowing refcounts with lots of RA...

PT-2023-27032 · Undefined · Undefined

on to the next stage, the purpose of which was access to the iOS kernel. The kernel was manipulated using vulnerabilities CVE-2023-42434 and CVE-2023-39606. The operation of the first one opened read and write access to the entire physical memory of the device, the use of the...

Linpmem - A Physical Memory Acquisition Tool For Linux

Like its Windows counterpart, Winpmem, this is not a traditional memory dumper. Linpmem offers an API for reading from any physical address, including reserved memory and memory holes , but it can also be used for normal memory dumping. Furthermore, the driver offers a variety of access modes to...

Fedora 37 : firecracker (2023-1db67725f2)

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-1db67725f2 advisory. Rebuild dependent packages for vm-memory v0.12.2 to address CVE-2023-41051 / RUSTSEC-2023-0056. - https://vulners.com/cve/CVE-2023-41051 -...

CVE-2023-41051 Default functions in VolatileMemory trait lack bounds checks in vm-memory

In a typical Virtual Machine Monitor VMM there are several components, such as boot loader, virtual device drivers, virtio backend drivers and vhost drivers, that need to access the VM physical memory. The vm-memory rust crate provides a set of traits to decouple VM memory consumers from VM memor...

CVE-2023-2598

A flaw was found in the fixed buffer registration code for iouring iosqebufferregister in iouring/rsrc.c in the Linux kernel that allows out-of-bounds access to physical memory beyond the end of the buffer. This flaw enables full local privilege escalation...

CVE-2023-2598

A flaw was found in the fixed buffer registration code for iouring iosqebufferregister in iouring/rsrc.c in the Linux kernel that allows out-of-bounds access to physical memory beyond the end of the buffer. This flaw enables full local privilege escalation...