3089 matches found
kernel: Heap out-of-bounds read in AF_PACKET sockets
A race condition issue was found in the way the raw packet socket implementation in the Linux kernel networking subsystem handled synchronization. A local user able to open a raw packet socket requires the CAPNETRAW capability could use this to waste resources in the kernel's ring buffer or...
Apple: Multiple Race Conditions in PCIe Message Ring protocol leading to OOB Write and OOB Read(CVE-2017-7115)
Broadcom produces Wi-Fi HardMAC SoCs which are used to handle the PHY and MAC layer processing. These chips are present in both mobile devices and Wi-Fi routers, and are capable of handling many Wi-Fi related events without delegating to the host OS. On iOS, the "AppleBCMWLANBusInterfacePCIe"...
Apple PCIe Message Ring Protocol Race Conditions Vulnerability
Exploit for macOS platform in category dos / poc Apple: Multiple Race Conditions in PCIe Message Ring protocol leading to OOB Write and OOB Read CVE-2017-7115 Broadcom produces Wi-Fi HardMAC SoCs which are used to handle the PHY and MAC layer processing. These chips are present in both mobile...
Researchers Find Phishing Site Encrypted with AES
Scammers chasing Apple credentials and payment card information have ramped up their efforts to hide their phishing page by encrypting it with AES. Researchers at Ring 0 Labs disclosed details about the operation last week, pointing out that the criminals behind this activity are buffering a fair...
CVE-2017-1000111
A race condition issue was found in the way the raw packet socket implementation in the Linux kernel networking subsystem handled synchronization. A local user able to open a raw packet socket requires the CAPNETRAW capability could use this to waste resources in the kernel's ring buffer or...
UBUNTU-CVE-2017-1000111
Linux kernel: heap out-of-bounds in AFPACKET sockets. This new issue is analogous to previously disclosed CVE-2016-8655. In both cases, a socket option that changes socket state may race with safety checks in packetsetring. Previously with PACKETVERSION. This time with PACKETRESERVE. The solution...
PT-2017-3105 · Linux +5 · Linux Kernel +5
Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to a heap out-of-bounds condition in AF PACKET sockets, similar to a previously disclosed problem. It involves a race condition between a socket option that change...
Qemu: usb: xHCI: infinite loop vulnerability in xhci_ring_fetch
The xhciringfetch function in hw/usb/hcd-xhci.c in QEMU aka Quick Emulator allows local guest OS administrators to cause a denial of service infinite loop and QEMU process crash by leveraging failure to limit the number of link Transfer Request Blocks TRB to process...
Qemu: net: rtl8139: infinite loop while transmit in C+ mode
The rtl8139cplustransmit function in hw/net/rtl8139.c in QEMU aka Quick Emulator allows local guest OS administrators to cause a denial of service infinite loop and CPU consumption by leveraging failure to limit the ring descriptor count...
The vulnerability of the ring_buffer_resize function in the Linux kernel’s profiling subsystem allows a hacker to increase their privileges.
The vulnerability of the ringbufferresize function in the Linux kernel’s profiling subsystem arises due to integer overflow or cyclic shift attacks. Exploiting this vulnerability can allow an attacker, operating locally, to increase their privileges by writing to the file in the...
The vulnerability of the `packet_set_ring` function in the Linux operating system allows a hacker to trigger a service failure or cause other adverse effects.
The vulnerability of the packetsetring function in the Linux operating system arises from the execution of an operation beyond the buffer boundaries in memory. Exploiting this vulnerability can allow a local attacker to cause service failures or other adverse effects through a specially crafted...
Microsoft Windows - 'nt!NtQueryInformationWorkerFactory (WorkerFactoryBasicInformation)' Kernel Stack Memory Disclosure
/ Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1214&desc=2 We have discovered that the nt!NtQueryInformationWorkerFactory system call called with the WorkerFactoryBasicInformation 7 information class discloses portions of uninitialized kernel stack memory to user-mode clients...
Microsoft Windows - 'win32k!NtGdiGetOutlineTextMetricsInternalW' Kernel Stack Memory Disclosure
/ Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1179 We have discovered that it is possible to disclose portions of uninitialized kernel stack memory to user-mode applications in Windows 7-10 through the win32k!NtGdiGetOutlineTextMetricsInternalW system call. The system call...
kernel: net/packet: overflow in check for priv area size
It was found that the packetsetring function of the Linux kernel's networking implementation did not properly validate certain block-size data. A local attacker with CAPNETRAW capability could use this flaw to trigger a buffer overflow resulting in a system crash or a privilege escalation...
kernel: net/packet: overflow in check for priv area size
It was found that the packetsetring function of the Linux kernel's networking implementation did not properly validate certain block-size data. A local attacker with CAPNETRAW capability could use this flaw to trigger a buffer overflow resulting in a system crash or a privilege escalation...
kernel: net/packet: overflow in check for priv area size
It was found that the packetsetring function of the Linux kernel's networking implementation did not properly validate certain block-size data. A local attacker with CAPNETRAW capability could use this flaw to trigger a buffer overflow resulting in a system crash or a privilege escalation...
DEBIAN-CVE-2017-8112
hw/scsi/vmwpvscsi.c in QEMU aka Quick Emulator allows local guest OS privileged users to cause a denial of service infinite loop and CPU consumption via the message ring page count...
CVE-2017-8112
hw/scsi/vmwpvscsi.c in QEMU aka Quick Emulator allows local guest OS privileged users to cause a denial of service infinite loop and CPU consumption via the message ring page count...
