Siemens SIMATIC S7-1500 TM MFP BIOS Off-by-one Error (CVE-2021-3999)

A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd may lead to memory corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and size passed to getcwd in a setuid program could use this flaw to potentially execute...

Siemens SIMATIC S7-1500 TM MFP BIOS Use After Free (CVE-2021-33574)

The mqnotify function in the GNU C Library aka glibc versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object passed through its struct sigevent parameter after it has been freed by the caller, leading to a denial of service application crash or possibly...

Siemens SIMATIC Devices Linux Kernel Use After Free (CVE-2022-1184)

A use-after-free flaw was found in fs/ext4/namei.c:dxinsertblock in the Linux kernel's filesystem sub-component. This flaw allows a local attacker with a user privilege to cause a denial of service. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot f...

Siemens SIMATIC Devices Linux Kernel Improper Resource Shutdown or Release (CVE-2022-3594)

A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this vulnerability is the function intrcallback of the file drivers/net/usb/r8152.c of the component BPF. The manipulation leads to logging of excessive data. The attack can be launched remotely. It is...

Siemens SIMATIC Devices Linux Kernel Out-of-bounds Read (CVE-2022-2905)

An out-of-bounds memory read flaw was found in the Linux kernel's BPF subsystem in how a user calls the bpftailcall function with a key larger than the maxentries of the map. This flaw allows a local user to gain unauthorized access to data. This plugin only works with Tenable.ot. Please visit...

Siemens SIMATIC Devices Linux Kernel Out-of-bounds Write (CVE-2022-47518)

An issue was discovered in the Linux kernel before 6.0.11. Missing validation of the number of channels in drivers/net/wireless/microchip/wilc1000/cfg80211.c in the WILC1000 wireless driver can trigger a heap-based buffer overflow when copying the list of operating channels from Wi-Fi management...

Siemens SIMATIC S7-1500 TM MFP BIOS Incorrect Default Permissions (CVE-2021-20269)

A flaw was found in the permissions of a log file created by kexec- tools. This flaw allows a local unprivileged user to read this file and leak kernel internal information from a previous panic. The highest threat from this vulnerability is to confidentiality. This flaw affects kexec-tools shipp...

Siemens SIMATIC Devices Linux Kernel Incorrect Authorization (CVE-2022-20572)

In veritytarget of dm-verity-target.c, there is a possible way to modify read-only files due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android...

Siemens SIMATIC S7-1500 TM MFP BIOS Use After Free (CVE-2021-42379)

A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the nextinputfile function. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL...

Siemens SIMATIC, SCALANCE and RUGGEDCOM Devices Linux Kernel Improper Certificate Validation (CVE-2022-1343)

Under certain circumstances, the command line OCSP verify function reports successful verification when the varification in fact failed. In this case the incorrect successful response will also be accompanied by error messages showing the failure and contradicting the apparently successful result...

Siemens SIMATIC Devices Linux Kernel Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') (CVE-2022-3303)

A race condition flaw was found in the Linux kernel sound subsystem due to improper locking. It could lead to a NULL pointer dereference while handling the SNDCTLDSPSYNC ioctl. A privileged local user root or member of the audio group could use this flaw to crash the system, resulting in a denial...

Siemens SIMATIC Devices Linux Kernel NULL Pointer Dereference (CVE-2022-2153)

A flaw was found in the Linux kernel's KVM when attempting to set a SynIC IRQ. This issue makes it possible for a misbehaving VMM to write to SYNIC/STIMER MSRs, causing a NULL pointer dereference. This flaw allows an unprivileged local attacker on the host to issue specific ioctl calls, causing a...

Siemens SIMATIC Devices Linux Kernel Improper Restriction of Operations within the Bounds of a Memory Buffer (CVE-2022-3564)

A vulnerability classified as critical was found in Linux Kernel. Affected by this vulnerability is the function l2capreassemblesdu of the file net/bluetooth/l2capcore.c of the component Bluetooth. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The...

Siemens SIMATIC Devices Linux Kernel Use After Free (CVE-2022-32250)

net/netfilter/nftablesapi.c in the Linux kernel through 5.18.1 allows a local user able to create user/net namespaces to escalate privileges to root because an incorrect NFTSTATEFULEXPR check leads to a use-after-free. This plugin only works with Tenable.ot. Please visit...

Siemens SIMATIC Devices Linux Kernel Improper Resource Shutdown or Release (CVE-2022-3646)

A vulnerability, which was classified as problematic, has been found in Linux Kernel. This issue affects the function nilfsattachlogwriter of the file fs/nilfs2/segment.c of the component BPF. The manipulation leads to memory leak. The attack may be initiated remotely. It is recommended to apply ...

Siemens SIMATIC Devices Linux Kernel Missing Release of Memory after Effective Lifetime (CVE-2022-3629)

A vulnerability was found in Linux Kernel. It has been declared as problematic. This vulnerability affects the function vsockconnect of the file net/vmwvsock/afvsock.c. The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. VDB-211930 is the identifier assign...

Siemens SIMATIC Devices Linux Kernel Incomplete Cleanup (CVE-2022-21166)

Incomplete cleanup in specific special register write operations for some IntelR Processors may allow an authenticated user to potentially enable information disclosure via local access. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more...

Siemens SIMATIC Devices Linux Kernel Missing Release of Memory after Effective Lifetime (CVE-2022-3633)

A vulnerability classified as problematic has been found in Linux Kernel. Affected is the function j1939sessiondestroy of the file net/can/j1939/transport.c. The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is...

Siemens SIMATIC Devices Linux Kernel Access of Resource Using Incompatible Type ('Type Confusion') (CVE-2023-1077)

In the Linux kernel, picknextrtentity may return a type confused entry, not detected by the BUGON condition, as the confused entry will not be NULL, but listhead.The buggy error condition would lead to a type confused entry with the list head,which would then be used as a type confused...

Siemens SIMATIC S7-1500 TM MFP BIOS NULL Pointer Dereference (CVE-2021-42376)

A NULL pointer dereference in Busybox's hush applet leads to denial of service when processing a crafted shell command, due to missing validation after a \x03 delimiter character. This may be used for DoS under very rare conditions of filtered command input. This plugin only works with Tenable.ot...