CVE-2024-26640 tcp: add sanity checks to rx zerocopy

In the Linux kernel, the following vulnerability has been resolved: tcp: add sanity checks to rx zerocopy TCP rx zerocopy intent is to map pages initially allocated from NIC drivers, not pages owned by a fs. This patch adds to canmapfrag these additional checks: - Page must not be a compound one....

CVE-2024-26640 tcp: add sanity checks to rx zerocopy

In the Linux kernel, the following vulnerability has been resolved: tcp: add sanity checks to rx zerocopy TCP rx zerocopy intent is to map pages initially allocated from NIC drivers, not pages owned by a fs. This patch adds to canmapfrag these additional checks: - Page must not be a compound one....

CVE-2024-26640

CVE-2024-26640 — Linux kernel TCP rx zerocopy sanity checks (Mode C) Affects: Linux kernel TCP rx zerocopy path. Root cause: can_map_frag() lacked validation when mapping NIC-allocated pages, risking misuse of pages owned by filesystems. The patch adds two checks: (1) the page must not be a compo...

CVE-2024-26640 tcp: add sanity checks to rx zerocopy

In the Linux kernel, the following vulnerability has been resolved: tcp: add sanity checks to rx zerocopy TCP rx zerocopy intent is to map pages initially allocated from NIC drivers, not pages owned by a fs. This patch adds to canmapfrag these additional checks: - Page must not be a compound one....

CVE-2024-26640

In the Linux kernel, the following vulnerability has been resolved: tcp: add sanity checks to rx zerocopy TCP rx zerocopy intent is to map pages initially allocated from NIC drivers, not pages owned by a fs. This patch adds to canmapfrag these additional checks: - Page must not be a compound one....

Cisco Unified SIP Phone 3905 Permissions, Privileges, and Access Controls (CVE-2014-0721)

The Cisco Unified SIP Phone 3905 with firmware before 9.41 allows remote attackers to obtain root access via a session on the test interface on TCP port 7870, aka Bug ID CSCuh75574. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more...

Oracle Linux 9 : kernel (ELSA-2024-1248)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-1248 advisory. - drm/amdgpu: Fix potential fence use-after-free v2 Jan Stancek RHEL-24501 RHEL-24504 RHEL-22506 RHEL-22507 CVE-2023-51042 - netfilter: nftables: skip...

Ubuntu 16.04 LTS / 18.04 LTS : Linux kernel vulnerabilities (USN-6701-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6701-1 advisory. Ruihan Li discovered that the bluetooth subsystem in the Linux kernel did not properly perform permissions checks when handling HCI sockets. ...

Cisco IP Phones TCP Packet Flood Denial of Service (CVE-2020-3574)

A vulnerability in the TCP packet processing functionality of Cisco IP Phones could allow an unauthenticated, remote attacker to cause the phone to stop responding to incoming calls, drop connected calls, or unexpectedly reload. The vulnerability is due to insufficient TCP ingress packet rate...

CVE-2021-47132

In the Linux kernel, the following vulnerability has been resolved: mptcp: fix skforwardmemory corruption on retransmission MPTCP skforwardmemory handling is a bit special, as such field is protected by the msk socket spinlock, instead of the plain socket lock. Currently we have a code path...

CVE-2021-47132

In the Linux kernel, the following vulnerability has been resolved: mptcp: fix skforwardmemory corruption on retransmission MPTCP skforwardmemory handling is a bit special, as such field is protected by the msk socket spinlock, instead of the plain socket lock. Currently we have a code path...

UBUNTU-CVE-2021-47132

In the Linux kernel, the following vulnerability has been resolved: mptcp: fix skforwardmemory corruption on retransmission MPTCP skforwardmemory handling is a bit special, as such field is protected by the msk socket spinlock, instead of the plain socket lock. Currently we have a code path...

CVE-2021-47131 net/tls: Fix use-after-free after the TLS device goes down and up

In the Linux kernel, the following vulnerability has been resolved: net/tls: Fix use-after-free after the TLS device goes down and up When a netdev with active TLS offload goes down, tlsdevicedown is called to stop the offload and tear down the TLS context. However, the socket stays alive, and it...

CVE-2024-28854 Slow loris vulnerability with default configuration in tls-listener

tls-listener is a rust lang wrapper around a connection listener to support TLS. With the default configuration of tls-listener, a malicious user can open 6.4 TcpStreams a second, sending 0 bytes, and can trigger a DoS. The default configuration options make any public service using...

CVE-2023-7250

A flaw was found in iperf, a utility for testing network performance using TCP, UDP, and SCTP. A malicious or malfunctioning client can send less than the expected amount of data to the iperf server, which can cause the server to hang indefinitely waiting for the remainder or until the connection...

Mobatek MobaXterm 10.4 (CVE-2017-15376)

The version of Mobatek MobaXterm installed on the remote host is 10.4. It is, therefore, affected by a vulnerability as referenced in the CVE-2017-15376 advisory. - The TELNET service in Mobatek MobaXterm 10.4 does not require authentication, which allows remote attackers to execute arbitrary...

PT-2024-11182 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to MPTCP sk forward memory handling, which is protected by the msk socket spin lock. A code path updating this field without handling the relevant lock can cause...

PT-2024-22368 · Corewcf · Corewcf

Name of the Vulnerable Software and Affected Versions: CoreWCF versions prior to 1.4.2 CoreWCF versions prior to 1.5.2 Description: The issue affects NetFraming based CoreWCF services, where extra system resources could be consumed by connections being left established instead of closing or...

KiTTY 0.76.1.13 - Start Duplicated Session Username Buffer Overflow Exploit

Exploit Title: KiTTY 0.76.1.13 - 'Start Duplicated Session Username' Buffer Overflow Exploit Author: DEFCESCO Austin A. DeFrancesco Vendor Homepage: https://github.com/cyd01/KiTTY/= Software Link: https://github.com/cyd01/KiTTY/releases/download/v0.76.1.13/kitty-bin-0.76.1.13.zip Version: ≤...

Backdoor.Win32.Emegrab.b MVID-2024-0675 Buffer Overflow

Discovery / credits: Malvuln John Page aka hyp3rlinx c 2024 Original source: https://malvuln.com/advisory/19a14d0414aec62ef38378de2e8b259d.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Emegrab.b Vulnerability: Remote Stack Buffer Overflow SEH Family: Emegrab...