Code injection

VMware Fusion13.x prior to 13.5 contains a TOCTOU Time-of-check Time-of-use vulnerability that occurs during installation for the first time the user needs to drag or copy the application to a folder from the '.dmg' volume or when installing an upgrade. A malicious actor with local...

Dell Client BIOS TOCTOU (DSA-2023-152)

The Dell BIOS on the remote device is missing a security patch and is, therefore, affected by a Time-of-check Time-of-use vulnerability. A local authenticated malicious user with physical access to the system could potentially exploit this vulnerability by using a specifically timed DMA transacti...

Design/Logic Flaw

A potential Time-of-Check to Time-of-Use TOCTOU vulnerability has been identified in certain HP PC products using AMI UEFI Firmware system BIOS, which might allow arbitrary code execution. AMI has released updates to mitigate the potential vulnerability...

CVE-2023-26299

CVE-2023-26299 describes a potential TOCTOU vulnerability in HP PCs that use AMI UEFI firmware (system BIOS), which could allow arbitrary code execution. The issue stems from how TOCTOU could be exploited on affected systems, with HP/AMI providing mitigations via firmware updates. Connected docum...

AMI UEFI Firmware June 2023 Security Update (TOCTOU)

A potential Time-of-Check to Time-of-Use TOCTOU vulnerability has been identified in certain HP PC products using AMI UEFI Firmware system BIOS, which might allow arbitrary code execution. AMI has released updates to mitigate the potential vulnerability. AMI has released updates to mitigate the...

CVE-2023-2007

A time-of-check time-of-use TOCTOU information disclosure vulnerability was found in the Linux Kernel DPT I2O controller. This issue results from the lack of proper locking when performing operations on an object, allowing a privileged local user to escalate privileges and execute arbitrary code ...

CVE-2021-26356

A TOCTOU in ASP bootloader may allow an attacker to tamper with the SPI ROM following data read to memory potentially resulting in S3 data corruption and information disclosure...

CVE-2022-43779

A potential Time-of-Check to Time-of-Use TOCTOU vulnerability has been identified in certain HP PC products using AMI UEFI Firmware system BIOS which might allow arbitrary code execution, denial of service, and information disclosure. AMI has released updates to mitigate the potential vulnerabili...

Information disclosure

A potential Time-of-Check to Time-of-Use TOCTOU vulnerability has been identified in certain HP PC products using AMI UEFI Firmware system BIOS which might allow arbitrary code execution, denial of service, and information disclosure. AMI has released updates to mitigate the potential vulnerabili...

Information disclosure

A potential Time-of-Check to Time-of-Use TOCTOU vulnerability has been identified in the BIOS for certain HP PC products which may allow arbitrary code execution, denial of service, and information disclosure. HP is releasing BIOS updates to mitigate the potential vulnerability...

CVE-2023-20523

TOCTOU in the ASP may allow a physical attacker to write beyond the buffer bounds, potentially leading to a loss of integrity or denial of service...

CVE-2021-46795

A TOCTOU time-of-check to time-of-use vulnerability exists where an attacker may use a compromised BIOS to cause the TEE OS to read memory out of bounds that could potentially result in a denial of service...

CVE-2021-46795

CVE-2021-46795 is a TOCTOU vulnerability where a compromised BIOS can trigger the TEE OS to read memory out-of-bounds, potentially causing a denial of service. Public details consistently describe the affected component as the TEE/ASP-SMU hardware stack in AMD platforms with BIOS-based mitigation...

PT-2023-12589 · Tee Os · Tee Os

Name of the Vulnerable Software and Affected Versions: TEE OS affected versions not specified Description: A TOCTOU time-of-check to time-of-use issue exists, allowing an attacker with a compromised BIOS to potentially cause the TEE OS to read memory out of bounds, resulting in a denial of servic...

CVE-2022-39908

TOCTOU vulnerability in Samsung decoding library for video thumbnails prior to SMR Dec-2022 Release 1 allows local attacker to perform Out-Of-Bounds Write...

CVE-2022-39908

TOCTOU vulnerability in Samsung decoding library for video thumbnails prior to SMR Dec-2022 Release 1 allows local attacker to perform Out-Of-Bounds Write...

CVE-2022-39908

TOCTOU vulnerability in Samsung decoding library for video thumbnails prior to SMR Dec-2022 Release 1 allows local attacker to perform Out-Of-Bounds Write...

CVE-2022-30774

DMA attacks on the parameter buffer used by the PnpSmm driver could change the contents after parameter values have been checked but before they are used a TOCTOU attack DMA attacks on the parameter buffer used by the PnpSmm driver could change the contents after parameter values have been checke...

CVE-2022-30773

DMA attacks on the parameter buffer used by the IhisiSmm driver could change the contents after parameter values have been checked but before they are used a TOCTOU attack. DMA attacks on the parameter buffer used by the IhisiSmm driver could change the contents after parameter values have been...

PT-2022-21944 · Insyde · Int15Servicesmm

Name of the Vulnerable Software and Affected Versions: Int15ServiceSmm software SMI handler versions prior to Kernel 5.2: 05.27.23 Int15ServiceSmm software SMI handler versions prior to Kernel 5.3: 05.36.23 Int15ServiceSmm software SMI handler versions prior to Kernel 5.4: 05.44.23 Int15ServiceSm...