The vulnerability in the implementation of the show_transport_handle() function in Linux operating systems allows a malicious actor to gain unauthorized access to protected information.

The vulnerability of the showtransporthandle function in Linux operating systems is related to improper handling of pointers. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

Linux kernel 安全漏洞

The Linux kernel is a computer operating system kernel written in C and assembly language, compliant with the POSIX standard, and distributed under the GNU General Public License. A data size validation error vulnerability exists in tipcnlretrievekey in net/tipc/node.c in Linux kernel versions...

USN-4883-1 linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-gcp, linux-gcp-4.15, linux-hwe, linux-kvm, linux-oracle, linux-raspi2, linux-snapdragon vulnerabilities

Adam Nichols discovered that heap overflows existed in the iSCSI subsystem in the Linux kernel. A local attacker could use this to cause a denial of service system crash or possibly execute arbitrary code. CVE-2021-27365 Adam Nichols discovered that the iSCSI subsystem in the Linux kernel did not...

OpenSSL Trust Management Issues Vulnerabilities

OpenSSL is an open source capable general-purpose cryptographic library from the Openssl team that implements the Secure Sockets Layer SSLv2/v3 and Secure Transport Layer TLSv1 protocols. The product supports a variety of cryptographic algorithms , including symmetric ciphers , hash algorithms ,...

MGASA-2021-0152 Updated kernel-linus packages fix security issues

This kernel-linus update is based on upstream 5.10.25 and fixes at least the following security issues: A NULL pointer dereference flaw was found in the Linux kernel's GPU Nouveau driver functionality in versions prior to 5.12-rc1 in the way the user calls ioctl DRMIOCTLNOUVEAUCHANNELALLOC. This...

CVE-2019-14852

A flaw was found in 3scale’s APIcast gateway that enabled the TLS 1.0 protocol. An attacker could target traffic using this weaker protocol and break its encryption, gaining access to unauthorized information. Version shipped in Red Hat 3scale API Management Platform is vulnerable to this issue...

rubygem-em-http-request: missing SSL hostname validation allows MITM

A flaw was found in rubygem-em-http-request. The eventmachine library does not verify the hostname in a TLS server certificate which can allow an attacker to perform a man-in-the-middle attack. The highest threat from this vulnerability is to data confidentiality and integrity...

Oracle Linux 7 / 8 : Unbreakable Enterprise kernel (ELSA-2021-9114)

The remote Oracle Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-9114 advisory. - scsi: iscsi: Verify lengths on passthrough PDUs Chris Leech Orabug: 32603379 CVE-2021-27363 CVE-2021-27364 CVE-2021-27365 - scsi: iscsi: Ensure...

Oracle Linux 7 : Unbreakable Enterprise kernel (ELSA-2021-9112)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-9112 advisory. - scsi: iscsi: Verify lengths on passthrough PDUs Chris Leech Orabug: 32634994 CVE-2021-27363 CVE-2021-27364 CVE-2021-27365 - scsi: iscsi: Ensure sysfs...

Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2021-9113)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-9113 advisory. - scsi: iscsi: Ensure sysfs attributes are limited to PAGESIZE Chris Leech Orabug: 32603382 CVE-2021-27363 CVE-2021-27364 CVE-2021-27365 - scsi:...

An issue was discovered in the Linux kernel through 5.11.3. A kernel pointer leak can be used to determine the address of the iscsi_transport structure. When an iSCSI transport is registered with the iSCSI subsystem the transport's handle is available to unprivileged users via the sysfs file system at /sys/class/iscsi_transport/$TRANSPORT_NAME/handle. When read the show_transport_handle function (in drivers/scsi/scsi_transport_iscsi.c) is called which leaks the handle. This handle is actually the pointer to an iscsi_transport struct in the kernel module's global variables.

...

An issue was discovered in the Linux kernel through 5.11.3. drivers/scsi/scsi_transport_iscsi.c is adversely affected by the ability of an unprivileged user to craft Netlink messages.

...

The vulnerability of the drivers/scsi/scsi_transport_iscsi.c file in the Linux operating system allows a hacker to connect to the iscsi NETLINK socket and send commands to the kernel.

The vulnerability of the drivers/scsi/scsitransportiscsi.c file in the Linux operating system is related to the lack of protection for service data. Exploiting this vulnerability allows an attacker to connect to the iscsi NETLINK socket and send commands to the kernel...

(Vulnerability) The vulnerability of the `show_transport_handle` function in Linux kernel allows a hacker to disclose sensitive information or cause service failures.

The vulnerability of the showtransporthandle function /scsi/scsitransportiscsi.c in the Linux operating system kernel is related to the lack of protection for service data. Exploiting this vulnerability could allow an attacker to disclose sensitive information or cause service failures...

The vulnerability of the `show_transport_handle` function in Linux kernel allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the showtransporthandle function /scsi/scsitransportiscsi.c in the Linux operating system is related to access control errors. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

Unspecified vulnerability in Linux kernel (CNVD-2021-19424)

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel versions 5.11.3 and earlier, which stems from a kernel pointer leak that can be used to determine the address of an iscsi...

BIG-IQ 安全漏洞

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, and load balancing. A security vulnerability exists in BIG-IQ that stems from the fact that BIG-IQ will not use Transport Layer Security TLS in an HA failover...

F5 BIG-IP 访问控制错误漏洞

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing and other functions. An information disclosure vulnerability exists in F5 BIG-IP, which stems from a failure to implement any form of authenticatio...

DEBIAN-CVE-2020-15260

PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In version 2.10 and earlier, PJSIP transport can be reused if they have the same IP address + port + protocol. However, this is...

CVE-2020-15260

PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In version 2.10 and earlier, PJSIP transport can be reused if they have the same IP address + port + protocol. However, this is...