Citrix Hypervisor Security Bulletin for CVE-2022-33748 & CVE-2022-33749

Several security issues have been identified in Citrix Hypervisor 8.2 LTSR CU1. These are: A malicious privileged user in a guest VM working in collaboration with a malicious privileged user in another guest VM can cause the host to crash or become unresponsive. This issue has the following CVE...

PT-2022-34623 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions v5.15.68 through v5.15.69 Description: A potential security issue exists due to a missing cpus read lock call in the cgroup attach task all function. The actual impact and attack plausibility have not yet been proven...

PT-2022-34585 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions v5.19.9 through v5.19.11 Description: A potential security issue exists due to a missing cpus read lock call in the cgroup attach task all function. The actual impact and attack plausibility have not yet been proven...

PT-2022-34084 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.137 Description: The issue is related to a potential panic in the dl cpu busy function due to an empty cs-cpus allowed. The actual impact and attack plausibility have not yet been proven. Recommendations:...

USN-5612-1: Intel Microcode vulnerability

Pietro Borrello, Andreas Kogler, Martin Schwarzl, Daniel Gruss, Michael Schwarz and Moritz Lipp discovered that some Intel processors did not properly clear data between subsequent xAPIC MMIO reads. This could allow a local attacker to compromise SGX enclaves...

Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.15.1)

The version of AOS installed on the remote host is prior to 5.15.1. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.15.1 advisory. - rtlp2pnoaie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel through 5.3.6 lacks a certain upper-bound check,...

Design/Logic Flaw

AutomationDirect DirectLOGIC is vulnerable to a a specially crafted packet can be sent continuously to the PLC to prevent access from DirectSoft and other devices, causing a denial-of-service condition. This issue affects: AutomationDirect DirectLOGIC D0-06 series CPUs D0-06DD1 versions prior to...

CVE-2022-2004 AutomationDirect DirectLOGIC with Ethernet Communication Uncontrolled Resource Consumption

AutomationDirect DirectLOGIC is vulnerable to a a specially crafted packet can be sent continuously to the PLC to prevent access from DirectSoft and other devices, causing a denial-of-service condition. This issue affects: AutomationDirect DirectLOGIC D0-06 series CPUs D0-06DD1 versions prior to...

CVE-2022-2004: Uncontrolled Resource Consumption

AutomationDirect DirectLOGIC is vulnerable to a a specially crafted packet can be sent continuously to the PLC to prevent access from DirectSoft and other devices, causing a denial-of-service condition. This issue affects: AutomationDirect DirectLOGIC D0-06 series CPUs D0-06DD1 versions prior to...

ÆPIC and SQUIP Vulnerabilities Found in Intel and AMD Processors

A group of researchers has revealed details of a new vulnerability affecting Intel CPUs that enables attackers to obtain encryption keys and other secret information from the processors. Dubbed ÆPIC Leak, the weakness is the first-of-its-kind to architecturally disclose sensitive data in a manner...

SUSE: Security Advisory (SUSE-SU-2022:2808-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLES12: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2022:2808-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2808-1 advisory. The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bugfixes. The following security bugs were fixe...

CVE-2021-46778

Execution unit scheduler contention may lead to a side channel vulnerability found on AMD CPU microarchitectures codenamed “Zen 1”, “Zen 2” and “Zen 3” that use simultaneous multithreading SMT. By measuring the contention level on scheduler queues an attacker may potentially leak sensitive...

CVE-2021-46778

A contention-based side channel vulnerability was found in hw. Some AMD CPUs using simultaneous multithreading SMT may allow an attacker to measure the contention level on scheduler queues, leading to potential leakage of sensitive information...

FreeBSD : wolfssl -- multiple issues (9b9a5f6e-1755-11ed-adef-589cfc01894a)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 9b9a5f6e-1755-11ed-adef-589cfc01894a advisory. - AMD EPYC Processors contain an information disclosure vulnerability in the Secure Encrypted...

SUSE SLES12 Security Update : kernel (SUSE-SU-2022:2629-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2629-1 advisory. - In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image, performing some operations, and unmounting can lead to a use-after-fre...

PT-2022-33066

Name of the Vulnerable Software and Affected Versions Linux Kernel versions 4.15 through 4.19.251 Description The issue is related to a refcount leak in the meson smp prepare cpus function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versio...

PT-2022-32977

Name of the Vulnerable Software and Affected Versions Linux Kernel versions 4.15 through 5.4.204 Description A refcount leak was discovered in the meson smp prepare cpus function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions 4.15...

PT-2022-32472

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.18.11 Description The issue is related to a refcount leak in the meson smp prepare cpus function. This problem was introduced in version v4.15 and is fixed in Linux Kernel version v5.18.11. The actual impact a...

PT-2022-32852

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.130 Description A refcount leak was discovered in the meson smp prepare cpus function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior to...