Qemu: exec: oob access during dma operation

Quick Emulator QEMU, compiled with qemumapramptr to access guests' RAM block area, is vulnerable to an OOB r/w access issue. The crash can occur if a privileged user inside a guest conducts certain DMA operations, resulting in a DoS...

Design/Logic Flaw

An issue was discovered in certain Apple products. macOS before 10.13.1 is affected. The issue involves the "APFS" component. It does not properly restrict the DMA mapping time of FileVault decryption buffers, which allows attackers to read cleartext APFS data via a crafted Thunderbolt adapter...

CVE-2017-13786

APFS DMA mapping timing vulnerability in macOS with versions before 10.13.1. The issue allows reading cleartext APFS data via a crafted Thunderbolt adapter due to insufficient restriction of DMA mapping time for FileVault decryption buffers. Apple’s security update 10.13.1 (and related Sierra/El ...

CVE-2017-13786

An issue was discovered in certain Apple products. macOS before 10.13.1 is affected. The issue involves the "APFS" component. It does not properly restrict the DMA mapping time of FileVault decryption buffers, which allows attackers to read cleartext APFS data via a crafted Thunderbolt adapter...

CVE-2017-13786: Undefined Security Weakness

An issue was discovered in certain Apple products. macOS before 10.13.1 is affected. The issue involves the "APFS" component. It does not properly restrict the DMA mapping time of FileVault decryption buffers, which allows attackers to read cleartext APFS data via a crafted Thunderbolt adapter...

PT-2017-13101

Name of the Vulnerable Software and Affected Versions macOS versions prior to 10.13.1 Description The issue involves the APFS component, which does not properly restrict the DMA mapping time of FileVault decryption buffers. This allows attackers to read cleartext APFS data via a crafted Thunderbo...

October 17, 2017—KB4041688 (OS Build 14393.1794)

None None...

Over The Air - Vol. 2, Pt. 3: Exploiting The Wi-Fi Stack on Apple Devices

Posted by Gal Beniamini, Project Zero In this blog post we’ll complete our goal of achieving remote kernel code execution on the iPhone 7, by means of Wi-Fi communication alone. After developing a Wi-Fi firmware exploit in the previous blog post, we are left with the task of using our newly...

CVE-2017-9725

In all Qualcomm products with Android releases from CAF using the Linux kernel, during DMA allocation, due to wrong data type of size, allocation size gets truncated which makes allocation succeed when it should fail...

Code injection

In all Qualcomm products with Android releases from CAF using the Linux kernel, during DMA allocation, due to wrong data type of size, allocation size gets truncated which makes allocation succeed when it should fail...

CVE-2017-9725

In all Qualcomm products with Android releases from CAF using the Linux kernel, during DMA allocation, due to wrong data type of size, allocation size gets truncated which makes allocation succeed when it should fail...

CVE-2017-9725

In all Qualcomm products with Android releases from CAF using the Linux kernel, during DMA allocation, due to wrong data type of size, allocation size gets truncated which makes allocation succeed when it should fail...

UBUNTU-CVE-2017-9725

In all Qualcomm products with Android releases from CAF using the Linux kernel, during DMA allocation, due to wrong data type of size, allocation size gets truncated which makes allocation succeed when it should fail...

CVE-2017-9725

In all Qualcomm products with Android releases from CAF using the Linux kernel, during DMA allocation, due to wrong data type of size, allocation size gets truncated which makes allocation succeed when it should fail...

CVE-2017-9725

CVE-2017-9725 affects Qualcomm CAF Android builds using the Linux kernel. Root cause: during DMA allocation, a wrong data type of size truncates the allocation size, causing it to succeed when it should fail. This yields a high-severity issue (local access, low attack complexity) as reflected in ...

CVE-2017-9725

In all Qualcomm products with Android releases from CAF using the Linux kernel, during DMA allocation, due to wrong data type of size, allocation size gets truncated which makes allocation succeed when it should fail...

PT-2017-19138

Name of the Vulnerable Software and Affected Versions Qualcomm products with Android releases from CAF using the Linux kernel affected versions not specified Description The issue arises during DMA allocation in Qualcomm products with Android releases from CAF using the Linux kernel. Due to the...

CVE-2017-9725: Incorrect Calculation

In all Qualcomm products with Android releases from CAF using the Linux kernel, during DMA allocation, due to wrong data type of size, allocation size gets truncated which makes allocation succeed when it should fail...

Security update for qemu (important)

This update for qemu fixes the following issues: Security issues fixed: CVE-2017-10664: Fix DOS vulnerability in qemu-nbd bsc1046636 CVE-2017-10806: Fix DOS from stack overflow in debug messages of usb redirection support bsc1047674 CVE-2017-11334: Fix OOB access during DMA operation bsc1048902...

openSUSE Security Update : qemu (openSUSE-2017-1072)

This update for qemu fixes the following issues : Security issues fixed : - CVE-2017-10664: Fix DOS vulnerability in qemu-nbd bsc1046636 - CVE-2017-10806: Fix DOS from stack overflow in debug messages of usb redirection support bsc1047674 - CVE-2017-11334: Fix OOB access during DMA operation...