Exploring malicious Windows drivers (Part 1): Introduction to the kernel and drivers

Drivers have long been of interest to threat actors, whether they are exploiting vulnerable drivers or creating malicious ones. Malicious drivers are difficult to detect and successfully leveraging one can give an attacker full access to a system. Real-world examples can be found in our previous...

CVE-2022-48619

A vulnerability was found in drivers/input/input.c in the Linux Kernel, where the inputsetcapability function mishandles scenarios where an event code is outside the bitmap. This issue can lead to a kernel panic when the event code exceeds the bitmap for the specified event type, which could allo...

CVE-2022-48619

An issue was discovered in drivers/input/input.c in the Linux kernel before 5.17.10. An attacker can cause a denial of service panic because inputsetcapability mishandles the situation in which an event code falls outside of a bitmap...

CVE-2022-48619

An issue was discovered in drivers/input/input.c in the Linux kernel before 5.17.10. An attacker can cause a denial of service panic because inputsetcapability mishandles the situation in which an event code falls outside of a bitmap...

Design/Logic Flaw

An issue was discovered in drivers/input/input.c in the Linux kernel before 5.17.10. An attacker can cause a denial of service panic because inputsetcapability mishandles the situation in which an event code falls outside of a bitmap...

Is it possible to customize the Virtual Channel function on Citrix Virtual Apps and Desktops ?

The Citrix Virtual Channel software development kit SDK supports writing server-side applications and client-side drivers for more virtual channels using the ICA protocol...

CVE-2022-48619

An issue was discovered in drivers/input/input.c in the Linux kernel before 5.17.10. An attacker can cause a denial of service panic because inputsetcapability mishandles the situation in which an event code falls outside of a bitmap...

CVE-2022-48619

An issue was discovered in drivers/input/input.c in the Linux kernel before 5.17.10. An attacker can cause a denial of service panic because inputsetcapability mishandles the situation in which an event code falls outside of a bitmap...

CVE-2024-0340 Kernel: information disclosure in vhost/vhost.c:vhost_new_msg()

A vulnerability was found in vhostnewmsg in drivers/vhost/vhost.c in the Linux kernel, which does not properly initialize memory in messages passed between virtual guests and the host operating system in the vhost/vhost.c:vhostnewmsg function. This issue can allow local privileged users to read...

Microsoft Windows Kernel-Mode Drivers Security Vulnerability

Microsoft Windows is a suite of operating systems for use on personal devices from the U.S.-based Microsoft Corporation Microsoft. A security vulnerability exists in Microsoft Windows Kernel-Mode Drivers. An attacker could exploit the vulnerability to elevate privileges. The following products an...

Amazon Linux 2 : thunderbird (ALAS-2024-2379)

The version of thunderbird installed on the remote host is prior to 115.5.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2379 advisory. On some systems--depending on the graphics settings and drivers--it was possible to force an out-of-bounds read and...

Ubuntu 23.10 : Linux kernel (Azure) vulnerabilities (USN-6572-1)

The remote Ubuntu 23.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6572-1 advisory. Yu Hao discovered that the UBI driver in the Linux kernel did not properly check for MTD with zero erasesize during device attachment. A local privileged...

How ransomware operators try to stay under the radar

An often heard remark is that when your security solution notices a ransomware attack, it’s already too late. Theres a lot of truth in that, if you consider the encryption process to be the ransomware attack. However, these days encryption is just a part of many ransomware attacks. Some of the...

NewStart CGSL MAIN 6.02 : kernel Multiple Vulnerabilities (NS-SA-2023-0073)

The remote NewStart CGSL host, running version MAIN 6.02, has kernel packages installed that are affected by multiple vulnerabilities: - A vulnerability has been found in Linux Kernel and classified as critical. Affected by this vulnerability is the function areacacheget of the file...

CVE-2023-7042 Kernel: null pointer dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev()

A null pointer dereference vulnerability was found in ath10kwmitlvoppullmgmttxcomplev in drivers/net/wireless/ath/ath10k/wmi-tlv.c in the Linux kernel. This issue could be exploited to trigger a denial of service...

Vulnerabilities fixed in Microsoft Windows

Microsoft has fixed vulnerabilities in Windows. A malicious party can exploit the vulnerabilities to launch attacks execute attacks that can lead to the following categories of damage: Denial-of-Service DoS. Remote code execution User Rights Spoofing Access to system data Increased user privilege...

Microsoft Windows Kernel Mode Drivers Security Vulnerability

Microsoft Windows Kernel Mode Drivers is a Windows kernel mode driver from Microsoft Corporation USA. A security vulnerability exists in Microsoft Windows Kernel Mode Drivers. An attacker could exploit the vulnerability to elevate privileges. The following products and editions are affected:Windo...

Linux kernel security vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel, which stems from secattestinfo in drivers/accel/habanalabs/common/habanalabsioctl.c that allows information to be leaked in...

Security Bulletin: Vulnerabilities affect NVIDIA GPU Display Drivers for Linux and Windows

Summary NVIDIA has released an update to address the following vulnerabilities in GPU Display Drivers for Linux and Windows. Vulnerability Details CVEID: CVE-2018-6260 DESCRIPTION: NVIDIA graphics driver could allow a local authenticated attacker to obtain sensitive information, caused by a flaw ...

CLSA-2023-1701962635 kernel: Fix of 18 CVEs

net/tls: do not free tlsrec on async operation in bpfexectxverdict CVE-2023-6176 - wifi: mac80211: fix MBSSID parsing use-after-free CVE-2022-42719 - mac80211: always allocate struct ieee80211elems CVE-2022-42719 - x86/sev: Check for user-space IOIO pointing to kernel space CVE-2023-46813 -...