macOS XNU - Missing Locking in checkdirs_callback() Enables Race with fchdir_common()

macOS XNU - Missing Locking in checkdirscallback Enables Race with fchdircommon On macOS, when a new mount point is created, the kernel uses checkdirs to, as a comment above the function explains: "Scan all active processes to see if any of them have a current or root directory onto which the new...

OracleVM 3.4 : Unbreakable / etc (OVMSA-2019-0009)

The remote OracleVM system is missing necessary patches to address critical security updates : - NFS: commit direct writes even if they fail partially J. Bruce Fields Orabug: 28212440 - rds: update correct congestion map for loopback transport Mukesh Kacker Orabug: 29175685 - ext4: only look at t...

Unbreakable Enterprise kernel security update

4.1.12-124.26.1 - NFS: commit direct writes even if they fail partially J. Bruce Fields Orabug: 28212440 - rds: update correct congestion map for loopback transport Mukesh Kacker Orabug: 29175685 - ext4: only look at the bgflags field if it is valid Theodore Tso Orabug: 29316684 CVE-2018-10876...

Unbreakable Enterprise kernel security update

4.14.35-1844.2.5 - x86/apic: Switch all APICs to Fixed delivery mode Thomas Gleixner Orabug: 29262403 4.14.35-1844.2.4 - x86/platform/UV: Add check of TSC state set by UV BIOS [email protected] Orabug: 29205471 - x86/tsc: Provide a means to disable TSC ART [email protected] Orabug: 29205471 -...

macOS < 10.14.3 / iOS < 12.1.3 - Arbitrary mach Port Name Deallocation in XPC Services due to

/ xpcserializerunpack in libxpc parses mach messages which contain xpc messages. There are two reasons for an xpc mach message to contain descriptors: if the message body is large, then it's sent as a MACHMSGOOLDESCRIPTOR. Also if the message contains other port resources eg memory entry ports th...

Joyent SmartOS Elevation of Privilege Vulnerability

Joyent SmartOS is a set of open source operating system from Joyent, Inc. in the United States. A security vulnerability exists in the DTrace DOF file in the Joyent SmartOS release-20170803-20170803T064301Z, which stems from a program that makes it difficult to correctly validate user-submitted...

CVE-2018-1171

This vulnerability allows local attackers to escalate privileges on vulnerable installations of Joyent SmartOS release-20170803-20170803T064301Z. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw...

CVE-2018-1171

This vulnerability allows local attackers to escalate privileges on vulnerable installations of Joyent SmartOS release-20170803-20170803T064301Z. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw...

Design/Logic Flaw

This vulnerability allows local attackers to escalate privileges on vulnerable installations of Joyent SmartOS release-20170803-20170803T064301Z. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw...

CVE-2018-1171

This vulnerability allows local attackers to escalate privileges on vulnerable installations of Joyent SmartOS release-20170803-20170803T064301Z. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw...

CVE-2018-1171

The CVE-2018-1171 entry concerns Joyent SmartOS release-20170803. An attacker who can run low-privileged code on the target can exploit a flaw in the DTrace DOF handling to write past the end of an allocated object, enabling local privilege escalation and code execution under the host OS. Root ca...

Joyent SmartOS DTrace DOF Out-Of-Bounds Write Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on vulnerable installations of Joyent SmartOS. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the DTrace DOF file...

CVE-2017-13782

An issue was discovered in certain Apple products. macOS before 10.13.1 is affected. The issue involves the "Kernel" component. It allows attackers to bypass intended memory-read restrictions via a /dev/dtracehelper attack involving the dtracedifvariable and dtracegetarg functions...

PT-2017-13097 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 10.13.1 Description: The issue involves the "Kernel" component and allows attackers to bypass intended memory-read restrictions. This is achieved via a /dev/dtracehelper attack that involves the dtrace dif variable and...

Joyent SmartOS dtrace Information Disclosure Vulnerability

This vulnerability allows attackers to disclose sensitive information on vulnerable installations of Joyent SmartOS. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the dtrace...

Joyent SmartOS dtrace Information Disclosure Vulnerability

This vulnerability allows attackers to disclose sensitive information on vulnerable installations of Joyent SmartOS. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the dtrace...

Joyent SmartOS dtrace Zone Escape Privilege Escalation Vulnerability

This vulnerability allows local attackers to execute arbitrary code on vulnerable installations of Joyent SmartOS. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the dtrace...

Security update for java-1_8_0-openjdk (important)

This update for java-180-openjdk fixes the following issues: - Upgrade to version jdk8u101 icedtea 3.1.0 - New in release 3.1.0 2016-07-25: Security fixes - S8079718, CVE-2016-3458: IIOP Input Stream Hooking bsc989732 - S8145446, CVE-2016-3485: Perfect pipe placement Windows only bsc989734 -...

Joyent SmartOS dtrace Information Disclosure Vulnerability

This vulnerability allows local attackers to disclose information on vulnerable installations of Joyent SmartOS. User interaction is required to exploit this vulnerability in that the target must open a malicious file. The specific flaw exists within the dtrace implementation in SmartOS. A functi...

Joyent SmartOS dtrace Zone Escape Privilege Escalation Vulnerability

This vulnerability allows local attackers to execute arbitrary code on vulnerable installations of Joyent SmartOS. User interaction is required to exploit this vulnerability in that the target must open a malicious file. The specific flaw exists within the dtrace implementation in SmartOS. A meth...