QEMU: slirp: OOB buffer access while emulating tcp protocols in tcp_emu()

A heap buffer overflow issue was found in the SLiRP networking implementation of the QEMU emulator. This flaw occurs in the tcpemu routine while emulating IRC and other protocols. An attacker could use this flaw to crash the QEMU process on the host, resulting in a denial of service or potential...

CVE-2019-15030

A flaw in the Linux kernel on the PowerPC platform, was found where a local user can read vector registers of other user processes via a Facility Unavailable exception. An attacker must start a transaction when the FPU operation begins or there is no leakage. Vector registers will become corrupte...

UPDATE: MITRE CALDERA 2.6.5

MITRE CALDERA 2.6.5 is now available! My last post about CALDERA from MITRE was about MITRE CALDERA 2.5.1 and as you remember, this awesome adversary emulation system was listed in my older post titled – List of Adversary Emulation Tools. This release includes a new plugin – Training. It has been...

Turning an OBD-II reader into a USB / NFC attack tool

One of my favourite sorts of hardware hacking is making a device do something it was never intended for. It's creative, disruptive, and fun. Everyone has their own way of going about things. Different methodologies, habits, and skill sets mean that approaches will be diverse. This is how I work...

Zelos - A Comprehensive Binary Emulation Platform

Zelos Z eropoint E mulated L ightweight O perating S ystem is a python-based binary emulation platform. One use of zelos is to quickly assess the dynamic behavior of binaries via command-line or python scripts. All syscalls are emulated to isolate the target binary. Linux x8664 32- and 64-bit, AR...

QEMU: slirp: OOB buffer access while emulating tcp protocols in tcp_emu()

A heap buffer overflow issue was found in the SLiRP networking implementation of the QEMU emulator. This flaw occurs in the tcpemu routine while emulating IRC and other protocols. An attacker could use this flaw to crash the QEMU process on the host, resulting in a denial of service or potential...

MGASA-2020-0113 Updated xen packages fix security vulnerability

Updated from 4.12.0 to 4.12.1 - Device quarantine for alternate pci assignment methods XSA-306 - x86: Machine Check Error on Page Size Change DoS XSA-304, CVE-2018-12207 - TSX Asynchronous Abort speculative side channel XSA-305, CVE-2019-11135 - VCPUOPinitialise DoS XSA-296, CVE-2019-18420...

Ghost Framework - An Android Post Exploitation Framework That Uses An Android Debug Bridge To Remotely Access A n Android Device

Ghost Framework is an Android post exploitation framework that uses an Android Debug Bridge to remotely access an Android device. Ghost Framework gives you the power and convenience of remote Android device administration. Getting started Ghost installation cd ghost chmod +x install.sh ./install....

The vulnerability of the lsi_do_msgin function in the QEMU hardware emulation software, related to reading beyond the data buffer, allows a hacker to trigger a service failure.

The vulnerability of the lsidomsgin function hw/scsi/lsi53c895a.c in the QEMU hardware emulation software is related to reading beyond the buffer data boundary. Exploiting this vulnerability can allow an attacker to cause a service failure due to an invalid value of the msglen variable...

The vulnerability of the TCP/IP emulator tcp_emu(), Slirp emulator, and the hardware emulation software QEMU allows a hacker to induce a service failure.

The vulnerability of the tcpemu function slirp/tcpsubr.c of the Slirp TCP/IP emulator and the QEMU hardware emulation software is related to the execution of operations outside the data buffer “scrcv-sbdata”. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the rtl8139_do_receive function in the QEMU hardware emulation software, related to integer overflow, allows a hacker to cause a service failure.

The vulnerability of the rtl8139doreceive function in the QEMU hardware emulation software is related to integer overflow. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2020-5542)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-5542 advisory. - KVM: nVMX: Check IO instruction VM-exit conditions Oliver Upton Orabug: 30847137 CVE-2020-2732 - KVM: nVMX: Refactor IO bitmap checks into helper function...

CVE-2020-2732

A flaw was found in the way KVM hypervisor handled instruction emulation for the L2 guest when nested=1 virtualization is enabled. In the instruction emulation, the L2 guest could trick the L0 hypervisor into accessing sensitive bits of the L1 hypervisor. An L2 guest could use this flaw to...

UBUNTU-CVE-2020-2732

A flaw was discovered in the way that the KVM hypervisor handled instruction emulation for an L2 guest when nested virtualisation is enabled. Under some circumstances, an L2 guest may trick the L0 guest into accessing sensitive L1 resources that should be inaccessible to the L2 guest...

QEMU: Slirp: potential OOB access due to unsafe snprintf() usages

An out-of-bounds heap buffer access flaw was found in the SLiRP networking implementation of the QEMU emulator. This flaw occurs in tcpemu routine while emulating IRC and other protocols due to unsafe usage of the snprintf3 function. A user or process could use this flaw to crash the QEMU process...

UPDATE: FudgeC2 0.5.4

FudgeC2 0.5.4 was released recently. As you may remember, this awesome adversary emulation system was listed in my older post titled – List of Open Source C2 Post-Exploitation Frameworks. This newer version brings in refactored code, improvements to the stager, bug fixes among other changes...

QEMU: Slirp: potential directory traversal using relative paths via tftp server on Windows host

A potential directory traversal issue was found in the tftp server of the SLiRP user-mode networking implementation used by QEMU. It could occur on a Windows host, as it allows the use of both forward '/' and backward slash'' tokens as separators in a file path. A user able to access the tftp...

QEMU: slirp: OOB buffer access while emulating tcp protocols in tcp_emu()

A heap buffer overflow issue was found in the SLiRP networking implementation of the QEMU emulator. This flaw occurs in the tcpemu routine while emulating IRC and other protocols. An attacker could use this flaw to crash the QEMU process on the host, resulting in a denial of service or potential...

Qiling - Advanced Binary Emulation Framework

Qiling is an advanced binary emulation framework, with the following features: Cross platform: Windows, MacOS, Linux, BSD Cross architecture: X86, X8664, Arm, Arm64, Mips Multiple file formats: PE, MachO, ELF Emulate & sandbox machine code in a isolated environment Provide high level API to setup...

QEMU: slirp: OOB buffer access while emulating tcp protocols in tcp_emu()

A heap buffer overflow issue was found in the SLiRP networking implementation of the QEMU emulator. This flaw occurs in the tcpemu routine while emulating IRC and other protocols. An attacker could use this flaw to crash the QEMU process on the host, resulting in a denial of service or potential...