FreeBSD : FreeBSD -- bhyve(8) out-of-bounds read access via XHCI emulation (1febd09b-7716-11ef-9a62-002590c1f29c)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 1febd09b-7716-11ef-9a62-002590c1f29c advisory. bhyve can be configured to emulate devices on a virtual USB controller XHCI, such as USB tablet devices...

CVE-2024-41721 bhyve(8) out-of-bounds read access via XHCI emulation

An insufficient boundary validation in the USB code could lead to an out-of-bounds read on the heap, which could potentially lead to an arbitrary write and remote code execution...

DEBIAN-CVE-2024-8354

A flaw was found in QEMU. An assertion failure was present in the usbepget function in hw/net/core.c when trying to get the USB endpoint from a USB device. This flaw may allow a malicious unprivileged guest user to crash the QEMU process on the host and cause a denial of service condition...

PT-2024-6401 · Bhyve +1 · Bhyve +1

Name of the Vulnerable Software and Affected Versions: FreeBSD affected versions not specified Description: The issue is related to an insufficient boundary validation in the USB code, which could lead to an out-of-bounds read on the heap, potentially resulting in an arbitrary write and remote co...

FreeBSD-SA-24:15.bhyve

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-24:15.bhyve Security Advisory The FreeBSD Project Topic: bhyve8 out-of-bounds read access via XHCI emulation Category: core Module: bhyve Announced: 2024-09-19...

SUSE CVE-2024-46707

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Make ICCSGIEL1 undef in the absence of a vGICv3 On a system with a GICv3, if a guest hasn't been configured with GICv3 and that the host is not capable of GICv2 emulation, a write to any of the ICCSGIEL1 registers is...

CVE-2024-46707 KVM: arm64: Make ICC_*SGI*_EL1 undef in the absence of a vGICv3

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Make ICCSGIEL1 undef in the absence of a vGICv3 On a system with a GICv3, if a guest hasn't been configured with GICv3 and that the host is not capable of GICv2 emulation, a write to any of the ICCSGIEL1 registers is...

CVE-2024-46707

CVE-2024-46707 affects the Linux kernel KVM for arm64. When a guest is configured without vGICv3 and the host cannot emulate GICv2, writes to ICC_SGI EL1 are trapped to EL2, leading to an attempted SGI emulation that dereferences a NULL interrupt pointer. The public details confirm the root cause...

CVE-2024-46707

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Make ICCSGIEL1 undef in the absence of a vGICv3 On a system with a GICv3, if a guest hasn't been configured with GICv3 and that the host is not capable of GICv2 emulation, a write to any of the ICCSGIEL1 registers is...

The vulnerability of the QEMU hardware emulation software, related to synchronization errors, allows a hacker to trigger a service failure.

The vulnerability of the QEMU hardware emulation software is related to synchronization errors. Exploiting this vulnerability can allow a remote attacker to cause a service failure...

CVE-2023-42467

...

CLSA-2024-1725876080 kernel: Fix of 44 CVEs

dmaengine: idxd: Fix possible Use-After-Free in irqprocessworklist CVE-2024-40956 - userfaultfd: fix a race between writeprotect and exitmmap CVE-2021-47461 - netfilter: nftables: use timestamp to check for set element timeout CVE-2024-27397 - x86/sev: Harden VC instruction emulation somewhat...

Hoverfly 安全漏洞

Hoverfly is a lightweight open source API emulation tool open-sourced by SpectoLabs. A security vulnerability exists in Hoverfly versions prior to v1.10.3. An attacker exploiting the vulnerability could read arbitrary files from the server...

OpenText NetIQ Access Manager 安全漏洞

OpenText NetIQ Access Manager is a comprehensive mobile and web access management tool from OpenText Canada. A security vulnerability exists in OpenText NetIQ Access Manager versions 5.0.4.1 and prior to 5.1, which stems from an improper privilege management vulnerability that allows user account...

error handling in x86 IOMMU identity mapping

ISSUE DESCRIPTION Certain PCI devices in a system might be assigned Reserved Memory Regions specified via Reserved Memory Region Reporting, "RMRR" for Intel VT-d or Unity Mapping ranges for AMD-Vi. These are typically used for platform tasks such as legacy USB emulation. Since the precise purpose...

Unbreakable Enterprise kernel-container security update

5.4.17-2136.334.6.el8 - loop: Fix a race between loop detach and loop open Gulam Mohamed Orabug: 36197800 - x86/bhi: Do not enable unnecessary BHI mitigation in OCI and Exadata VMs Alexandre Chartre Orabug: 36672495 - x86/bhi: Avoid warning in DB handler due to BHI mitigation Alexandre Chartre...

CBL Mariner 2.0 Security Update: qemu (CVE-2022-36648)

The version of qemu installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-36648 advisory. - The hardware emulation in the ofdpacmdaddl2flood of rocker device model in QEMU, as used in 7.0.0 and earlier,...

A DMA reentrancy issue was found in the NVM Express Controller (NVME) emulation in QEMU. This CVE is similar to CVE-2021-3750 and just like it when the reentrancy write triggers the reset function nvme_ctrl_reset() data structs will be freed leading to a use-after-free issue. A malicious guest could use this flaw to crash the QEMU process on the host resulting in a denial of service condition or potentially executing arbitrary code within the context of the QEMU process on the host.

...

A flaw was found in the QXL display device emulation in QEMU. An integer overflow in the cursor_alloc() function can lead to the allocation of a small cursor object followed by a subsequent heap-based buffer overflow. This flaw allows a malicious privileged guest user to crash the QEMU process on the host or potentially execute arbitrary code within the context of the QEMU process.

...

A flaw was found in the QXL display device emulation in QEMU. A double fetch of guest controlled values `cursor->header.width` and `cursor->header.height` can lead to the allocation of a small cursor object followed by a subsequent heap-based buffer overflow. A malicious privileged guest user could use this flaw to crash the QEMU process on the host or potentially execute arbitrary code within the context of the QEMU process.

...