QEMU: slirp: OOB buffer access while emulating tcp protocols in tcp_emu()

A heap buffer overflow issue was found in the SLiRP networking implementation of the QEMU emulator. This flaw occurs in the tcpemu routine while emulating IRC and other protocols. An attacker could use this flaw to crash the QEMU process on the host, resulting in a denial of service or potential...

Invoke-APT29: Adversarial Threat Emulation

MITRE recently conducted its second ATT&CK exercise in their ongoing annual series of Endpoint Security Efficacy testing and evaluation. This test focuses on assessing the behavioral capabilities of multiple endpoint security vendors against a simulated adversary, based closely around...

Huawei EulerOS: Security Advisory for qemu-kvm (EulerOS-SA-2019-1368)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

kernel: kvm: guest userspace to guest kernel write

A flaw was found in the way Linux kernel KVM hypervisor emulated instructions such as sgdt/sidt/fxsave/fxrstor. It did not check current privilegeCPL level while emulating unprivileged instructions. An unprivileged guest user/process could use this flaw to potentially escalate privileges inside...

CVE-2019-14024

Possible stack-use-after-scope issue in NFC usecase for card emulation in Snapdragon Auto, Snapdragon Industrial IOT, Snapdragon Mobile in MSM8917, MSM8953, Nicobar, QM215, Rennell, SDM429, SDM439, SDM450, SDM632, SDM670, SDM710, SDM845, SM6150, SM7150, SM8150, SM8250, SXR2130...

Code injection

Possible stack-use-after-scope issue in NFC usecase for card emulation in Snapdragon Auto, Snapdragon Industrial IOT, Snapdragon Mobile in MSM8917, MSM8953, Nicobar, QM215, Rennell, SDM429, SDM439, SDM450, SDM632, SDM670, SDM710, SDM845, SM6150, SM7150, SM8150, SM8250, SXR2130...

UPDATE: MITRE CALDERA 2.5.0

MITRE CALDERA 2.5.0 is now available since the last release - MITRE CALDERA 2.4.0, which was released in the month of December. As you remember, this awesome adversary emulation system was listed in my older post titled – List of Adversary Emulation Tools. What is MITRE CALDERA? CALDERA is an...

CVE-2019-14024: Use After Free

Possible stack-use-after-scope issue in NFC usecase for card emulation in Snapdragon Auto, Snapdragon Industrial IOT, Snapdragon Mobile in MSM8917, MSM8953, Nicobar, QM215, Rennell, SDM429, SDM439, SDM450, SDM632, SDM670, SDM710, SDM845, SM6150, SM7150, SM8150, SM8250, SXR2130...

PT-2020-9450

Name of the Vulnerable Software and Affected Versions: Qualcomm Snapdragon versions in MSM8917, MSM8953, Nicobar, QM215, Rennell, SDM429, SDM439, SDM450, SDM632, SDM670, SDM710, SDM845, SM6150, SM7150, SM8150, SM8250, SXR2130 Description: A possible stack-use-after-scope issue exists in the NFC u...

DEBIAN-CVE-2019-19332

An out-of-bounds memory write issue was found in the Linux Kernel, version 3.13 through 5.4, in the way the Linux kernel's KVM hypervisor handled the 'KVMGETEMULATEDCPUID' ioctl2 request to get CPUID features emulated by the KVM hypervisor. A user or process able to access the '/dev/kvm' device...

UBUNTU-CVE-2019-19332

An out-of-bounds memory write issue was found in the Linux Kernel, version 3.13 through 5.4, in the way the Linux kernel's KVM hypervisor handled the 'KVMGETEMULATEDCPUID' ioctl2 request to get CPUID features emulated by the KVM hypervisor. A user or process able to access the '/dev/kvm' device...

openSUSE: Security Advisory for qemu (openSUSE-SU-2019:2510-1)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

kernel: kvm: guest userspace to guest kernel write

A flaw was found in the way Linux kernel KVM hypervisor emulated instructions such as sgdt/sidt/fxsave/fxrstor. It did not check current privilegeCPL level while emulating unprivileged instructions. An unprivileged guest user/process could use this flaw to potentially escalate privileges inside...

UPDATE: MITRE CALDERA 2.4.0

MITRE CALDERA 2.4.0 is now available! It has been just four months since the release of MITRE CALDERA 2.3.0. As you remember, this awesome adversary emulation system was listed in my older post titled – List of Adversary Emulation Tools. This release has a lot of new feature, breaking and...

Kernel: KVM: nVMX: use-after-free of the hrtimer for emulation of the preemption timer

A use-after-free vulnerability was found in the way the Linux kernel's KVM hypervisor emulates a preemption timer for L2 guests when nested =1 virtualization is enabled. This high resolution timerhrtimer runs when a L2 guest is active. After VM exit, the syncvmcs12 timer object is stopped. The...

Active C2 Discovery Using Protocol Emulation Part1 (HYDSEVEN NetWire)

Malware C2 addresses can be an important IOC to detect known threats. In order to obtain C2 information, we first need malware samples which are then analyzed dynamically or statically. However the analysis task is often times not straightforward. Increasingly anti-analysis methods are implemente...

The vulnerability of the Virtio Vring component in the QEMU hardware emulation software allows a hacker to induce a system failure.

The vulnerability of the Virtio Vring component in the QEMU hardware emulation software is related to division by zero errors. Exploiting this vulnerability can allow an attacker to cause a system failure...

The vulnerability of the Network Block Device (NBD) hardware emulation server in QEMU allows a hacker to induce a maintenance failure.

The vulnerability of the Network Block Device NBD emulation server of QEMU is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a remote attacker to trigger a service failure through a specially crafted request...

The vulnerability of functions mode4and5 in the hardware/display/cirrus_vga.c file of the QEMU hardware emulation software allows a hacker to induce a service failure.

The vulnerability of functions mode4and5 in the QEMU hardware emulation software hw/display/cirrusvga.c is related to writing beyond the memory buffer boundaries. Exploiting this vulnerability can allow an attacker to cause a system failure...

Fedora 29 : xen (2019-865bb16900)

VCPUOPinitialise DoS XSA-296, CVE-2019-18420 missing descriptor table limit checking in x86 PV emulation XSA-298, CVE-2019-18425 Issues with restartable PV type change operations XSA-299, CVE-2019-18421 1767726 add-to-physmap can be abused to DoS Arm hosts XSA-301, CVE-2019-18423 passed through P...