kernel: TLB flush happens too late on mremap

Since Linux kernel version 3.2, the mremap syscall performs TLB flushes after dropping pagetable locks. If a syscall such as ftruncate removes entries from the pagetables of a task that is in the middle of mremap, a stale TLB entry can remain for a short time that permits access to a physical pag...

Moderate: Red Hat Security Advisory: kernel security and bug fix update

An update for kernel is now available for Red Hat Enterprise Linux 7.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

RHEL 7 : kernel (RHSA-2020:0103)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0103 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: Use-after-free in blkdrainqueu...

Important: Red Hat Security Advisory: kernel-rt security and bug fix update

An update for kernel-rt is now available for Red Hat Enterprise MRG 2. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

RHEL 7 : kernel (RHSA-2020:0036)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0036 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: Use-after-free in sndpcminfo...

Moderate: Red Hat Security Advisory: kernel security and bug fix update

An update for kernel is now available for Red Hat Enterprise Linux 7.5 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

CVE-2019-18178

Real Time Engineers FreeRTOS+FAT 160919a has a use after free. The function FFClose is defined in fffile.c. The file handler pxFile is freed by ffconfigFREE, which by default is a macro definition of vPortFree, but it is reused to flush modified file content from the cache to disk by the function...

CVE-2019-15703

An Insufficient Entropy in PRNG vulnerability in Fortinet FortiOS 6.2.1, 6.2.0, 6.0.8 and below for device not enable hardware TRNG token and models not support builtin TRNG seed allows attacker to theoretically recover the long term ECDSA secret in a TLS client with a RSA handshake and mutual...

NewStart CGSL CORE 5.04 / MAIN 5.04 : kernel-rt Multiple Vulnerabilities (NS-SA-2019-0183)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has kernel-rt packages installed that are affected by multiple vulnerabilities: - A flaw was found in the way Linux kernel KVM hypervisor before 4.18 emulated instructions such as sgdt/sidt/fxsave/fxrstor. It did not check...

openSUSE Security Update : the Linux Kernel (openSUSE-2019-2307)

The openSUSE Leap 15.0 kernel was updated to receive various security and bugfixes. The following security bugs were fixed : - CVE-2019-15291: There was a NULL pointer dereference caused by a malicious USB device in the flexcopusbprobe function in the drivers/media/usb/b2c2/flexcop-usb.c driver...

openSUSE Security Update : the Linux Kernel (openSUSE-2019-2308)

The openSUSE Leap 15.1 kernel was updated to receive various security and bugfixes. The following security bugs were fixed : - CVE-2019-15291: There was a NULL pointer dereference caused by a malicious USB device in the flexcopusbprobe function in the drivers/media/usb/b2c2/flexcop-usb.c driver...

curl: use after free in cookie.c

I ran fuzzing with the internal fuzzer at https://github.com/pauldreik/curl-fuzzer/blob/paul/localfuzzpublic0/intreefuzzer/src/insidefuzzers/fuzzcookies.cc It seems like the following sequence of events trigger the use after free: c include "cookie.h" include curlglobalinitCURLGLOBALDEFAULT; CURL...

Denial Of Service (DoS)

kernel is vulneralbe to denial of service DoS. The vulnerability exists as TLB flush happens too late on mremap...

kernel: TLB flush happens too late on mremap

Since Linux kernel version 3.2, the mremap syscall performs TLB flushes after dropping pagetable locks. If a syscall such as ftruncate removes entries from the pagetables of a task that is in the middle of mremap, a stale TLB entry can remain for a short time that permits access to a physical pag...

SUSE-SU-2019:2046-1 Security update for ardana packages

This update for ardana package fixes the following issues: - Update to version 9.0+git.1560211997.7ac9792: Adds repository list parameter bsc1122825 - Update to version 9.0+git.1557219331.457b6e7: Update gerrit location SCRD-9140 - Switch to new Gerrit Server - Update to version...

SUSE SLED15 / SLES15 Security Update : libgcrypt (SUSE-SU-2019:1971-1)

This update for libgcrypt fixes the following issues : Security issue fixed : CVE-2019-12904: Fixed a flush-and-reload side-channel attack in the AES implementation bsc1138939. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisor...

SUSE-SU-2019:1971-1 Security update for libgcrypt

This update for libgcrypt fixes the following issues: Security issue fixed: - CVE-2019-12904: Fixed a flush-and-reload side-channel attack in the AES implementation bsc1138939...

OPENSUSE-SU-2019:1792-1 Security update for libgcrypt

This update for libgcrypt fixes the following issues: Security issues fixed: - CVE-2019-12904: The C implementation of AES is vulnerable to a flush-and-reload side-channel attack because physical addresses are available to other processes. The C implementation is used on platforms where an...

SUSE-SU-2019:1862-1 Security update for ardana and crowbar

This update for ardana and crowbar fixes the following issues: - Restrict rootwrap directories for cinder bsc1132542 - Change Cinder default log level from DEBUG to INFO SCRD-7132 - Remove configuration from migration bsc1126391 - Configurable innodb flush options SCRD-7496 - Secure designate's...

PT-2019-4893 · Xen +1 · Xen +1

Name of the Vulnerable Software and Affected Versions: Xen versions prior to 4.12 Description: The issue is related to an incompatibility between Process Context Identifiers PCID and TLB flushes, allowing x86 PV guest OS users to cause a denial of service or gain privileges. This is due to...