kernel: race condition in perf_event_open leads to privilege escalation

A use-after-free flaw was found in the Linux kernel’s performance events functionality. A user triggers a race condition in setting up performance monitoring between the leading PERFTYPETRACEPOINT and sub PERFEVENTHARDWARE plus the PERFEVENTSOFTWARE using the perfeventopen function with these thr...

kernel: race condition in perf_event_open leads to privilege escalation

A use-after-free flaw was found in the Linux kernel’s performance events functionality. A user triggers a race condition in setting up performance monitoring between the leading PERFTYPETRACEPOINT and sub PERFEVENTHARDWARE plus the PERFEVENTSOFTWARE using the perfeventopen function with these thr...

Citrix Hypervisor Security Update

A security issue has been identified in Citrix Hypervisor 7.1 LTSR CU2 that may allow privileged code in a PV guest VM to compromise the host. Citrix believes that there would be significant complexity in performing this attack in Citrix Hypervisor. The issue has the following CVE identifier:...

The vulnerability of the lsi_do_msgout function in the QEMU hardware emulation software allows a hacker to trigger a service failure.

The vulnerability of the lsidomsgout function hw/scsi/lsi53c895a.c in the QEMU hardware emulation software is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to cause a system failure...

[SECURITY] Fedora 36 Update: qemu-6.2.0-12.fc36

qemu is an open source virtualizer that provides hardware emulation for the KVM hypervisor. qemu acts as a virtual machine monitor together with the KVM kernel modules, and emulates the hardware for a full system such as a PC and its associated peripherals...

Securing your IoT with Edge Secured-core devices

A recent study conducted by Microsoft in partnership with Ponemon Institute included a survey of companies that have adopted IoT solutions and 65 percent of them mentioned that security is a top priority when implementing IoT. Attacks targeting IoT devices put businesses at risk. Impacted devices...

Securing your IoT with Edge Secured-core devices

A recent study conducted by Microsoft in partnership with Ponemon Institute included a survey of companies that have adopted IoT solutions and 65 percent of them mentioned that security is a top priority when implementing IoT. Attacks targeting IoT devices put businesses at risk. Impacted devices...

Lepin EP-KP001 KP001_V19 Authentication Bypass Vulnerability

When analyzing the USB flash drive Lepin EP-KP001, Matthias Deeg found out that it uses an insecure hardware design which allows an attacker to bypass the password-based user authentication. Product: EP-KP001 Manufacturer: Lepin Affected Versions: KP001V19 Tested Versions: KP001V19 Vulnerability...

Nexans FTTO GigaSwitch industrial/office switches 信任管理问题漏洞

Nexans FTTO GigaSwitch industrial/office switches are a range of industrial switches from Nexans. A security vulnerability exists in Nexans FTTO GigaSwitch industrial/office switches HW version 5, which stems from the use of outdated and vulnerable software components...

Lepin EP-KP001 KP001_V19 Authentication Bypass

Advisory ID: SYSS-2022-024 Product: EP-KP001 Manufacturer: Lepin Affected Versions: KP001V19 Tested Versions: KP001V19 Vulnerability Type: Violation of Secure Design Principles CWE-657 Risk Level: High Solution Status: Open Manufacturer Notification: 2022-04-12 Solution Date: - Public Disclosure:...

The vulnerability of the Windows Hyper-V hardware virtualization system allows a perpetrator to execute arbitrary code.

The vulnerability of the Windows Hyper-V hardware virtualization technology in Windows operating systems is related to improper code generation. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

The vulnerability of the Windows Hyper-V hardware virtualization system allows a perpetrator to gain unauthorized access to protected information or cause service failures.

The vulnerability of the Windows Hyper-V hardware virtualization system is related to errors in information processing. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information or cause service failures...

The vulnerability of the Windows Hyper-V hardware virtualization system allows a perpetrator to execute arbitrary code.

The vulnerability of the Windows Hyper-V hardware virtualization system in Windows operating systems is related to synchronization errors when using shared resources „Race Conditions“. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

Attacking the Performance of Machine Learning Systems

Interesting research: "Sponge Examples: Energy-Latency Attacks on Neural Networks": Abstract: The high energy costs of neural network training and inference led to the use of acceleration hardware such as GPUs and TPUs. While such devices enable us to train large-scale neural networks in...

CVE-2022-20142

In createFromParcel of GeofenceHardwareRequestParcelable.java, there is a possible arbitrary code execution due to parcel mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

M1 Chip Vulnerability

This is a new vulnerability against Apples M1 chip. Researchers say that it is unpatchable. Researchers from MIT’s Computer Science and Artificial Intelligence Laboratory, however, have created a novel hardware attack, which combines memory corruption and speculative execution attacks to sidestep...

CVE-2022-21127

A flaw was found in hw. Incomplete cleanup in specific special register read operations for some Intel® Processors may allow an authenticated user to enable information disclosure via local access. Mitigation Mitigation for this issue is either not available or the currently available options don...

CVE-2022-30903

Nokia "G-2425G-A" Bharti Airtel Routers Hardware version "3FE48299DEAA" Software Version "3FE49362IJHK42" is vulnerable to Cross-Site Scripting XSS via the admin-MaintenanceDevice Management...

CVE-2022-30903

Nokia "G-2425G-A" Bharti Airtel Routers Hardware version "3FE48299DEAA" Software Version "3FE49362IJHK42" is vulnerable to Cross-Site Scripting XSS via the admin-MaintenanceDevice Management...

Cross site scripting

Nokia "G-2425G-A" Bharti Airtel Routers Hardware version "3FE48299DEAA" Software Version "3FE49362IJHK42" is vulnerable to Cross-Site Scripting XSS via the admin-MaintenanceDevice Management...