Xen Hypervisor Pagetable De-typing Recursion Handling Guest-to-Host DoS (XSA-240)

According to its self-reported version number, the Xen hypervisor installed on the remote host is affected by a stack overflow vulnerability that is triggered when recursion is not properly handled when de-typing linear pagetables. By stacking multiple layers of page tables, an attacker within a...

Why is Malwarebytes blocking CoinHive?

If you've encountered a Malwarebytes web protection block for coinhive.com over the last few weeks, you are either glad about it, angry about it, or don't really care. Since September 19, the second most frequently blocked website for our customers has been coinhive.com, and when we observe that...

UBUNTU-CVE-2017-15592

An issue was discovered in Xen through 4.9.x allowing x86 HVM guest OS users to cause a denial of service hypervisor crash or possibly gain privileges because self-linear shadow mappings are mishandled for translated guests...

x86: Incorrect handling of self-linear shadow mappings with translated guests

ISSUE DESCRIPTION The shadow pagetable code uses linear mappings to inspect and modify the shadow pagetables. A linear mapping which points back to itself is known as self-linear. For translated guests, the shadow linear mappings being in a separate address space are not intended to be self-linea...

x86: Incorrect handling of IST settings during CPU hotplug

ISSUE DESCRIPTION The x86-64 architecture allows interrupts to be run on distinct stacks. The choice of stack is encoded in a field of the corresponding interrupt descriptor in the Interrupt Descriptor Table IDT. That field selects an entry from the active Task State Segment TSS. Since, on AMD...

Product update: Virtuozzo Automator 7.0 Update 2 Hotfix 3 (VA MN: 7.0.2-510, VA Agent: 7.0.2-258)

This hotfix for Virtuozzo Automator 7.0.2 provides new features as well as stability and usability bug fixes. Vulnerability id: PVA-34527 Alert reason would not be shown on clicking the alert icon on the virtual environment or hardware node summary page if the corresponding event had already been...

USN-3443-2 linux-hwe vulnerabilities

USN-3443-1 fixed vulnerabilities in the Linux kernel for Ubuntu 17.04. This update provides the corresponding updates for the Linux Hardware Enablement HWE kernel from Ubuntu 17.04 for Ubuntu 16.04 LTS. It was discovered that on the PowerPC architecture, the kernel did not properly sanitize the...

Vulnerability in TPM could allow Security Feature Bypass

Executive Summary This advisory addresses CVE-2017-15361, also referred to as "Return of Coppersmith's Attack" ROCA. A security vulnerability exists in certain Trusted Platform Module TPM chipsets. The vulnerability weakens key strength. It is important to note that this is a firmware...

Google Android Media framework audio hal elevation of privilege vulnerability

Android is a free and open source Linux-based operating system led and developed by Google Inc. and the Open Handset Alliance. An elevation of privilege vulnerability exists in the Media framework audio hal in Android. An attacker can exploit this vulnerability to gain elevated privileges...

Debian DLA-1128-1 : qemu-kvm security update

Multiple vulnerabilities were discovered in qemu-kvm, a full virtualization solution for Linux hosts on x86 hardware with x86 guests based on the Quick EmulatorQemu. CVE-2017-14167 Incorrect validation of multiboot headers could result in the execution of arbitrary code. CVE-2017-15038 When using...

CVE-2017-0812

An elevation of privilege vulnerability in the Android media framework audio hal. Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-62873231...

UBUNTU-CVE-2017-0812

An elevation of privilege vulnerability in the Android media framework audio hal. Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-62873231...

UPDATE: WarBerryPi Version 5.1b!

PenTestIT RSS Feed My last post pertaining to this Red Teaming Hardware Implant was about an updated version. This post also covers the changes made to two versions since my last post about the WarBerryPi v5. We now have an updated release for the Raspberry Pi based hardware implant allowing you ...

Five Critical Android Bugs Get Patched in October Update

Five critical vulnerabilities were reported by Google Monday as part of its October Android Security Bulletin. In all, 14 patches were issued for corresponding vulnerabilities, ranging from critical to high. The relative low bug count for the month of October is due to the fact this month Google...

CVE-2017-12154

The preparevmcs02 function in arch/x86/kvm/vmx.c in the Linux kernel through 4.13.3 does not ensure that the "CR8-load exiting" and "CR8-store exiting" L0 vmcs02 controls exist in cases where L1 omits the "use TPR shadow" vmcs12 control, which allows KVM L2 guest OS users to obtain read and write...

CVE-2017-12154

The CVE-2017-12154 entry describes a Linux kernel KVM/vmx issue (arch/x86/kvm/vmx.c: prepare_vmcs02) present through kernel 4.13.3. Root cause: it does not ensure that the CR8-load exiting and CR8-store exiting vmcs02 controls exist when L1 omits the use_TPR_shadow VMCS12 control, enabling a KVM ...

[SECURITY] Fedora 26 Update: gnome-shell-3.24.3-2.fc26

GNOME Shell provides core user interface functions for the GNOME 3 desktop, like switching to windows and launching applications. GNOME Shell takes advantage of the capabilities of modern graphics hardware and introduces innovative user interface concepts to provide a visually attractive and easy...

Multiple Thales nShield Connect Hardware Privilege Access Control Vulnerabilities

Thales nShield Connect hardware models 500 and others are networked HSM Hardware Security Module devices from Thales e-Security, USA. A security vulnerability exists in several models of Thales nShield Connect hardware. An attacker in close physical proximity could exploit this vulnerability to...

CVE-2017-9645

An Inadequate Encryption Strength issue was discovered in Mirion Technologies DMC 3000 Transmitter Module, iPam Transmitter f/DMC 2000, RDS-31 iTX and variants including RSD31-AM Package, DRM-1/2 and variants including Solar PWR Package, DRM and RDS Based Boundary Monitors, External Transmitters,...

Design/Logic Flaw

An Inadequate Encryption Strength issue was discovered in Mirion Technologies DMC 3000 Transmitter Module, iPam Transmitter f/DMC 2000, RDS-31 iTX and variants including RSD31-AM Package, DRM-1/2 and variants including Solar PWR Package, DRM and RDS Based Boundary Monitors, External Transmitters,...