409 matches found
HyperDeceit
HyperDeceit This repository contains the full source-code of the HyperDeceit project which is a library that allows you to impersonate as Hyper-V and intercept hypercalls done by the Windows kernel. Blog post: https://reversing.info/posts/hyperdeceit/ Disclaimer The code has not been through prop...
kernel: KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1
A flaw was found in the Kernel-based Virtual Machine KVM nSVM module of the Linux kernel. This vulnerability occurs when an unhandled VMMCALL is not properly intercepted by the Level 1 L1 hypervisor. A malicious Level 2 L2 guest operating system could exploit this by making specific hypercalls,...
CVE-2026-99258
In the Linux kernel, the following vulnerability has been resolved: x86/hyperv: Avoid using per-cpu output page in hvapicidtovpindex hvapicidtovpindex currently uses the per-cpu hypercall input and output pages. This function is called when running in VTL2 and when running in an SEV-SNP CoCo VM...
DEBIAN-CVE-2026-99258
In the Linux kernel, the following vulnerability has been resolved: x86/hyperv: Avoid using per-cpu output page in hvapicidtovpindex hvapicidtovpindex currently uses the per-cpu hypercall input and output pages. This function is called when running in VTL2 and when running in an SEV-SNP CoCo VM...
Security update for qemu (important)
openSUSE security update: security update for qemu ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22047-1 Rating: important References: bsc1263864 bsc1279962 bsc1282077 bsc1282578 bsc1282918 Cross-References: CVE-2026-81627 CVE-2026-93834 CVSS...
OPENSUSE-SU-2026:22047-1 Security update for qemu
This update for qemu fixes the following issues: Security issues fixed: - CVE-2026-81627: missing writable RAM alias validation in the VAPIC setup hypercall allows a privileged guest user to bypass chipset DLCK protection and injecting code into System Management Mode memory bsc1282077. -...
SUSE-SU-2026:24159-1 Security update for qemu
This update for qemu fixes the following issues: Security issues fixed: - CVE-2026-81627: missing writable RAM alias validation in the VAPIC setup hypercall allows a privileged guest user to bypass chipset DLCK protection and injecting code into System Management Mode memory bsc1282077. -...
SUSE-SU-2026:24115-1 Security update for qemu
This update for qemu fixes the following issues: Security issues fixed: - CVE-2026-81627: missing writable RAM alias validation in the VAPIC setup hypercall allows a privileged guest user to bypass chipset DLCK protection and injecting code into System Management Mode memory bsc1282077. -...
SUSE CVE-2026-81627
A flaw was found in QEMU. The VAPIC setup hypercall in hw/i386/vapic.c does not validate that the writable RAM alias remains within the option ROM window. A privileged guest user on a Q35/KVM machine can position this alias over locked SMRAM, bypassing chipset DLCK protection and injecting code...
AZL-105275 CVE-2026-81627 affecting package qemu for versions less than 10.1.0-2
A flaw was found in QEMU. The VAPIC setup hypercall in hw/i386/vapic.c does not validate that the writable RAM alias remains within the option ROM window. A privileged guest user on a Q35/KVM machine can position this alias over locked SMRAM, bypassing chipset DLCK protection and injecting code...
CVE-2026-81627
A flaw was found in QEMU. The VAPIC setup hypercall in hw/i386/vapic.c does not validate that the writable RAM alias remains within the option ROM window. A privileged guest user on a Q35/KVM machine can position this alias over locked SMRAM, bypassing chipset DLCK protection and injecting code...
CVE-2026-81627 Qemu-kvm: vapic writable rom alias can escape the option-rom window and expose locked smram
A flaw was found in QEMU. The VAPIC setup hypercall in hw/i386/vapic.c does not validate that the writable RAM alias remains within the option ROM window. A privileged guest user on a Q35/KVM machine can position this alias over locked SMRAM, bypassing chipset DLCK protection and injecting code...
CVE-2026-81627
A flaw was found in QEMU. The VAPIC setup hypercall in hw/i386/vapic.c does not validate that the writable RAM alias remains within the option ROM window. A privileged guest user on a Q35/KVM machine can position this alias over locked SMRAM, bypassing chipset DLCK protection and injecting code...
PT-2026-105041
A flaw was found in QEMU. The VAPIC setup hypercall in hw/i386/vapic.c does not validate that the writable RAM alias remains within the option ROM window. A privileged guest user on a Q35/KVM machine can position this alias over locked SMRAM, bypassing chipset D LCK protection and injecting code...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: x86/hyperv: Disabling IBT when the hypercall page lacks the ENDBR instruction. On hardware that supports Indirect Branch Tracking IBT, Hyper-V VMs with ConfigVersion 9.3 or later support IBT in the guest. However, current version...
SUSE-SU-2026:3451-1 Security update for xen
This update for xen fixes the following issues - CVE-2026-42493: x86 shadow paging is deprecated bsc1271528. - CVE-2026-42494,CVE-2026-42495,CVE-2026-62423,CVE-2026-62424,CVE-2026-62425: buffer overruns in libfsimage iso9660 handling bsc1271530. - CVE-2026-62426,CVE-2026-62427: sysctl and...
ALPINE-CVE-2026-62432
The EVTCHNOPexpandarray hypercall checks for whether FIFO event channels are enabled, but without holding the correct lock. It can race with EVTCHNOPreset, resulting in dereferencing a NULL pointer...
CVE-2026-62432
The EVTCHNOPexpandarray hypercall checks for whether FIFO event channels are enabled, but without holding the correct lock. It can race with EVTCHNOPreset, resulting in dereferencing a NULL pointer...
UBUNTU-CVE-2026-62432
The EVTCHNOPexpandarray hypercall checks for whether FIFO event channels are enabled, but without holding the correct lock. It can race with EVTCHNOPreset, resulting in dereferencing a NULL pointer...
CVE-2026-62433 correct buffer checks for DM_OP hypercalls
Parts of the DMOP handling code assumes the caller has provided the required number of buffers for the given operation without any checking being done. As a result, certain operations might access stack rubble as structures are possibly uninitialized...