hw: cpu: Intel: Post-barrier Return Stack Buffer Predictions

A flaw was found in hw. In certain processors with Intel's Enhanced Indirect Branch Restricted Speculation eIBRS capabilities, soon after VM exit or IBPB command event, the linear address following the most recent near CALL instruction prior to a VM exit may be used as the Return Stack Buffer RSB...

UBUNTU-CVE-2022-43282

wasm-interp v1.0.29 was discovered to contain an out-of-bounds read via the component OnReturnCallIndirectExpr-GetReturnCallDropKeepCount...

PT-2022-26828 · Unknown +1 · Wasm-Interp +1

Name of the Vulnerable Software and Affected Versions: wasm-interp version 1.0.29 Description: The issue is related to an out-of-bounds read in the OnReturnCallIndirectExpr component, specifically via the GetReturnCallDropKeepCount method. Recommendations: For version 1.0.29, consider restricting...

USN-5703-1: Linux kernel (Intel IoTG) vulnerabilities

Selim Enes Karaduman discovered that a race condition existed in the General notification queue implementation of the Linux kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service system crash or possibly execute arbitrary code. CVE-2022-188...

U.S. Dept Of Defense: IDOR leaking PII data via VendorId parameter

Description: Dear DoD, I found one bug on your domain from Hack US program: █████ It's IDOR bug. Make sure to know that I didn't test many funcs here for IDOR. I didn't test for ATO Account Takeover. But you should fix this. Here's the PoC: ██████████ Thank you DoD! Impact An attacker could steal...

Ubuntu: Security Advisory (USN-2438-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu: Security Advisory (USN-3525-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DSA-5207-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2022-5521 · Amd +2 · Amd Processor Microcode +2

Name of the Vulnerable Software and Affected Versions: AMD processor microcode affected versions not specified Description: The issue is related to the implementation of the Indirect Branch Prediction Barrier IBPB mechanism in AMD processor microcode, which may lead to a potential information...

Intel® Processors Post Invalidation RSB Advisory

Summary: A potential security vulnerability in some Intel® Processors may allow information disclosure. Intel is releasing prescriptive guidance to address this potential vulnerability. Vulnerability Details: CVEID: CVE-2022-26373 Description: Non-transparent sharing of return predictor targets...

CVE-2022-31154 Indirect Object Access in Sourcegraph Code Monitoring

Sourcegraph is an opensource code search and navigation engine. It is possible for an authenticated Sourcegraph user to edit the Code Monitors owned by any other Sourcegraph user. This includes being able to edit both the trigger and the action of the monitor in question. An attacker is not able ...

CVE-2022-28693

Unprotected alternative channel of return branch target prediction in some IntelR Processors may allow an authorized user to potentially enable information disclosure via local access...

Intel® Processors RRSBA Advisory

Summary: A potential security vulnerability in some Intel® Processors may allow information disclosure. Intel is releasing prescriptive guidance to address this potential vulnerability. Vulnerability Details: CVEID: CVE-2022-28693 Description: Unprotected alternative channel of return branch targ...

Solving the indirect vulnerability enigma - fixing indirect vulnerabilities without breaking your dependency tree

Fixing indirect vulnerabilities is one of those complex, tedious and, quite frankly, boring tasks that no one really wants to touch. No one except for Debricked, it seems. Sure, there are lots of ways to do it manually, but can it be done automatically with minimal risk of breaking changes? The...

PT-2022-4409 · Intel +3 · Intel Processors +3

Name of the Vulnerable Software and Affected Versions: IntelR Processors affected versions not specified Description: The issue is related to an unprotected alternative channel of return branch target prediction in some IntelR Processors, which may allow an authorized user to potentially enable...

The vulnerability of AMD processor-based LFENCE/JMP modules allows attackers to disclose protected information.

The vulnerability of AMD’s LFENCE/JMP processors lies in the characteristics of the branch prediction module’s operation. Exploiting this vulnerability allows an attacker to gain access to protected memory from a program that does not have the necessary privileges, by using the mechanism for...

hw: cpu: intel: Branch History Injection (BHI)

A flaw was found in hw. The Branch History Injection BHI describes a specific form of intra-mode BTI. This flaw allows an unprivileged attacker to manipulate the branch history before transitioning to supervisor or VMX root mode. This issue is an effort to cause an indirect branch predictor to...

hw: cpu: intel: Intra-Mode BTI

A flaw was found in hw. The Intra-mode BTI refers to a variant of Branch Target Injection aka SpectreV2 BTI where an indirect branch speculates to an aliased predictor entry for a different indirect branch in the same predictor mode, and a disclosure gadget at the predicted target transiently...

hw: cpu: intel: Branch History Injection (BHI)

A flaw was found in hw. The Branch History Injection BHI describes a specific form of intra-mode BTI. This flaw allows an unprivileged attacker to manipulate the branch history before transitioning to supervisor or VMX root mode. This issue is an effort to cause an indirect branch predictor to...

Huawei EulerOS: Security Advisory for qemu (EulerOS-SA-2022-1622)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...