USN-5070-1 linux, linux-aws, linux-aws-5.11, linux-azure, linux-azure-5.11, linux-gcp, linux-hwe-5.11, linux-kvm, linux-oracle, linux-oracle-5.11, linux-raspi vulnerabilities

Maxim Levitsky and Paolo Bonzini discovered that the KVM hypervisor implementation for AMD processors in the Linux kernel allowed a guest VM to disable restrictions on VMLOAD/VMSAVE in a nested guest. An attacker in a guest VM could use this to read or write portions of the host's physical memory...

Advantech WebAccess BwFLApp Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Advantech WebAccess. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of IOCTL 0x2711, which can be used to invoke BwFLApp.exe. The issue...

Linux Kernel Buffer Overflow Vulnerability

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A buffer error vulnerability exists in the Linux kernel that stems from a race condition issue in vtkioctl in drivers/tty/vt/vtioctl.c. This could result in out-of-bounds reads...

PT-2021-30903

Уязвимость функции vt k ioctl drivers/tty/vt/vt ioctl.c ядра операционной системы Linux связана с чтением за границами памяти. Эксплуатация уязвимости может позволить нарушителю раскрыть защищаемую информацию...

PT-2021-4205

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to a race problem in the vt k ioctl function in the Linux kernel, specifically in the drivers/tty/vt/vt ioctl.c file. This problem may cause an out of bounds read in...

A use-after-free in function hci_sock_bound_ioctl() of the Linux kernel HCI subsystem was found in the way user calls ioct HCIUNBLOCKADDR or other way triggers race condition of the call hci_unregister_dev() together with one of the calls hci_sock_blacklist_add() hci_sock_blacklist_del() hci_get_conn_info() hci_get_auth_info(). A privileged local user could use this flaw to crash the system or escalate their privileges on the system. This flaw affects the Linux kernel versions prior to 5.13-rc5.

...

DEBIAN-CVE-2021-3573

A use-after-free in function hcisockboundioctl of the Linux kernel HCI subsystem was found in the way user calls ioct HCIUNBLOCKADDR or other way triggers race condition of the call hciunregisterdev together with one of the calls hcisockblacklistadd, hcisockblacklistdel, hcigetconninfo,...

CVE-2021-3573

A use-after-free in function hcisockboundioctl of the Linux kernel HCI subsystem was found in the way user calls ioct HCIUNBLOCKADDR or other way triggers race condition of the call hciunregisterdev together with one of the calls hcisockblacklistadd, hcisockblacklistdel, hcigetconninfo,...

CVE-2021-21785

An information disclosure vulnerability exists in the IOCTL 0x9c40a148 handling of IOBit Advanced SystemCare Ultimate 14.2.0.220. A specially crafted I/O request packet IRP can lead to a disclosure of sensitive information. An attacker can send a malicious IRP to trigger this vulnerability...

Information disclosure

An information disclosure vulnerability exists in the IOCTL 0x9c40a148 handling of IOBit Advanced SystemCare Ultimate 14.2.0.220. A specially crafted I/O request packet IRP can lead to a disclosure of sensitive information. An attacker can send a malicious IRP to trigger this vulnerability...

CVE-2021-21785: Exposed IOCTL with Insufficient Access Control

An information disclosure vulnerability exists in the IOCTL 0x9c40a148 handling of IOBit Advanced SystemCare Ultimate 14.2.0.220. A specially crafted I/O request packet IRP can lead to a disclosure of sensitive information. An attacker can send a malicious IRP to trigger this vulnerability...

CVE-2021-21791: Exposed IOCTL with Insufficient Access Control

An information disclosure vulnerability exists in the the way IOBit Advanced SystemCare Ultimate 14.2.0.220 driver handles Privileged I/O read requests. A specially crafted I/O request packet IRP can lead to privileged reads in the context of a driver which can result in sensitive information...

PT-2021-29628

Name of the Vulnerable Software and Affected Versions Linux Kernel versions 4.18 through 5.13.5 Description A potential security issue exists due to a leak in the kvm arch vcpu ioctl vcpu load function. The actual impact and attack plausibility have not yet been proven. This issue was introduced ...

PT-2021-25838

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.19.199 Description The issue is related to a leak in the kvm arch vcpu ioctl function, specifically in the vcpu load operation. The actual impact and potential for attack have not been fully determined...

PT-2021-29833

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.19.199 Description A potential security issue exists due to a leak in the kvm arch vcpu ioctl function, specifically in the vcpu load operation. The actual impact and attack plausibility of this issue have not...

PT-2021-29709

Name of the Vulnerable Software and Affected Versions Linux Kernel versions 4.18 through 5.10.53 Description A potential security issue exists due to a leak in the kvm arch vcpu ioctl function when handling vcpu load. The actual impact and attack plausibility have not yet been proven. This issue...

PT-2021-25633

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions 4.18 through 5.13.5 Description: A potential security issue exists due to a leak in the kvm arch vcpu ioctl function, specifically in the vcpu load operation. The actual impact and likelihood of an attack have not been...

PT-2021-25782

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.4.136 Description The issue is related to a leak in the kvm arch vcpu ioctl function, specifically in the vcpu load operation. This problem was introduced in version v4.18 and is fixed in Linux Kernel version...

PT-2021-25714

Name of the Vulnerable Software and Affected Versions Linux Kernel versions 4.18 through 5.10.53 Description A potential security issue exists due to a leak in the kvm arch vcpu ioctl function, specifically in the vcpu load operation. The actual impact and likelihood of an attack have not been...

PT-2021-25682

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to 5.13.3 Description: The issue concerns the v4l2-core in the Linux Kernel, where ioctl input data is not explicitly cleared. This could potentially lead to security vulnerabilities, although the actual impact and...