CVE-2017-11046: Out-of-bounds Write

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, when an audio driver ioctl handler is called, a kernel out-of-bounds write can potentially occur...

Joyent SmartOS Hyprlofs FS IOCTL Add Entries Native File System Denial of Service Vulnerability(CVE-2016-9039)

Summary An exploitable denial of service exists in the the Joylent SmartOS OS 20161110T013148Z Hyprlofs file system. The vulnerability is present in the Ioctl system call with the command HYPRLOFSADDENTRIES. An attacker can cause a buffer to be allocated and never freed. When repeatedly exploit...

Joyent SmartOS Hyprlofs FS IOCTL Add Entries 32-bit File System Denial of Service Vulnerability(CVE-2016-9040)

Summary An exploitable denial of service exists in the the Joylent SmartOS OS 20161110T013148Z Hyprlofs file system. The vulnerability is present in the Ioctl system call with the command HYPRLOFSADDENTRIES when used with a 32 bit model. An attacker can cause a buffer to be allocated and never...

Joyent SmartOS Hyprlofs FS IOCTL 32-bit File System path Buffer Overflow Privilege Escalation Vulnerability(CVE-2016-9035)

Summary An exploitable buffer overflow exists in the the Joyent SmartOS OS 20161110T013148Z Hyprlofs file system. The vulnerability is present in the Ioctl system call with the command HYPRLOFSADDENTRIES when dealing with native file systems. An attacker can craft an input that can cause a buffer...

Joyent SmartOS Hyprlofs FS IOCTL Native File System Integer Overflow Privilege Escalation Vulnerability(CVE-2016-8733)

Summary An exploitable integer overflow exists in the Joyent SmartOS OS 20161110T013148Z Hyprlofs file system. The vulnerability is present in the Ioctl system call with the command HYPRLOFSADDENTRIES when dealing with native file systems. An attacker can craft an input that can cause a kernel...

Joyent SmartOS Hyprlofs FS IOCTL Native File System path Buffer Overflow Privilege Escalation Vulnerability(CVE-2016-9033)

Summary An exploitable buffer overflow exists in the the Joyent SmartOS OS 20161110T013148Z Hyprlofs file system. The vulnerability is present in the Ioctl system call with the command HYPRLOFSADDENTRIES when dealing with native file systems. An attacker can craft an input that can cause a buffer...

DEBIAN-CVE-2017-14991

The sgioctl function in drivers/scsi/sg.c in the Linux kernel before 4.13.4 allows local users to obtain sensitive information from uninitialized kernel heap-memory locations via an SGGETREQUESTTABLE ioctl call for /dev/sg0...

Design/Logic Flaw

The sgioctl function in drivers/scsi/sg.c in the Linux kernel before 4.13.4 allows local users to obtain sensitive information from uninitialized kernel heap-memory locations via an SGGETREQUESTTABLE ioctl call for /dev/sg0...

CVE-2017-14991

The sgioctl function in drivers/scsi/sg.c in the Linux kernel before 4.13.4 allows local users to obtain sensitive information from uninitialized kernel heap-memory locations via an SGGETREQUESTTABLE ioctl call for /dev/sg0...

CVE-2017-14991

The sgioctl function in drivers/scsi/sg.c in the Linux kernel before 4.13.4 allows local users to obtain sensitive information from uninitialized kernel heap-memory locations via an SGGETREQUESTTABLE ioctl call for /dev/sg0...

PT-2017-13808

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.13.4 Description The issue allows local users to obtain sensitive information from uninitialized kernel heap-memory locations. This is achieved via an SG GET REQUEST TABLE ioctl call for /dev/sg0, specifically...

Trend Micro OfficeScan tmwfp Memory Corruption Privilege Escalation Vulnerability

This vulnerability allows local attackers to execute arbitrary code on vulnerable installations of Trend Micro OfficeScan. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the...

Apple assembleBGScanResults Heap Overflow Vulnerability

Exploit for macOS platform in category dos / poc Apple: Heap overflow in "assembleBGScanResults" when handling ioctl results CVE-2017-7105 Broadcom produces Wi-Fi HardMAC SoCs which are used to handle the PHY and MAC layer processing. These chips are present in both mobile devices and Wi-Fi...

Apple setVendorIE Heap Overflow / Information Disclosure Vulnerabilities

Exploit for macOS platform in category dos / poc Apple: Heap overflow and information disclosure in "setVendorIE" when handling ioctl results CVE-2017-7110 Broadcom produces Wi-Fi HardMAC SoCs which are used to handle the PHY and MAC layer processing. These chips are present in both mobile device...

Apple updateRateSetAsyncCallback Heap Overflow Vulnerability

Exploit for macOS platform in category dos / poc Apple: Heap overflow in "updateRateSetAsyncCallback" when handling ioctl results CVE-2017-7108 Broadcom produces Wi-Fi HardMAC SoCs which are used to handle the PHY and MAC layer processing. These chips are present in both mobile devices and Wi-Fi...

rzpnk.sys IOCTL Process Descriptor

The vulnerability of the rzpnk.sys driver, a IOCTL handler for configuring a cloud-based system, is related to deficiencies in access control for the ZwOpenProcess procedure. Exploiting this vulnerability allows a malicious actor to open a descriptor for an arbitrary process remotely...

NetMechanica NetDecision Winring0x32.sys Driver Elevation of Privilege Vulnerability

NetMechanica NetDecision is a suite of network device monitoring software.Winring0x32.sys driver is one of the drivers. A security vulnerability exists in the Winring0x32.sys driver in NetMechanica NetDecision version 5.8.2. A local attacker can exploit this vulnerability to gain privileges with...

Memory corruption

In all Qualcomm products with Android releases from CAF using the Linux kernel, concurrent calls into ioctl RMNETIOCTLADDMUXCHANNEL in ipa wan driver may lead to memory corruption due to missing locks...

CVE-2017-9677

In all Qualcomm products with Android releases from CAF using the Linux kernel, in function msmcomprioctlshared, variable "ddp-paramslength" could be accessed and modified by multiple threads, while it is not protected with locks. If one thread is running, while another thread is setting data, ra...

PT-2017-19111

Name of the Vulnerable Software and Affected Versions Qualcomm products with Android releases from CAF using the Linux kernel affected versions not specified Description The issue arises from the function msm compr ioctl shared, where the variable ddp-params length can be accessed and modified by...