CVE-2018-20404

ETKE900.sys, a SmartETK driver for VIA Technologies EPIA-E900 system board, is vulnerable to denial of service attack via IOCTL 0x9C402048, which calls memmove and constantly fails on an arbitrary uncontrollable address, resulting in an eternal hang or a BSoD...

CVE-2018-20404

CVE-2018-20404 affects the ETK_E900.sys SmartETK driver for VIA Technologies EPIA-E900 system boards. The vulnerability is triggered by IOCTL 0x9C402048, which calls memmove and may fail on an arbitrary, uncontrollable address, leading to an eternal hang or a blue screen (DoS). Exploitation detai...

CVE-2018-20331

Local attackers can trigger a Kernel Pool Buffer Overflow in Antiy AVL ATool v1.0.0.22. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the processing of IOCTL 0x80002004 by the...

Buffer overflow

Local attackers can trigger a Kernel Pool Buffer Overflow in Antiy AVL ATool v1.0.0.22. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the processing of IOCTL 0x80002004 by the...

CVE-2018-20331

Local attackers can trigger a Kernel Pool Buffer Overflow in Antiy AVL ATool v1.0.0.22. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the processing of IOCTL 0x80002004 by the...

GIGABYTE Driver Privilege Escalation

SecureAuth - SecureAuth Labs Advisory http://www.secureauth.com/ GIGABYTE Drivers Elevation of Privilege Vulnerabilities 1. Advisory Information Title: GIGABYTE Drivers Elevation of Privilege Vulnerabilities Advisory ID: CORE-2018-0007 Advisory URL:...

Amazon Linux 2 : kernel (ALAS-2018-1133)

A security flaw was found in the Linux kernel in a way that the cleancache subsystem clears an inode after the final file truncation removal. The new file created with the same inode may contain leftover pages from cleancache and the old file data instead of the new one.CVE-2018-16862 An issue wa...

CVE-2018-19522

DriverAgent 2.2015.7.14, which includes DrvAgent64.sys 1.0.0.1, allows a user to send an IOCTL 0x800020F4 with a buffer containing user defined content. The driver's subroutine will execute a wrmsr instruction with the user's buffer for partial input...

Design/Logic Flaw

DriverAgent 2.2015.7.14, which includes DrvAgent64.sys 1.0.0.1, allows a user to send an IOCTL 0x800020F4 with a buffer containing user defined content. The driver's subroutine will execute a wrmsr instruction with the user's buffer for partial input...

CVE-2018-19522

DriverAgent 2.2015.7.14, which includes DrvAgent64.sys 1.0.0.1, allows a user to send an IOCTL 0x800020F4 with a buffer containing user defined content. The driver's subroutine will execute a wrmsr instruction with the user's buffer for partial input...

CVE-2018-19522

DriverAgent 2.2015.7.14, which includes DrvAgent64.sys 1.0.0.1, allows a user to send an IOCTL 0x800020F4 with a buffer containing user defined content. The driver's subroutine will execute a wrmsr instruction with the user's buffer for partial input...

CVE-2018-19522

CVE-2018-19522 involves DriverAgent 2.2015.7.14 with DrvAgent64.sys 1.0.0.1. The driver allows a user to send an IOCTL (0x800020F4) carrying user-controlled data, and the driver’s subroutine will execute a wrmsr instruction using the user buffer for partial input. This is a local impact scenario ...

Local Access Privilege Vulnerability in Multiple Siemens Products

Siemens SINUMERIK 808D and so on are the German Siemens Siemens company's CNC machine tool system controller. A security vulnerability exists in several Siemens products. A local attacker can exploit this vulnerability with ioctl calls to perform out-of-bounds reads, arbitrary writes, or execute...

kernel: Use-after-free in snd_seq_ioctl_create_port()

A use-after-free vulnerability was found when issuing an ioctl to a sound device. This could allow a user to exploit a race condition and create memory corruption or possibly privilege escalation...

kernel: Use-after-free in snd_seq_ioctl_create_port()

A use-after-free vulnerability was found when issuing an ioctl to a sound device. This could allow a user to exploit a race condition and create memory corruption or possibly privilege escalation...

Linux kernel userfaultfd tmpfs file permission bypass vulnerability

Linux kernel is the kernel used by Linux, the open source operating system released by the Linux Foundation in the United States. A security vulnerability exists in the implementation of userfaultfd in versions of Linux kernel prior to 4.19.7, which stems from a program's failure to properly hand...

CVE-2018-11465

A vulnerability has been identified in SINUMERIK 808D V4.7 All versions, SINUMERIK 808D V4.8 All versions, SINUMERIK 828D V4.7 All versions V4.7 SP6 HF1, SINUMERIK 840D sl V4.7 All versions V4.7 SP6 HF5, SINUMERIK 840D sl V4.8 All versions V4.8 SP3. A local attacker could use ioctl calls to do ou...

Out-of-bounds

A vulnerability has been identified in SINUMERIK 808D V4.7 All versions, SINUMERIK 808D V4.8 All versions, SINUMERIK 828D V4.7 All versions V4.7 SP6 HF1, SINUMERIK 840D sl V4.7 All versions V4.7 SP6 HF5, SINUMERIK 840D sl V4.8 All versions V4.8 SP3. A local attacker could use ioctl calls to do ou...

CVE-2018-11465

A vulnerability has been identified in SINUMERIK 808D V4.7 All versions, SINUMERIK 808D V4.8 All versions, SINUMERIK 828D V4.7 All versions V4.7 SP6 HF1, SINUMERIK 840D sl V4.7 All versions V4.7 SP6 HF5, SINUMERIK 840D sl V4.8 All versions V4.8 SP3. A local attacker could use ioctl calls to do ou...

Design/Logic Flaw

The userfaultfd implementation in the Linux kernel before 4.19.7 mishandles access control for certain UFFDIO ioctl calls, as demonstrated by allowing local users to write data into holes in a tmpfs file if the user has read-only access to that file, and that file contains holes, related to...