Security Advisory - Buffer Overflow Vulnerability in QEMU-KVM

There is a buffer overflow vulnerability in the vhost module of QEMU-KVM. During the hot migration of the target VM, an attacker with guest user account may send descriptors with invalid length to the affected host to exploit this vulnerability. Successfully exploited may cause the kernel buffer...

Linux Bluetooth hidp_process_report Buffer Overflow

The vulnerability of the hidpprocessreport function in the Bluetooth component of the Linux kernel’s core code is due to a numerical overflow condition. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected informati...

Apple macOS Mojave Kernel Buffer Overflow Vulnerability (CNVD-2019-14423)

Apple macOS Mojave is a specialized operating system developed by Apple for Mac computers.Kernel is one of the kernel components. A buffer overflow vulnerability exists in the Kernel component of Apple macOS Mojave versions prior to 10.14.4. An attacker could exploit this vulnerability to execute...

macOS 10.14.3 iOS 12.1.3 - Kernel Heap Overflow in PF_KEY due to Lack of Bounds Checking when Retrieving Statistics

macOS 10.14.3 iOS 12.1.3 - Kernel Heap Overflow in PFKEY due to Lack of Bounds Checking when Retrieving Statistics / Inspired by Ned Williamsons's fuzzer I took a look at the netkey code. keygetsastat handles SADBGETSASTAT messages: It allocates a buffer based on the number of SAs there currently...

macOS < 10.14.3 / iOS < 12.1.3 - Kernel Heap Overflow in PF_KEY due to Lack of Bounds Checking when Retrieving Statistics

/ Inspired by Ned Williamsons's fuzzer I took a look at the netkey code. keygetsastat handles SADBGETSASTAT messages: It allocates a buffer based on the number of SAs there currently are: bufsize = ipsecsavcount + 1 sizeofsastatssav; KMALLOCWAITsastatssav, typeofsastatssav, bufsize; It the...

XNU Kernel Code Execution

The vulnerability of the ICMP packet processing module in the XNU kernel of iOS and macOS operating systems is caused by an overflow in the buffer in the “stack”. Exploiting this vulnerability allows a remote attacker to execute arbitrary code using specially crafted ICMP packets...

Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Apple Iphone_Os

node-cve-2018-4407 Node.js PoC exploit code for CVE-2018-4407...

DEBIAN-CVE-2018-14634

An integer overflow flaw was found in the Linux kernel's createelftables function. An unprivileged local user with access to SUID or otherwise privileged binary could use this flaw to escalate their privileges on the system. Kernel versions 2.6.x, 3.10.x and 4.14.x are believed to be vulnerable...

MacOS/iOS kernel heap overflow due to lack of lower size check in getvolattrlist(CVE-2018-4243)

getvolattrlist takes a user controlled bufferSize argument via the fgetattrlist syscall. When allocating a kernel buffer to serialize the attr list to there's the following comment: / Allocate a target buffer for attribute results. Note that since we won't ever copy out more than the caller...

UBUNTU-CVE-2017-17806

The HMAC implementation crypto/hmac.c in the Linux kernel before 4.14.8 does not validate that the underlying cryptographic hash algorithm is unkeyed, allowing a local attacker able to use the AFALG-based hash interface CONFIGCRYPTOUSERAPIHASH and the SHA-3 hash algorithm CONFIGCRYPTOSHA3 to caus...

kernel: Integer overflow in ip6_find_1stfragopt() causes infinite loop

An integer overflow vulnerability in ip6find1stfragopt function was found. A local attacker that has privileges of CAPNETRAW to open raw socket can cause an infinite loop inside the ip6find1stfragopt function...

Jungo DriverWizard WinDriver < 12.4.0 - Kernel Pool Overflow / Local Privilege Escalation (1)

-- coding: utf-8 -- """ Jungo DriverWizard WinDriver Kernel Pool Overflow Vulnerability Download: http://www.jungo.com/st/products/windriver/ File: WD1240.EXE Sha1: 3527cc974ec885166f0d96f6aedc8e542bb66cba Driver: windrvr1240.sys Sha1: 0f212075d86ef7e859c1941f8e5b9e7a6f2558ad CVE: CVE-2017-14153...

Mac OS X iOS Privilege Escalation

The vulnerability of the Kernel component in Mac OS X and iOS systems is related to a numerical overflow condition. Exploiting this vulnerability allows an attacker to execute arbitrary code in a privileged context using a specially created application...

Mac OS X iOS Privilege Escalation

The vulnerability of the Kernel component in the Mac OS X and iOS operating systems is caused by a numerical overflow. Exploiting this vulnerability allows an attacker to execute arbitrary code in privileged contexts or cause a service failure using a specially created application...

kernel: Integer overflow when using kzalloc in vfio driver

The use of a kzalloc with an integer multiplication allowed an integer overflow condition to be reached in vfiopciintrs.c. This combined with CVE-2016-9083 may allow an attacker to craft an attack and use unallocated memory, potentially crashing the machine...

Mac OS X Privilege Escalation

The vulnerability of the dtrace dynamic tracing framework in the Mac OS X operating system’s kernel is caused by a numerical overflow. Exploiting this vulnerability allows an attacker to execute arbitrary code in a privileged context using a specially created application...

FreeBSD 10.2 64位内核堆溢出漏洞（CVE-2016-1885）

FreeBSD简介 FreeBSD是一种类UNIX的开源操作系统，为不同架构的计算机系统提供了不同程度的支持。FreeBSD提供先进的网络、性能、安全以及兼容性，这些特性在其他现代操作系统上仍有所缺失，即使是一些最好的商业操作系统。 在网络方面，FreeBSD的性能也是相当优异的。在很重的负载之下，FreeBSD仍然可以稳定的运行，这也是很多网络服务器采用 FreeBSD 的原因之一。 漏洞描述 在FreeBSD...

Advantech WebAccess Integer Overflow Vulnerability

WebAccess HMI/SCADA software provides remote control and management, allowing users to easily view and configure automation devices in facility management systems, power stations and building automation systems. An integer overflow vulnerability exists in the Kernel service of Advantech WebAccess...

iOS Code Execution

The vulnerability of the IOKit component in the iOS operating system’s kernel is caused by a buffer overflow. Exploiting this vulnerability allows an attacker to execute arbitrary code with elevated privileges or cause a service failure using a specially crafted application...

iOS Mac OS X Privilege Escalation

The vulnerability of the kernel in iOS and Mac OS X operating systems is related to a numerical overflow condition. Exploiting this vulnerability allows an attacker to execute arbitrary code in a privileged context remotely...