AlmaLinux 9 : xorg-x11-server (ALSA-2023:2248)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:2248 advisory. - A vulnerability classified as critical was found in X.org Server. Affected by this vulnerability is the function GetCountedString of the file xkb/xkb.c...

AlmaLinux 9 : libtiff (ALSA-2023:2340)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:2340 advisory. - Multiple heap buffer overflows in tiffcrop.c utility in libtiff library Version 4.4.0 allows attacker to trigger unsafe or out of bounds memory access v...

Fedora 38 : kernel (2023-26325e5399)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-26325e5399 advisory. The 6.2.15 stable kernel update contains a number of important fixes across the tree. Tenable has extracted the preceding description block directly...

SUSE SLES12: cluster-md-kmp-rt / dlm-kmp-rt / gfs2-kmp-rt / kernel-devel-rt / etc (SUSE-SU-2023:2156-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2156-1 advisory. The SUSE Linux Enterprise 12 SP5 RT kernel was updated to receive various security and bugfixes. The following security bugs were fixed: -...

SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2023:2151-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2151-1 advisory. The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes. The following security...

OESA-2023-1276 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: The specific flaw exists within the DPT I2O Controller driver. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this in conjunction with other vulnerabilities to...

CVE-2023-22297

Access of memory location after end of buffer in some IntelR Server Board BMC firmware before version 2.90 may allow a privileged user to enable escalation of privilege via local access...

Design/Logic Flaw

Access of memory location after end of buffer in some IntelR Server Board BMC firmware before version 2.90 may allow a privileged user to enable escalation of privilege via local access...

CVE-2023-22297

Access of memory location after end of buffer in some IntelR Server Board BMC firmware before version 2.90 may allow a privileged user to enable escalation of privilege via local access...

CVE-2023-22297

The CVE-2023-22297 issue affects Intel® Server Board BMC firmware prior to 2.90, caused by access of memory location after end of buffer. This can allow a local, privileged user to escalate privileges. Intel’s advisory (intel-sa-00839) confirms the vulnerability and lists CVE-2023-22297 among iss...

SUSE CVE-2023-2598

A flaw was found in the fixed buffer registration code for iouring iosqebufferregister in iouring/rsrc.c in the Linux kernel that allows out-of-bounds access to physical memory beyond the end of the buffer. This flaw enables full local privilege escalation...

PT-2023-18406 · Intel · Intel Server Board Bmc Firmware

Name of the Vulnerable Software and Affected Versions: IntelR Server Board BMC firmware versions prior to 2.90 Description: The issue allows a privileged user to enable escalation of privilege via local access due to access of memory location after end of buffer in the firmware. Recommendations:...

Upgraded Q -> 2 from #49 [1683711080406]

Judge has assessed an item in Issue 49 as 2 risk. The relevant finding follows: QA10. readKeyValue fails to enforce the constraint offset+len Mitigation: make sure offset+len input.length revert outOfBoundAccess; uint256 separator = input.findoffset, len, "="; if separator == typeuint256.max retu...

CVE-2021-46760

A malicious or compromised UApp or ABL can send a malformed system call to the bootloader, which may result in an out-of-bounds memory access that may potentially lead to an attacker leaking sensitive information or achieving code execution...

Default credentials

A malicious or compromised UApp or ABL can send a malformed system call to the bootloader, which may result in an out-of-bounds memory access that may potentially lead to an attacker leaking sensitive information or achieving code execution...

CVE-2021-46769

Insufficient syscall input validation in the ASP Bootloader may allow a privileged attacker to execute arbitrary DMA copies, which can lead to code execution...

CVE-2021-46760

CVE-2021-46760 affects AMD Secure Processor (ASP) and AMD System Management Unit (SMU) where a malicious or compromised UApp/ABL can send a malformed system call to the bootloader, causing out-of-bounds memory access and potentially leaking sensitive information or achieving code execution. CVSS ...

CVE-2021-46760

A malicious or compromised UApp or ABL can send a malformed system call to the bootloader, which may result in an out-of-bounds memory access that may potentially lead to an attacker leaking sensitive information or achieving code execution...

kernel: udmabuf: Set the DMA mask for the udmabuf device (v2)

In the Linux kernel, the following vulnerability has been resolved: udmabuf: Set the DMA mask for the udmabuf device v2 If the DMA mask is not set explicitly, the following warning occurs when the userspace tries to access the dma-buf via the CPU as reported by syzbot here: WARNING: CPU: 1 PID:...

kernel: iavf: Fix adminq error handling

In the Linux kernel, the following vulnerability has been resolved: iavf: Fix adminq error handling iavfallocasqbufs/iavfallocarqbufs allocates with dmaalloccoherent memory for VF mailbox. Free DMA regions for both ASQ and ARQ in case error happens during configuration of ASQ/ARQ registers. Witho...