78 matches found
Race condition
In arch/x86/lib/insn-eval.c in the Linux kernel before 5.1.9, there is a use-after-free for access to an LDT entry because of a race condition between modifyldt and a BR exception for an MPX bounds violation...
CVE-2019-13233
In arch/x86/lib/insn-eval.c in the Linux kernel before 5.1.9, there is a use-after-free for access to an LDT entry because of a race condition between modifyldt and a BR exception for an MPX bounds violation...
CVE-2019-13233
In arch/x86/lib/insn-eval.c in the Linux kernel before 5.1.9, there is a use-after-free for access to an LDT entry because of a race condition between modifyldt and a BR exception for an MPX bounds violation...
CVE-2019-13233
In arch/x86/lib/insn-eval.c in the Linux kernel before 5.1.9, there is a use-after-free for access to an LDT entry because of a race condition between modifyldt and a BR exception for an MPX bounds violation...
Linux - Use-After-Free via race Between modify_ldt() and #BR Exception Exploit
/ When a BR exception is raised because of an MPX bounds violation, Linux parses the faulting instruction and computes the linear address of its memory operand. If the userspace instruction is in 32-bit code, this involves looking up the correct segment descriptor and adding the segment offset to...
Linux - Use-After-Free via race Between modify_ldt() and #BR Exception
Linux - Use-After-Free via race Between modifyldt and BR Exception / When a BR exception is raised because of an MPX bounds violation, Linux parses the faulting instruction and computes the linear address of its memory operand. If the userspace instruction is in 32-bit code, this involves looking...
Citrix NetScaler Gateway TLS Padding Oracle Vulnerability (CTX240139)
The remote Citrix NetScaler device is affected by a TLS padding oracle vulnerability. An attacker may be able to leverage this vulnerability to decrypt TLS traffic. Please refer to advisory CTX240139 for more information. Note appliances with all CBC-based ciphers disabled are not affected by thi...
CVE-2019-6485 - TLS Padding Oracle Vulnerability in Citrix Application Delivery Controller (ADC) and NetScaler Gateway
Description of Problem A vulnerability has been identified in the Citrix Application Delivery Controller ADC formally known as NetScaler ADC and NetScaler Gateway platforms using hardware acceleration that could allow an attacker to exploit the appliance to decrypt TLS traffic. This vulnerability...
How to license Citrix NetScaler SDX and MPX using the GUI
This article describes how to license Citrix Netscaler SDX/MPX...
How to Allocate an Extra Management CPU to NetScaler MPX Appliance
The object is to add an additional Management CPU to the NetScaler MPX for Management data processing and monitoring...
On ROCA, KRACK, BoundHook, Google Advanced Protection
Threatpost editors Mike Mimoso and Tom Spring recap this week’s infosec news starting with the ROCA vulnerabilities affecting factorization of RSA private keys, the KRACK WPA2 Wi-Fi vulnerabilities, the BoundHook attacks, and Google’s introduction of Advanced Protection for Gmail. Download: Music...
BoundHook Attack Exploits Intel Skylake MPX Feature
A post-intrusion technique developed by researchers at CyberArk Labs called BoundHooking allows attackers to exploit a feature in all Intel chips introduced since Skylake. The attack technique allows for the execution of code from any process without detection by antivirus software or other...
CVE-2017-10916
The vCPU context-switch implementation in Xen through 4.8.x improperly interacts with the Memory Protection Extensions MPX and Protection Key PKU features, which makes it easier for guest OS users to defeat ASLR and other protection mechanisms, aka XSA-220...
CVE-2017-10916
The vCPU context-switch implementation in Xen through 4.8.x improperly interacts with the Memory Protection Extensions MPX and Protection Key PKU features, which makes it easier for guest OS users to defeat ASLR and other protection mechanisms, aka XSA-220...
CVE-2017-10916
CVE-2017-10916 is an information-leak flaw in the Xen vCPU context-switch handling of Memory Protection Extensions (MPX) and Protection Key (PKU). The issue enables guest OS users to potentially bypass ASLR and related protections. Public advisories (Debian, SUSE, Fedora/OpenVAS/NASL) associate t...
x86: PKRU and BND* leakage between vCPU-s
ISSUE DESCRIPTION Memory Protection Extensions MPX and Protection Key PKU are features in newer processors, whose state is intended to be per-thread and context switched along with all other XSAVE state. Xen's vCPU context switch code would save and restore the state only if the guest had set the...
FAQ: Key Sizes/Certificates Supported by ADC
Q: What are the key sizes/certificates supported by ADC? A : An MPX appliance supports certificates of 512 or more bits, up to the following sizes: 4096-bit server certificate on the virtual server 4096-bit client certificate on the service 4096-bit CA certificate includes intermediate and root...
Borland StarTeam多个远程溢出及拒绝服务漏洞
BUGTRAQ ID: 28080 Borland Starteam是Borland公司ALM生命周期管理的核心工具，是目前市面上最好的软件配置管理工具之一。 Starteam服务器没有正确地计算为从客户端所接收到的某些数组所需分配的内存数，导致多个整数溢出漏洞。在PROJECTLOGIN和SETSERVERACL命令中，有32位从客户端所接收到的用于指定报文中条目数量的数字分别被乘以8（或4，具体取决于文件名名称或规范）和12，然后未经考虑32位的限制便将结果用于分配内存，这可能触发堆溢出，允许攻击者控制某些寄存器，导致执行恶意指令。但攻击者必须拥有有效帐号才能利用这些漏洞。...