GSD-2021-1002764 scsi: scsi_debug: Fix type in min_t to avoid stack OOB

scsi: scsidebug: Fix type in mint to avoid stack OOB This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.11 by commit...

GSD-2021-1002755 net: stmmac: dwmac-rk: fix oob read in rk_gmac_setup

net: stmmac: dwmac-rk: fix oob read in rkgmacsetup This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.11 by commit...

GSD-2021-1002714 scsi: scsi_debug: Fix type in min_t to avoid stack OOB

scsi: scsidebug: Fix type in mint to avoid stack OOB This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.88 by commit...

in vim/vim

Description A heap-based OOB read of size 4 occurs when a user tries to open a vim session file specified below. This happens regarless of any command line options that could be specified to restrict vim, such -Z and -m. This bug has been found on default vim build in Ubuntu 20.04 for x8664/amd64...

CVE-2021-0924

An out-of-bounds OOB memory access flaw was found in xhcivendorgetops in drivers/usb/host/xhci.c in the Linux kernel's xhci platform drivers. In this flaw, a local attacker with user privileges may cause an escalation of privilege due to a missing sanity check. Mitigation Mitigation for this issu...

GSD-2021-1002550 atlantic: Fix OOB read and write in hw_atl_utils_fw_rpc_wait

atlantic: Fix OOB read and write in hwatlutilsfwrpcwait This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.7 by commit...

GSD-2021-1002481 atlantic: Fix OOB read and write in hw_atl_utils_fw_rpc_wait

atlantic: Fix OOB read and write in hwatlutilsfwrpcwait This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.84 by commit...

GSD-2021-1002440 atlantic: Fix OOB read and write in hw_atl_utils_fw_rpc_wait

atlantic: Fix OOB read and write in hwatlutilsfwrpcwait This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.164 by commit...

GSD-2021-1002412 atlantic: Fix OOB read and write in hw_atl_utils_fw_rpc_wait

atlantic: Fix OOB read and write in hwatlutilsfwrpcwait This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.220 by commit...

CVE-2021-4090

An out-of-bounds OOB memory write flaw was found in the NFSD in the Linux kernel. Missing sanity may lead to a write beyond bmvalbmlen-1 in nfsd4decodebitmap4 in fs/nfsd/nfs4xdr.c. In this flaw, a local attacker with user privilege may gain access to out-of-bounds memory, leading to a system...

CVE-2021-4090

An out-of-bounds OOB memory write flaw was found in the NFSD in the Linux kernel. Missing sanity may lead to a write beyond bmvalbmlen-1 in nfsd4decodebitmap4 in fs/nfsd/nfs4xdr.c. In this flaw, a local attacker with user privilege may gain access to out-of-bounds memory, leading to a system...

tokenWhitelist might break if removeFromTokenWhitelist is called multiple times with the same token

Handle gzeon Vulnerability details Impact In removeFromTokenWhitelist of ProtocolGovernance, numberOfValidTokens is decreased by 1 if addr is in tokenEverAdded. There are no check if the addr is still in the whitelist and therefore numberOfValidTokens can be repeatedly decreased to 0 by calling...

SUSE SLES15: libnetcdf-gnu-hpc / libnetcdf-gnu-mpich-hpc / etc (SUSE-SU-2021:3873-1)

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3873-1 advisory. - Fixed multiple vulnerabilities in ezXML: CVE-2019-20007, CVE-2019-20006, CVE-2019-20201, CVE-2019-20202, CVE-2019-20199, CVE-2019-20200,...

Huawei EulerOS: Security Advisory for kernel (EulerOS-SA-2021-2782)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 18.04 LTS / 20.04 LTS : Linux kernel vulnerabilities (USN-5137-2)

The remote Ubuntu 18.04 LTS / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5137-2 advisory. It was discovered that the f2fs file system in the Linux kernel did not properly validate metadata in some situations. An attacker could use...

Heap OOB read in all `tf.raw_ops.QuantizeAndDequantizeV*` ops

Impact The shape inference functions for the QuantizeAndDequantizeV operations can trigger a read outside of bounds of heap allocated array as illustrated in the following sets of PoCs: python import tensorflow as tf @tf.function def test: data=tf.rawops.QuantizeAndDequantizeV4Grad...

Heap OOB in shape inference for `QuantizeV2`

Impact The shape inference code for QuantizeV2 can trigger a read outside of bounds of heap allocated array: python import tensorflow as tf @tf.function def test: data=tf.rawops.QuantizeV2 input=1.0,1.0, minrange=1.0,10.0, maxrange=1.0,10.0, T=tf.qint32, mode='MINCOMBINED', roundmode='HALFTOEVEN'...

Heap OOB read in `tf.ragged.cross`

Impact The shape inference code for tf.ragged.cross can trigger a read outside of bounds of heap allocated array: python import tensorflow as tf @tf.function def test: y = tf.rawops.RaggedCrossraggedvalues=, raggedrowsplits=, sparseindices=5, sparsevalues=, sparseshape=5, denseinputs='a',...

Undefined behavior via `nullptr` reference binding in sparse matrix multiplication

Impact The code for sparse matrix multiplication is vulnerable to undefined behavior via binding a reference to nullptr: python import tensorflow as tf tf.rawops.SparseMatMul a=1.0,1.0,1.0, b=,,, transposea=False, transposeb=False, aissparse=False, bissparse=True This occurs whenever the dimensio...

`SparseFillEmptyRows` heap OOB

Impact The implementation of SparseFillEmptyRows can be made to trigger a heap OOB access: python import tensorflow as tf data=tf.rawops.SparseFillEmptyRows indices=0,0,0,0,0,0, values='sssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssss', denseshape=5,3, defaultvalue='o' This occurs...