PT-2022-31094

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.18.3 Description The issue is related to a double free in the si parse power table function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior ...

CVE-2022-1665

A set of pre-production kernel packages of Red Hat Enterprise Linux for IBM Power architecture can be booted by the grub in Secure Boot mode even though it shouldn't. These kernel builds don't have the secure boot lockdown patches applied to it and can bypass the secure boot validations, allowing...

CVE-2022-1665

A set of pre-production kernel packages of Red Hat Enterprise Linux for IBM Power architecture can be booted by the grub in Secure Boot mode even though it shouldn't. These kernel builds don't have the secure boot lockdown patches applied to it and can bypass the secure boot validations, allowing...

CVE-2022-1665

A set of pre-production kernel packages of Red Hat Enterprise Linux for IBM Power architecture can be booted by the grub in Secure Boot mode even though it shouldn't. These kernel builds don't have the secure boot lockdown patches applied to it and can bypass the secure boot validations, allowing...

Code injection

A set of pre-production kernel packages of Red Hat Enterprise Linux for IBM Power architecture can be booted by the grub in Secure Boot mode even though it shouldn't. These kernel builds don't have the secure boot lockdown patches applied to it and can bypass the secure boot validations, allowing...

CVE-2022-1665

CVE-2022-1665 affects Red Hat Enterprise Linux for IBM Power (ppc64le): pre-production kernel packages could bypass Secure Boot lockdown patches and load non-trusted code. Root cause: missing lockdown patches in affected builds. Impact: potential code execution with elevated privileges by booting...

CVE-2022-1665

A set of pre-production kernel packages of Red Hat Enterprise Linux for IBM Power architecture can be booted by the grub in Secure Boot mode even though it shouldn't. These kernel builds don't have the secure boot lockdown patches applied to it and can bypass the secure boot validations, allowing...

CVE-2022-1665

A set of pre-production kernel packages of Red Hat Enterprise Linux for IBM Power architecture can be booted by the grub in Secure Boot mode even though it shouldn't. These kernel builds don't have the secure boot lockdown patches applied to it and can bypass the secure boot validations, allowing...

IBM Power System security vulnerabilities

The IBM Power System is a Power processor-based server computer from IBM in the United States. A security vulnerability exists in the IBM Power System, which arises from a pre-production kernel package that can be bootstrapped by grub in Secure Boot Mode. These kernel builds do not have the Secur...

CVE-2022-1665: Public Key Re-Use for Signing both Debug and Production Code

A set of pre-production kernel packages of Red Hat Enterprise Linux for IBM Power architecture can be booted by the grub in Secure Boot mode even though it shouldn't. These kernel builds don't have the secure boot lockdown patches applied to it and can bypass the secure boot validations, allowing...

Microsoft Power BI Component Spoofing

The vulnerability of the Microsoft Power BI local data gateway’s component is related to errors in information presentation by the user interface. Exploiting this vulnerability allows a malicious actor to perform spoofing attacks remotely...

Malware in weather-power-up

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2022-7063 Malicious code in weather-power-up (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7a4fa4b856ba13413f1fa2757b592c0b5988dd18bd051989b3ca22ee0f975fc4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in weather-power-up (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7a4fa4b856ba13413f1fa2757b592c0b5988dd18bd051989b3ca22ee0f975fc4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1271 Malicious code in azure-arm-powerbidedicated-samples-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1e949858ae810e1567a6a2d7b0da9d70a05c271905a357bde28cacd667e0596f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1270 Malicious code in azure-arm-powerbidedicated-samples-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 464eaf05a08fa03f4bbb461e7b8cfd53a5fb6a68a638e5b9a305a9c082a5b88d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Hertzbleed: A New Side-Channel Attack

Hertzbleed is a new side-channel attack that works against a variety of microprocressors. Deducing cryptographic keys by analyzing power consumption has long been an attack, but its not generally viable because measuring power consumption is often hard. This new attack measures power consumption ...

CVE-2022-1665

A flaw was found in the Linux kernel, where a set of pre-production kernel packages of Red Hat Enterprise Linux for IBM Power architecture were signed with Red Hat's production secure boot keys. This issue allows kernel versions targeted for testing to eventually boot in PowerPC environments with...

IBM AIX and VIOS Denial of Service Vulnerability

IBM AIX is an open standards-based UNIX operating system developed by IBM for the IBM Power architecture. IBM AIX versions 7.1, 7.2, 7.3 and VIOS version 3.1 have a denial-of-service vulnerability that stems from failure to properly process incoming error messages, which can be exploited by...

Hertzbleed exposes computers’ secret whispers

Hertzbleed is the name for a vulnerability that can be used to obtain cryptographic keys and other secret data from Intel and AMD CPUs, remotely. It works by monitoring changes in power consumption, which can be deduced by the careful timing of known workloads, thanks to a processor power saving...