AMD’s multiple products have vulnerabilities related to input validation errors

AMD Platform Security Processor and AMD Secure Encrypted Virtualization are both products of AMD Corporation.AMD Platform Security Processor is a security processor.AMD Secure Encrypted Virtualization is a software application. Hardware-accelerated memory encryption to protect data in use. An inp...

AMD Platform Security Processor input validation error vulnerability

AMD Platform Security Processor is a security processor from AMD, Inc. AMD Platform Security Processor suffers from an input validation error vulnerability that stems from insufficient input validation against discrete TPM commands in the PSP firmware could lead to a potential loss of integrity a...

AMD Secure Processor Security Feature Vulnerability

The Advanced Micro Devices AMD Secure Processor ASP is a standalone ARM Coretex-A5 chip from Advanced Micro Devices. AMD Secure Processor suffers from a security signature issue vulnerability that can be exploited by an attacker to exploit multiple vulnerabilities in AMD processors...

AMD Platform Security Processor Command Injection Vulnerability

HP ProLiant is the intelligent computing foundation for HP America's hybrid cloud, providing unparalleled workload optimization, security and automation, all available as a service. HP ProLiant has a command injection vulnerability that can be exploited by an attacker who can exploit multiple...

AMD Platform Security Processor input validation error vulnerability

AMD Platform Security Processor is a security processor from AMD. The AMD Platform Security Processor suffers from an input validation error vulnerability that originates from a vulnerability that can be exploited by an attacker to exploit multiple vulnerabilities in AMD processors...

AMD Secure Processor Input Verification Error Vulnerability

AMD Secure Processor ASP is a standalone ARM Coretex-A5 chip from AMD. An input validation error vulnerability exists in multiple AMD products that stems from incorrect input and range checking in the Platform Secure Processor PSP bootloader image header that could allow an attacker to use...

Cisco Adaptive Security Appliances SSL/TLS DoS

The vulnerability of SSL/TLS message processors in microprogramming network interface devices from Cisco Adaptive Security Appliances and Cisco Firepower Threat Defense involves an operation that goes beyond the buffer in memory. Exploiting this vulnerability could allow a malicious actor to caus...

CVE-2021-26321

Insufficient ID command validation in the SEV Firmware may allow a local authenticated attacker to perform a denial of service of the PSP...

CVE-2021-26315

When the AMD Platform Security Processor PSP boot rom loads, authenticates, and subsequently decrypts an encrypted FW, due to insufficient verification of the integrity of decrypted image, arbitrary code may be executed in the PSP when encrypted firmware images are used...

CVE-2021-26335

Improper input and range checking in the AMD Secure Processor ASP boot loader image header may allow an attacker to use attacker-controlled values prior to signature validation potentially resulting in arbitrary code execution...

kernel: fuse: stall on CPU can occur because a retry loop continually finds the same bad inode

A denial of service in the kernel side of the FUSE functionality can allow a local system to create a denial of service...

kernel: DoS in rb_per_cpu_empty()

A lack of CPU resources in the Linux kernel tracing module functionality was found in the way users use the trace ring buffer in specific way. Only privileged local users with CAPSYSADMIN capability could use this flaw to starve the resources causing denial of service...

BIOS Reference Code Advisory

Summary: Potential security vulnerabilities in the BIOS reference code for some Intel® Processors may allow escalation of privilege. Intel is releasing firmware updates to mitigate these potential vulnerabilities. Vulnerability Details: CVEID: CVE-2021-0157 Description: Insufficient control flow...

Intel® Processor Advisory

Summary: A potential security vulnerability in some Intel® Processors may allow escalation of privilege. Intel is releasing firmware updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2021-0146 Description: Hardware allows activation of test or debug logic at...

AMD Server Vulnerabilities – November 2021

Bulletin ID: AMD-SB-1021 Potential Impact: Varies by CVE, see descriptions below Severity: Varies by CVE, see descriptions below Summary During security reviews in collaboration with Google, Microsoft, and Oracle, potential vulnerabilities in the AMD Secure Processor ASP, AMD System Management Un...

Multiple Qualcomm product vulnerabilities involving buffer errors

Qualcomm QCA6574AU and others are products of Qualcomm Incorporated Qualcomm.QCA6574AU is a central processing unit CPU product.APQ8017 is a central processing unit CPU product.SDX55 is a modem.Qualcomm QCA6574AU is a central processing unit CPU product.APQ8017 is a central processing unit CPU...

Redmine Project Management Authorization Bypass

The vulnerability of the incoming email processor in Redmine’s project and task management web application relates to the bypassing of the addissuenotes permission restrictions. Exploiting this vulnerability could allow a malicious actor to influence the integrity of data...

GitLab input validation vulnerability

GitLab is a self-hosted, Git version control system project repository application developed in Ruby on Rails by GitLab, Inc. GitLab CE/EE is vulnerable to input validation errors, which can be exploited to cause high CPU usage...

CVE-2021-22097

In Spring AMQP versions 2.2.0 - 2.2.18 and 2.3.0 - 2.3.10, the Spring AMQP Message object, in its toString method, will deserialize a body for a message with content type application/x-java-serialized-object. It is possible to construct a malicious java.util.Dictionary object that can cause 100%...

F5 Networks BIG-IP : Intel processor vulnerabilities (K41043270)

The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the K41043270 advisory. CVE-2021-0086Observable response discrepancy in floating-point operations for some IntelR Processors may allow...