The road to secure crypto: start getting risk management priorities on your threat modeling radar

While attending the biggest event in crypto history earlier this month in Miami, it struck me that, although irrational over-exuberance was the mood, the reality is really sinking in: We are in a new payments industry paradigm shift. Its not a fad anymore, and its not going away. An exclamation t...

Upcoming Speaking Engagements

This is a current list of where and when I am scheduled to speak: Ill be part of a European Internet Forum virtual debate on June 17, 2021. The topic is "Decrypting the encryption debate: How to ensure public safety with a privacy-preserving and secure Internet?" I’m speaking at the all-online...

UVI-2021-1000107 NFS: fs_context: validate UDP retrans to prevent shift out-of-bounds

NFS: fscontext: validate UDP retrans to prevent shift out-of-bounds This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.11.20 by commit...

UVI-2021-1000470 liquidio: Fix unintented sign extension of a left shift of a u16

liquidio: Fix unintented sign extension of a left shift of a u16 This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.233 by commit...

UVI-2021-1000454 liquidio: Fix unintented sign extension of a left shift of a u16

liquidio: Fix unintented sign extension of a left shift of a u16 This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.191 by commit...

UVI-2021-1000426 liquidio: Fix unintented sign extension of a left shift of a u16

liquidio: Fix unintented sign extension of a left shift of a u16 This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.119 by commit...

GSD-2021-1000374 sched/fair: Fix shift-out-of-bounds in load_balance()

sched/fair: Fix shift-out-of-bounds in loadbalance This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.37 by commit...

PT-2021-28535

Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.6 through v5.12.3 Description The issue is related to the fs context in NFS, where validation of UDP retransmissions can prevent shift out-of-bounds. This problem was introduced in version v5.6 and is fixed in version...

PT-2021-28574

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.11.20 Description The issue concerns the validation of UDP retransmissions in the fs context of the NFS, which could potentially lead to a shift out-of-bounds. The actual impact and attack plausibility have no...

PT-2021-28609

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.36 Description The issue concerns the validation of UDP retransmissions in the fs context of the NFS, which could potentially lead to a shift out-of-bounds. The actual impact and attack plausibility have no...

PT-2021-28738

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.12.4 Description The issue is related to a shift-out-of-bounds in the load balance function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior ...

PT-2021-24541

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.12.3 Description: The issue is related to the fs context in NFS, where validation of UDP retransmissions can prevent shift out-of-bounds errors. The actual impact and attack plausibility have not yet been...

PT-2021-24845

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.37 Description: The issue is related to a shift-out-of-bounds in the load balance function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions...

PT-2021-28891

Name of the Vulnerable Software and Affected Versions liquidio versions prior to v5.4.119 Description The issue concerns an unintended sign extension of a left shift of a u16 value. This problem was introduced in version v4.9 and is fixed in Linux Kernel version v5.4.119. The actual impact and...

PT-2021-28839

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.37 Description The issue is related to a shift-out-of-bounds in the load balance function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior...

PT-2021-28829

Name of the Vulnerable Software and Affected Versions liquidio versions prior to v5.10.37 Description The issue concerns an unintended sign extension of a left shift of a u16. This problem was introduced in version v4.9 and is fixed in Linux Kernel version v5.10.37. The actual impact and attack...

PT-2021-24897

Name of the Vulnerable Software and Affected Versions: liquidio versions prior to v5.4.119 Description: The issue concerns an unintended sign extension of a left shift of a u16 value. This problem was introduced in version v4.9 and is fixed in Linux Kernel version v5.4.119. The actual impact and...

PT-2021-24925

Name of the Vulnerable Software and Affected Versions: liquidio versions prior to v4.19.191 Description: The issue concerns an unintended sign extension of a left shift of a u16. This problem was introduced in version v4.9 and is fixed in Linux Kernel version v4.19.191. The actual impact and atta...

PT-2021-24953

Name of the Vulnerable Software and Affected Versions: liquidio versions prior to v4.9.269 Description: The issue concerns an unintended sign extension of a left shift of a u16. This problem was introduced in version v4.9 and is fixed in Linux Kernel version v4.9.269. The actual impact and attack...

PT-2021-24729

Name of the Vulnerable Software and Affected Versions liquidio versions prior to v5.12.4 Description The issue concerns an unintended sign extension of a left shift of a u16. This problem was introduced in version v4.9 and is fixed in Linux Kernel version v5.12.4. Recommendations For versions pri...