Siemens SIMATIC S7-1500 TM MFP BIOS Reachable Assertion (CVE-2020-29562)

The iconv function in the GNU C Library aka glibc or libc6 2.30 to 2.32, when converting UCS4 text containing an irreversible character, fails an assertion in the code path and aborts the program, potentially resulting in a denial of service. This plugin only works with Tenable.ot. Please visit...

Siemens SIMATIC S7-1500 TM MFP BIOS Use After Free (CVE-2021-42380)

A use-after-free in awk leads to denial of service and possibly code execution when processing a crafted awk pattern in the clrvar function. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc...

Siemens SIMATIC Devices Linux Kernel Use After Free (CVE-2022-3534)

A vulnerability classified as critical has been found in Linux Kernel. Affected is the function btfdumpnamedups of the file tools/lib/bpf/btfdump.c of the component libbpf. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier of this...

Siemens SIMATIC S7-1500 TM MFP BIOS Double Free (CVE-2021-27645)

The nameserver caching daemon nscd in the GNU C Library aka glibc or libc6 2.29 through 2.33, when processing a request for netgroup lookup, may crash due to a double-free, potentially resulting in degraded service or Denial of Service on the local system. This is related to netgroupcache.c. This...

Siemens SIMATIC S7-1500 TM MFP BIOS Improper Handling of Exceptional Conditions (CVE-2021-28831)

decompressgunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huftbuild result pointer, with a resultant invalid free or segmentation fault, via malformed gzip data. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more informatio...

Siemens SIMATIC S7-1500 TM MFP BIOS Use After Free (CVE-2021-42381)

A use-after-free in awk leads to denial of service and possibly code execution when processing a crafted awk pattern in the hashinit function. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc...

Siemens SIMATIC S7-1500 TM MFP BIOS Use After Free (CVE-2021-42383)

A use-after-free in awk leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc...

Siemens SIMATIC Devices Linux Kernel Improper Input Validation (CVE-2022-2602)

A flaw was found in the Linux kernel. A race issue occurs between an iouring request and the Unix socket garbage collector, allowing an attacker local privilege escalation. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information...

Siemens SIMATIC Devices Linux Kernel NULL Pointer Dereference (CVE-2022-3115)

An issue was discovered in the Linux kernel through 5.16-rc6. malidpcrtcreset in drivers/gpu/drm/arm/malidpcrtc.c lacks check of the return value of kzalloc and will cause the null pointer dereference. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-o...

Siemens SIMATIC Devices Linux Kernel NULL Pointer Dereference (CVE-2022-42722)

In the Linux kernel 5.8 through 5.19.x before 5.19.16, local attackers able to inject WLAN frames into the mac80211 stack could cause a NULL pointer dereference denial-of-service attack against the beacon protection of P2P devices. This plugin only works with Tenable.ot. Please visit...

Siemens SIMATIC Devices Linux Kernel Use After Free (CVE-2022-47946)

An issue was discovered in the Linux kernel 5.10.x before 5.10.155. A use-after-free in iosqpollwaitsq in fs/iouring.c allows an attacker to crash the kernel, resulting in denial of service. finishwait can be skipped. An attack can occur in some situations by forking a process and then quickly...

Siemens SIMATIC Devices Linux Kernel Access of Resource Using Incompatible Type ('Type Confusion') (CVE-2023-1077)

In the Linux kernel, picknextrtentity may return a type confused entry, not detected by the BUGON condition, as the confused entry will not be NULL, but listhead.The buggy error condition would lead to a type confused entry with the list head,which would then be used as a type confused...

Siemens SIMATIC Devices Linux Kernel Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (CVE-2022-3628)

A buffer overflow flaw was found in the Linux kernel Broadcom Full MAC Wi-Fi driver. This issue occurs when a user connects to a malicious USB device. This can allow a local user to crash the system or escalate their privileges. This plugin only works with Tenable.ot. Please visit...

Siemens SIMATIC S7-1500 TM MFP BIOS Release of Invalid Pointer or Reference (CVE-2021-42377)

An attacker-controlled pointer free in Busybox's hush applet leads to denial of service and possible code execution when processing a crafted shell command, due to the shell mishandling the &&& string. This may be used for remote code execution under rare conditions of filtered command input. Thi...

Siemens SIMATIC S7-1500 TM MFP BIOS Use After Free (CVE-2021-42382)

A use-after-free in awk leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvars function. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc...

Siemens SIMATIC Devices Linux Kernel Use After Free (CVE-2022-32250)

net/netfilter/nftablesapi.c in the Linux kernel through 5.18.1 allows a local user able to create user/net namespaces to escalate privileges to root because an incorrect NFTSTATEFULEXPR check leads to a use-after-free. This plugin only works with Tenable.ot. Please visit...

Siemens SIMATIC Devices Linux Kernel Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') (CVE-2022-1462)

An out-of-bounds read flaw was found in the Linux kernel's TeleTYpe subsystem. The issue occurs in how a user triggers a race condition using ioctls TIOCSPTLCK and TIOCGPTPEER and TIOCSTI and TCXONC with leakage of memory in the flushtoldisc function. This flaw allows a local user to crash the...

Siemens SIMATIC Devices Linux Kernel Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') (CVE-2022-3303)

A race condition flaw was found in the Linux kernel sound subsystem due to improper locking. It could lead to a NULL pointer dereference while handling the SNDCTLDSPSYNC ioctl. A privileged local user root or member of the audio group could use this flaw to crash the system, resulting in a denial...

Siemens SIMATIC Devices Linux Kernel NULL Pointer Dereference (CVE-2022-1852)

A NULL pointer dereference flaw was found in the Linux kernel's KVM module, which can lead to a denial of service in the x86emulateinsn in arch/x86/kvm/emulate.c. This flaw occurs while executing an illegal instruction in guest in the Intel CPU. This plugin only works with Tenable.ot. Please visi...

Siemens SIMATIC S7-1500 TM MFP BIOS Integer Overflow or Wraparound (CVE-2023-0179)

A buffer overflow vulnerability was found in the Netfilter subsystem in the Linux Kernel. This issue could allow the leakage of both stack and heap addresses, and potentially allow Local Privilege Escalation to the root user via arbitrary code execution. This plugin only works with Tenable.ot...