Siemens SIMATIC S7-1500 TM MFP BIOS Use After Free (CVE-2021-42378)

A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvari function. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900...

Siemens SIMATIC S7-1500 TM MFP BIOS Use After Free (CVE-2021-42381)

A use-after-free in awk leads to denial of service and possibly code execution when processing a crafted awk pattern in the hashinit function. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc...

Siemens SIMATIC S7-1500 TM MFP BIOS Improper Handling of Exceptional Conditions (CVE-2021-28831)

decompressgunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huftbuild result pointer, with a resultant invalid free or segmentation fault, via malformed gzip data. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more informatio...

Siemens SIMATIC Devices Linux Kernel Use After Free (CVE-2022-4095)

A use-after-free flaw was found in Linux kernel before 5.19.2. This issue occurs in cmdhdlfilter in drivers/staging/rtl8712/rtl8712cmd.c, allowing an attacker to launch a local denial of service attack and gain escalation of privileges. This plugin only works with Tenable.ot. Please visit...

Siemens SIMATIC Devices Linux Kernel Use After Free (CVE-2022-1882)

A use-after-free flaw was found in the Linux kernel's pipes functionality in how a user performs manipulations with the pipe postonenotification after freepipeinfo that is already called. This flaw allows a local user to crash or potentially escalate their privileges on the system. This plugin on...

Siemens SIMATIC, SCALANCE and RUGGEDCOM Devices Linux Kernel Improper Resource Shutdown or Release (CVE-2022-1473)

The used OpenSSL version improperly reuses memory when decoding certificates or keys. This can lead to a process termination and Denial of Service for long lived processes. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information...

Siemens SIMATIC Devices Linux Kernel Missing Release of Memory after Effective Lifetime (CVE-2022-1012)

A memory leak problem was found in the TCP source port generation algorithm in net/ipv4/tcp.c due to the small table perturb size. This flaw may allow an attacker to information leak and may cause a denial of service problem. This plugin only works with Tenable.ot. Please visit...

Siemens SIMATIC Devices Linux Kernel Use After Free (CVE-2022-3586)

A flaw was found in the Linux kernel's networking code. A use-after- free was found in the way the schsfb enqueue function used the socket buffer SKB cb field after the same SKB had been enqueued and freed into a child qdisc. This flaw allows a local, unprivileged user to crash the system, causin...

Siemens SIMATIC, SCALANCE and RUGGEDCOM Devices Linux Kernel Improper Input Validation (CVE-2022-36946)

nfqnlmangle in net/netfilter/nfnetlinkqueue.c in the Linux kernel through 5.18.14 allows remote attackers to cause a denial of service panic because, in the case of an nfqueue verdict with a one-byte nftapayload attribute, an skbpull can encounter a negative skb-len. This plugin only works with...

Siemens SIMATIC Devices Linux Kernel Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') (CVE-2022-3303)

A race condition flaw was found in the Linux kernel sound subsystem due to improper locking. It could lead to a NULL pointer dereference while handling the SNDCTLDSPSYNC ioctl. A privileged local user root or member of the audio group could use this flaw to crash the system, resulting in a denial...

Siemens SIMATIC Devices Linux Kernel Improper Restriction of Operations within the Bounds of a Memory Buffer (CVE-2022-3564)

A vulnerability classified as critical was found in Linux Kernel. Affected by this vulnerability is the function l2capreassemblesdu of the file net/bluetooth/l2capcore.c of the component Bluetooth. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The...

Siemens SIMATIC Devices Linux Kernel Incorrect Authorization (CVE-2022-20572)

In veritytarget of dm-verity-target.c, there is a possible way to modify read-only files due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android...

Siemens SIMATIC Devices Linux Kernel Use After Free (CVE-2022-20566)

In l2capchanput of l2capcore, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:...

Siemens SIMATIC Devices Linux Kernel Incomplete Cleanup (CVE-2022-0171)

A flaw was found in the Linux kernel. The existing KVM SEV API has a vulnerability that allows a non-root host user-level application to crash the host kernel by creating a confidential guest VM instance in AMD CPU that supports Secure Encrypted Virtualization SEV. This plugin only works with...

Siemens SIMATIC Devices Linux Kernel Use After Free (CVE-2022-32250)

net/netfilter/nftablesapi.c in the Linux kernel through 5.18.1 allows a local user able to create user/net namespaces to escalate privileges to root because an incorrect NFTSTATEFULEXPR check leads to a use-after-free. This plugin only works with Tenable.ot. Please visit...

Siemens SIMATIC S7-1500 TM MFP BIOS Use After Free (CVE-2021-42379)

A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the nextinputfile function. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL...

Siemens SIMATIC Devices Linux Kernel Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (CVE-2022-3628)

A buffer overflow flaw was found in the Linux kernel Broadcom Full MAC Wi-Fi driver. This issue occurs when a user connects to a malicious USB device. This can allow a local user to crash the system or escalate their privileges. This plugin only works with Tenable.ot. Please visit...

Siemens SIMATIC Devices Linux Kernel Access of Resource Using Incompatible Type ('Type Confusion') (CVE-2023-1077)

In the Linux kernel, picknextrtentity may return a type confused entry, not detected by the BUGON condition, as the confused entry will not be NULL, but listhead.The buggy error condition would lead to a type confused entry with the list head,which would then be used as a type confused...

Siemens SIMATIC S7-1500 TM MFP BIOS Improper Restriction of Operations within the Bounds of a Memory Buffer (CVE-2022-3435)

A vulnerability classified as problematic has been found in Linux Kernel. This affects the function fibnhmatch of the file net/ipv4/fibsemantics.c of the component IPv4 Handler. The manipulation leads to out-of-bounds read. It is possible to initiate the attack remotely. It is recommended to appl...

Siemens SIMATIC Devices Linux Kernel Loop with Unreachable Exit Condition ('Infinite Loop') (CVE-2022-42721)

A list management bug in BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before 5.19.16 could be used by local attackers able to inject WLAN frames to corrupt a linked list and, in turn, potentially execute code. This plugin only works with Tenable.ot. Please visit...