CVE-2022-31696

VMware ESXi contains a memory corruption vulnerability that exists in the way it handles a network socket. A malicious actor with local access to ESXi may exploit this issue to corrupt memory leading to an escape of the ESXi sandbox...

Memory corruption

VMware ESXi contains a memory corruption vulnerability that exists in the way it handles a network socket. A malicious actor with local access to ESXi may exploit this issue to corrupt memory leading to an escape of the ESXi sandbox...

Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The patch for XSA-392 introduced another issue which might result in a deadlock when trying to free the SKB of a packet dropped due to the XSA-392 handling (CVE-2022-42328). Additionally when dropping packages for other reasons the same deadlock could occur in case of netpoll being active for the interface the xen-netback driver is connected to (CVE-2022-42329).

...

Microsoft Windows Secure Socket Tunneling Protocol 竞争条件问题漏洞

The Microsoft Windows Secure Socket Tunneling Protocol is a Microsoft mechanism for encapsulating Point-to-Point Protocol PPP traffic via the HTTPS protocol, as specified in RFC1945, RFC2616, and RFC2818. This protocol enables users to access private networks using HTTPS. HTTPS can traverse most...

PT-2022-5851 · Microsoft · Windows Sstp +1

Name of the Vulnerable Software and Affected Versions: Windows Secure Socket Tunneling Protocol SSTP affected versions not specified Description: The issue is related to errors in synchronization when using a shared resource, specifically a "race condition" situation, in the implementation of the...

CVE-2022-31696

VMware ESXi contains a memory corruption vulnerability that exists in the way it handles a network socket. A malicious actor with local access to ESXi may exploit this issue to corrupt memory leading to an escape of the ESXi sandbox...

CVE-2022-31696

CVE-2022-31696 is a memory‑corruption flaw in VMware ESXi related to how a network socket is handled. A local, authenticated attacker could exploit this to escape the ESXi sandbox. Affected: ESXi (versions referenced in connected docs). Impact: potential memory corruption with high severity. Miti...

Ubuntu: Security Advisory (USN-5773-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerability of the network socket of the VMware ESXi hypervisor allows a attacker to execute arbitrary code with elevated privileges.

The vulnerability of the VMware ESXi hypervisor’s network socket is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability allows an attacker to execute arbitrary code with elevated privileges...

CVE-2022-3633

A memory leak flaw was found in the Linux kernel’s j1939 socket functionality. This flaw allows a local user to crash the system...

PT-2022-36489 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v4.19.267 Description: The issue is related to an alignment problem in the bpf prog test run skb function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel...

PT-2022-36481 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v4.19.267 Description: The issue is related to close race conditions on sk receive queue. The actual impact and attack plausibility have not yet been proven. It was introduced in version v4.6 and fixed in Linux...

PT-2022-36552 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v4.14.300 Description: The issue is related to an alignment problem in the bpf prog test run skb function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel...

PT-2022-5817 · Vmware · Vmware Esxi

Name of the Vulnerable Software and Affected Versions: VMware ESXi affected versions not specified Description: The issue is related to a memory corruption vulnerability in the way VMware ESXi handles a network socket. A malicious actor with local access to ESXi may exploit this issue to corrupt...

CVE-2022-3629

A memory leak flaw was found in the Linux kernel’s Virtual Socket Protocol. This flaw allows a local user to crash the system...

DEBIAN-CVE-2022-42329

Guests can trigger deadlock in Linux netback driver This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. The patch for XSA-392 introduced another issue which might result in a deadlock when trying to free the SKB of a packe...

PT-2022-7680 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to a potential use-after-free in the ravb rx gbeth function. This occurs because the skb is delivered to napi gro receive, which may free it. After this call,...

NodeBB 安全漏洞

NodeBB is a forum system from the Design Create Play team built using Node.js, a web application platform built on top of Google's V8 JavaScript engine. A security vulnerability exists in NodeBB versions prior to 2.6.1, which stems from the use of plain objects with prototypes in socket.io messag...

PT-2024-11835 · Linux +4 · Linux Kernel +4

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to a NULL pointer dereference in the sk user ns function, which is caused by the newly allocated skb not having sk in the unix diag get exact function. This can le...

The vulnerability of the FUJITSU Extended Socket Network driver in the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the FUJITSU Extended Socket Network kernel driver in the Linux operating system is related to the swapping of the zero pointer. Exploiting this vulnerability can allow an attacker to cause a service failure...