Remote code execution

Azure Sphere Unsigned Code Execution Vulnerability...

Spoofing

Azure Sphere Tampering Vulnerability...

Remote code execution

Azure Sphere Unsigned Code Execution Vulnerability...

CVE-2020-16994 Azure Sphere Unsigned Code Execution Vulnerability

...

CVE-2020-16994

Azure Sphere has a code‑execution vulnerability in the normal world via unsigned code execution through /proc/self/mem. The TALOS advisory details how a process can write to its own memory by leveraging a Linux kernel behavior that allows memory to be writable and executable, circumventing protec...

CVE-2020-16994 Azure Sphere Unsigned Code Execution Vulnerability

...

CVE-2020-16992

CVE-2020-16992 is an Azure Sphere elevation-of-privilege vulnerability affecting Microsoft Azure Sphere. The connected PT-2020-4813 entry describes insufficient access control as the root cause and notes affected Azure Sphere versions with no specified fix version; it recommends updating via Wind...

CVE-2020-16992 Azure Sphere Elevation of Privilege Vulnerability

...

CVE-2020-16993 Azure Sphere Elevation of Privilege Vulnerability

...

CVE-2020-16993

CVE-2020-16993 concerns Microsoft Azure Sphere and describes a privilege-escalation vulnerability in the uid_map functionality of Azure Sphere 20.06 and earlier. The root cause is that the application-manager clears uniqueness checks among listed UIDs, allowing multiple component_ids to share the...

CVE-2020-16989 Azure Sphere Elevation of Privilege Vulnerability

...

CVE-2020-16990 Azure Sphere Information Disclosure Vulnerability

...

CVE-2020-16990

Azure Sphere (Microsoft) kernel message ring buffer information disclosure vulnerability (CVE-2020-16990) affects Azure Sphere 20.05+; unprivileged users can access the kernel log via klogctl due to default dmesg_restrict settings, potentially leaking memory addresses and other sensitive data. TA...

CVE-2020-16989

CVE-2020-16989 affects Microsoft Azure Sphere. The connected PT-Security entry indicates the issue involves errors in privilege management within the Azure Sphere OS, enabling a remote attacker to elevate privileges. Public references show the vulnerability is classified as a privilege escalation...

CVE-2020-16991

Azure Sphere contains a signed-code-execution vulnerability in the Normal World. A specially crafted shellcode can be executed by abusing ptrace to modify a running process’s memory, bypassing write protections and enabling arbitrary code execution. TALOS documents this as a local, low-attack-sur...

CVE-2020-16991 Azure Sphere Unsigned Code Execution Vulnerability

...

CVE-2020-16987

Azure Sphere contains a local unsigned code execution vulnerability in the normal world path via /proc/thread-self/mem allowing an attacker to write shellcode into a process memory region and execute it. The TALOS advisory for Azure Sphere 20.07 details a shellcode-based overwrite of non-writable...

CVE-2020-16988 Azure Sphere Elevation of Privilege Vulnerability

...

CVE-2020-16987 Azure Sphere Unsigned Code Execution Vulnerability

...

CVE-2020-16988

CVE-2020-16988 corresponds to a Microsoft Azure Sphere Elevation of Privilege vulnerability. Connected PT-2020-4764 confirms a privilege-management error in Azure Sphere OS that could let a remote attacker elevate privileges, potentially enabling remote privilege escalation. The CVSS metrics in t...