Input validation

Memory corruption in SPI buses due to improper input validation while reading address configuration from spi buses in Snapdragon Mobile, Snapdragon Wearables...

CVE-2022-25698

Memory corruption in SPI buses due to improper input validation while reading address configuration from spi buses in Snapdragon Mobile, Snapdragon Wearables...

PT-2022-17470 · Qualcomm · Qualcomm Snapdragon Mobile +1

Name of the Vulnerable Software and Affected Versions: Qualcomm Snapdragon Mobile affected versions not specified Qualcomm Snapdragon Wearables affected versions not specified Description: The issue is related to memory corruption in SPI buses due to improper input validation while reading addres...

CVE-2022-25698

Memory corruption in SPI buses due to improper input validation while reading address configuration from spi buses in Snapdragon Mobile, Snapdragon Wearables...

CVE-2022-25698

CVE-2022-25698 : Concrete issue in Qualcomm Snapdragon Mobile and Snapdragon Wearables, caused by memory corruption in SPI buses due to improper input validation when reading address configuration. Affected components are Qualcomm’s SPI bus handling in those platforms; root cause is input validat...

CVE-2022-45269

A directory traversal vulnerability in the component SCS.Web.Server.SPI/1.0 of Linx Sphere LINX 7.35.ST15 allows attackers to read arbitrary files...

Stack overflow

An stack buffer overflow vulnerability leads to arbitrary code execution issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. If the attacker modifies specific UEFI variables, it can cause a stack overflow, leading to arbitrary code execution. The specific variables are normally...

CVE-2022-35897

An stack buffer overflow vulnerability leads to arbitrary code execution issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. If the attacker modifies specific UEFI variables, it can cause a stack overflow, leading to arbitrary code execution. The specific variables are normally...

CVE-2022-35897

CVE-2022-35897 affects Insyde InsydeH2O kernel 5.0–5.5. A stack buffer overflow occurs when an attacker modifies certain UEFI variables, potentially causing arbitrary code execution. Exploitation requires direct SPI modification and the attacker must change at least two of three variables (Secure...

CVE-2022-35897

An stack buffer overflow vulnerability leads to arbitrary code execution issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. If the attacker modifies specific UEFI variables, it can cause a stack overflow, leading to arbitrary code execution. The specific variables are normally...

kernel security, bug fix, and enhancement update

4.18.0-425.3.1.OL8 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...

PT-2022-19517 · Intel · Fwblockservicesmm

Name of the Vulnerable Software and Affected Versions: FwBlockServiceSmm driver versions prior to 05.21.51.0048 FwBlockServiceSmm driver versions prior to 05.42.23.0066 FwBlockServiceSmm driver versions prior to 05.42.11.0021 FwBlockServiceSmm driver versions prior to 05.44.25.0052...

GSD-2022-1006350 spi: bitbang: Fix lsb-first Rx

spi: bitbang: Fix lsb-first Rx This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.19.9 by commit 048f549c629a13e8f570767bf0f9392510c39886, it wa...

GSD-2022-1006348 regmap: spi: Reserve space for register address/padding

regmap: spi: Reserve space for register address/padding This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.19.9 by commit...

PT-2022-34605 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.19.9 Description: The issue concerns a potential security vulnerability in the Linux Kernel. It is related to the regmap: spi, where space for register address/padding is reserved. The actual impact and attac...

PT-2022-34607 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions v5.18 through v5.19.8 Description: The issue is related to a bitbang fix for lsb-first Rx in the SPI driver. It was introduced in version v5.18 and fixed in version v5.19.9. The actual impact and attack plausibility have...

CVE-2022-40261

An attacker can exploit this vulnerability to elevate privileges from ring 0 to ring -2, execute arbitrary code in System Management Mode - an environment more privileged than operating system OS and completely isolated from it. Running arbitrary code in SMM additionally bypasses SMM-based SPI...

CVE-2022-40261 SMM memory corruption vulnerability in OverClockSmiHandler SMM driver

An attacker can exploit this vulnerability to elevate privileges from ring 0 to ring -2, execute arbitrary code in System Management Mode - an environment more privileged than operating system OS and completely isolated from it. Running arbitrary code in SMM additionally bypasses SMM-based SPI...

PT-2022-25306 · Unknown · Overclocksmihandler

Name of the Vulnerable Software and Affected Versions: OverClockSmiHandler affected versions not specified Description: An attacker can exploit this issue to elevate privileges from ring 0 to ring -2, execute arbitrary code in System Management Mode - an environment more privileged than the...

GSD-2022-1005645 spi: tegra20-slink: fix UAF in tegra_slink_remove()

spi: tegra20-slink: fix UAF in tegraslinkremove This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.61 by commit...