ThunderSpy

A combination of vulnerabilities for the Thunderbolt protocol have been announced that allow a malicious actor to access most machines with a Thunderbolt port and bypass security restrictions on the device. Recent assessments: agalauner-r7 at May 11, 2020 4:37pm UTC reported: The risks of DMA...

DEBIAN-CVE-2020-12769

An issue was discovered in the Linux kernel before 5.4.17. drivers/spi/spi-dw.c allows attackers to cause a panic via concurrent calls to dwspiirq and dwspitransferone, aka CID-19b61392c5a8...

CVE-2020-12769

An issue was discovered in the Linux kernel before 5.4.17. drivers/spi/spi-dw.c allows attackers to cause a panic via concurrent calls to dwspiirq and dwspitransferone, aka CID-19b61392c5a8...

Design/Logic Flaw

An issue was discovered in the Linux kernel before 5.4.17. drivers/spi/spi-dw.c allows attackers to cause a panic via concurrent calls to dwspiirq and dwspitransferone, aka CID-19b61392c5a8...

CVE-2020-12769

An issue was discovered in the Linux kernel before 5.4.17. drivers/spi/spi-dw.c allows attackers to cause a panic via concurrent calls to dwspiirq and dwspitransferone, aka CID-19b61392c5a8...

CVE-2020-12769

An issue was discovered in the Linux kernel before 5.4.17. drivers/spi/spi-dw.c allows attackers to cause a panic via concurrent calls to dwspiirq and dwspitransferone, aka CID-19b61392c5a8...

CVE-2020-12769

An issue was discovered in the Linux kernel before 5.4.17. drivers/spi/spi-dw.c allows attackers to cause a panic via concurrent calls to dwspiirq and dwspitransferone, aka CID-19b61392c5a8...

CVE-2020-12769

CVE-2020-12769 affects the Linux kernel prior to 5.4.17. The issue is in drivers/spi/spi-dw.c, where concurrent calls to dw_spi_irq and dw_spi_transfer_one can trigger a kernel panic (local exploit). The vulnerability is fixed in Linux kernel 5.4.17 (see ChangeLog-5.4.17). No exploit details are ...

CVE-2020-12769

An issue was discovered in the Linux kernel before 5.4.17. drivers/spi/spi-dw.c allows attackers to cause a panic via concurrent calls to dwspiirq and dwspitransferone, aka CID-19b61392c5a8...

CVE-2020-12769: Improper Synchronization

An issue was discovered in the Linux kernel before 5.4.17. drivers/spi/spi-dw.c allows attackers to cause a panic via concurrent calls to dwspiirq and dwspitransferone, aka CID-19b61392c5a8...

spi-oficina.decathlon.pt Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1153751 Security Researcher Papix2020 Helped patch 18 vulnerabilities Received 1 Coordinated Disclosure badges Received 2 recommendations , a holder of 1 badges for responsible and coordinated disclosure, found a security vulnerability affecting spi-oficina.decathlon.pt...

PT-2020-2633

Name of the Vulnerable Software and Affected Versions Thunderbolt devices affected versions not specified Description The issue is related to errors in the implementation of the SPI Flash interface in Thunderbolt device microcontrollers. Exploitation of this issue could allow an attacker to gain...

USN-4300-1: Linux kernel vulnerabilities

It was discovered that the KVM implementation in the Linux kernel, when paravirtual TLB flushes are enabled in guests, the hypervisor in some situations could miss deferred TLB flushes or otherwise mishandle them. An attacker in a guest VM could use this to expose sensitive information read memor...

Ubuntu 18.04 LTS : Linux kernel vulnerabilities (USN-4300-1)

The remote Ubuntu 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4300-1 advisory. It was discovered that the KVM implementation in the Linux kernel, when paravirtual TLB flushes are enabled in guests, the hypervisor in some situations...

Hardware Router CTF

Here at Pen Test Partners we love hardware and also love a good CTF. So here's how I figured out my way through the hardware CTF that PTP set as a pre-requisite for some interviews. I'm pretty new to hardware, so learned quite a bit along the way. We have now moved on to a new 'interview' CTF so,...

Information Disclosure

Apache gateway-spi is vulnerable to information disclosure. The vulnerability exists cookie header that is forwarded from knox-cilent to backend as Knox does not exclude the user-knox cookies in cilent outbounf requests by adding in REQUESTEXCLUDEHEADERS where an attacker can successfully trick a...

PT-2020-2427

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.4.17 Description The issue exists due to insufficient input validation in the drivers/spi/spi-dw.c component of the Linux kernel. This can be exploited by an attacker to cause a denial of service via concurrent...

The vulnerability of the fsl_lpspi_probe() function in the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the fsllpspiprobe function drivers/spi/spi-fsl-lpspi.c in the Linux kernel involves an uncontrolled consumption of resources. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...

Ubuntu 16.04 LTS / 18.04 LTS : Linux kernel vulnerabilities (USN-4210-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4210-1 advisory. It was discovered that a buffer overflow existed in the 802.11 Wi-Fi configuration interface for the Linux kernel when handling beacon...

USN-4208-1: Linux kernel vulnerabilities

Jann Horn discovered that the OverlayFS and ShiftFS Drivers in the Linux kernel did not properly handle reference counting during memory mapping operations when used in conjunction with AUFS. A local attacker could use this to cause a denial of service system crash or possibly execute arbitrary...