Siemens SIMATIC Devices Linux Kernel Use of Uninitialized Variable (CVE-2022-42432)

This vulnerability allows local attackers to disclose sensitive information on affected installations of the Linux Kernel 6.0-rc2. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within...

Siemens SIMATIC S7-1500 TM MFP BIOS Improper Input Validation (CVE-2021-42375)

An incorrect handling of a special element in Busybox's ash applet leads to denial of service when processing a crafted shell command, due to the shell mistaking specific characters for reserved characters. This may be used for DoS under rare conditions of filtered command input. This plugin only...

Siemens SIMATIC S7-1500 TM MFP BIOS Improper Restriction of Operations within the Bounds of a Memory Buffer (CVE-2022-3435)

A vulnerability classified as problematic has been found in Linux Kernel. This affects the function fibnhmatch of the file net/ipv4/fibsemantics.c of the component IPv4 Handler. The manipulation leads to out-of-bounds read. It is possible to initiate the attack remotely. It is recommended to appl...

Siemens SIMATIC S7-1500 TM MFP BIOS NULL Pointer Dereference (CVE-2021-42376)

A NULL pointer dereference in Busybox's hush applet leads to denial of service when processing a crafted shell command, due to missing validation after a \x03 delimiter character. This may be used for DoS under very rare conditions of filtered command input. This plugin only works with Tenable.ot...

Siemens SIMATIC S7-1500 TM MFP BIOS Use After Free (CVE-2020-1752)

A use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde expansion was carried out. Directory paths containing an initial tilde followed by a valid username were affected by this issue. A local attacker could exploit this flaw by creating a specially...

Siemens SIMATIC and SCALANCE Devices Linux Kernel Access of Resource Using Incompatible Type ('Type Confusion') (CVE-2022-34918)

An issue was discovered in the Linux kernel through 5.18.9. A type confusion bug in nftseteleminit leading to a buffer overflow could be used by a local attacker to escalate privileges, a different vulnerability than CVE-2022-32250. The attacker can obtain root access, but must start with an...

Siemens SIMATIC Devices Linux Kernel Incorrect Authorization (CVE-2022-20572)

In veritytarget of dm-verity-target.c, there is a possible way to modify read-only files due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android...

Siemens SIMATIC S7-1500 TM MFP BIOS Integer Overflow or Wraparound (CVE-2021-35942)

The wordexp function in the GNU C Library aka glibc through 2.33 may crash or read arbitrary memory in parseparam in posix/wordexp.c when called with an untrusted, crafted pattern, potentially resulting in a denial of service or disclosure of information. This occurs because atoi was used but...

Siemens SIMATIC Devices Linux Kernel Use After Free (CVE-2022-3534)

A vulnerability classified as critical has been found in Linux Kernel. Affected is the function btfdumpnamedups of the file tools/lib/bpf/btfdump.c of the component libbpf. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier of this...

Siemens SIMATIC, SCALANCE and RUGGEDCOM Devices Linux Kernel Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CVE-2022-1292)

The crehash script does not properly sanitise shell metacharacters to prevent command injection. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description...

Siemens SIMATIC, SCALANCE and RUGGEDCOM Devices Linux Kernel Observable Discrepancy (CVE-2022-32296)

The Linux kernel before 5.17.9 allows TCP servers to identify clients by observing what source ports are used. This occurs because of use of Algorithm 4 Double-Hash Port Selection Algorithm of RFC 6056. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-...

Siemens SIMATIC Devices Linux Kernel Exposure of Resource to Wrong Sphere (CVE-2022-40768)

drivers/scsi/stex.c in the Linux kernel through 5.19.9 allows local users to obtain sensitive information from kernel memory because stexqueuecommandlck lacks a memset for the PASSTHRUCMD case. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for mo...

Siemens SIMATIC Devices Linux Kernel Out-of-bounds Read (CVE-2023-26607)

In the Linux kernel 6.0.8, there is an out-of-bounds read in ntfsattrfind in fs/ntfs/attrib.c. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description...

Siemens SIMATIC S7-1500 TM MFP BIOS Improper Handling of Exceptional Conditions (CVE-2021-28831)

decompressgunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huftbuild result pointer, with a resultant invalid free or segmentation fault, via malformed gzip data. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more informatio...

Siemens SIMATIC S7-1500 TM MFP BIOS Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (CVE-2022-23218)

The deprecated compatibility function svcunixcreate in the sunrpc module of the GNU C Library aka glibc through 2.34 copies its path argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or if an application is not...

Siemens SIMATIC Devices Linux Kernel Use After Free (CVE-2022-41222)

mm/mremap.c in the Linux kernel before 5.13.3 has a use-after-free via a stale TLB because an rmap lock is not held during a PUD move. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc...

Siemens SIMATIC Devices Linux Kernel Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') (CVE-2022-41849)

drivers/video/fbdev/smscufx.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free if a physically proximate attacker removes a USB device while calling open, aka a race condition between ufxopsopen and ufxusbdisconnect. This plugin only works with Tenable.ot...

Siemens SIMATIC Devices Linux Kernel Out-of-bounds Read (CVE-2022-47520)

An issue was discovered in the Linux kernel before 6.0.11. Missing offset validation in drivers/net/wireless/microchip/wilc1000/hif.c in the WILC1000 wireless driver can trigger an out-of-bounds read when parsing a Robust Security Network RSN information element from a Netlink packet. This plugin...

Siemens SIMATIC Devices Linux Kernel Use After Free (CVE-2022-42719)

A use-after-free in the mac80211 stack when parsing a multi-BSSID element in the Linux kernel 5.2 through 5.19.x before 5.19.16 could be used by attackers able to inject WLAN frames to crash the kernel and potentially execute code. This plugin only works with Tenable.ot. Please visit...

Siemens SIMATIC S7-1500 TM MFP BIOS Off-by-one Error (CVE-2021-3999)

A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd may lead to memory corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and size passed to getcwd in a setuid program could use this flaw to potentially execute...