Gatekeeper’s Achilles heel: Unearthing a macOS vulnerability

On July 27, 2022, Microsoft discovered a vulnerability in macOS that can allow attackers to bypass application execution restrictions imposed by Apple’s Gatekeeper security mechanism, designed to ensure only trusted apps run on Mac devices. We developed a proof-of-concept exploit to demonstrate t...

GSD-2022-1006204 smb3: check xattr value length earlier

smb3: check xattr value length earlier This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.291 by commit...

GSD-2022-1006121 ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h

ext4: add EXT4INODEHASXATTRSPACE macro in xattr.h This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.256 by commit...

GSD-2022-1006091 smb3: check xattr value length earlier

smb3: check xattr value length earlier This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.256 by commit...

GSD-2022-1005949 smb3: check xattr value length earlier

smb3: check xattr value length earlier This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.211 by commit...

GSD-2022-1005753 smb3: check xattr value length earlier

smb3: check xattr value length earlier This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.138 by commit...

GSD-2022-1005548 ext4: fix race when reusing xattr blocks

ext4: fix race when reusing xattr blocks This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.61 by commit...

PT-2022-34207 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.4.211 Description: The issue is related to the smb3 protocol, where the check for xattr value length is performed earlier. The actual impact and attack plausibility have not yet been proven. Recommendations:...

PT-2022-34567 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v4.9.326 Description: A use-after-free issue was discovered in the ext4 xattr set entry function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions...

PT-2022-34485 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v4.14.291 Description: A use-after-free issue was discovered in the ext4 xattr set entry function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions...

GSD-2022-1005464 smb3: check xattr value length earlier

smb3: check xattr value length earlier This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.63 by commit...

GSD-2022-1005185 ext4: fix race when reusing xattr blocks

ext4: fix race when reusing xattr blocks This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.19.2 by commit...

GSD-2022-1005178 ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h

ext4: add EXT4INODEHASXATTRSPACE macro in xattr.h This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.19.2 by commit...

GSD-2022-1005067 smb3: check xattr value length earlier

smb3: check xattr value length earlier This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.19.4 by commit 6a77b03098b1491cbaf23aba3f7e5c981755aef...

PT-2022-33325 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.19.4 Description: The issue is related to the smb3 protocol, where the check for xattr value length is performed earlier. The actual impact and attack plausibility have not yet been proven. Recommendations: F...

CVE-2018-5764, CVE-2017-16548 and CVE-2017-1734. Vulnerabilities in rsynd

Security Advisory ID : BSA-2022-2074 Component : rsyncd Revision : 1.0 CVE-2018-5764: The parsearguments function in options.c in rsyncd in rsync before 3.1.3 does not prevent multiple --protect-args uses, which allows remote attackers to bypass an argument-sanitization protection mechanism. Base...

EulerOS Virtualization 2.10.1 : samba (EulerOS-SA-2022-2066)

According to the versions of the samba packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - All versions of Samba prior to 4.13.16 are vulnerable to a malicious client using an SMB1 or NFS race to allow a directory to be...

GSD-2021-1002813 f2fs: fix to do sanity check on last xattr entry in __f2fs_setxattr()

f2fs: fix to do sanity check on last xattr entry in f2fssetxattr This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.89 by commit...

GSD-2021-1002800 f2fs: fix to do sanity check on last xattr entry in __f2fs_setxattr()

f2fs: fix to do sanity check on last xattr entry in f2fssetxattr This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.169 by commit...

GSD-2021-1002788 f2fs: fix to do sanity check on last xattr entry in __f2fs_setxattr()

f2fs: fix to do sanity check on last xattr entry in f2fssetxattr This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.223 by commit...