Microsvuln

A malicious USB MTP/PTP device can cause the USBX host to read past a heap buffer during ordinary object enumeration, leaking adjacent heap contents to the application or faulting on an unmapped page.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** A flaw exists in the ` nx icmpv6 validate options()` function where it fails to examine a one- or two-byte residue at the end of an option area. This allows subsequent processing functions to re-walk the area and encounter attacker-controlled bytes, leading to three potential outcomes: 1. If a zero length byte is present, the handlers ` nx icmpv6 process ra()`, ` nx icmpv6 process ns()`, ` nx icmpv6 process na()`, and ` nx icmpv6 process redirect()` enter an infinite loop. Since this occurs in the high-priority IP thread without yielding, the system hangs until a watchdog reset occurs. 2. If a non-zero length byte is present on a short residue, unsigned counters may underflow, causing the process to read past the packet buffer until a fault occurs or a zero length byte is encountered. 3. If a one-byte residue exists, the walker over-reads one byte when reading a two-byte option header. Additionally, during a runaway walk, bytes interpreted as a link-layer address option may be copied into the neighbor cache and used as a destination MAC, potentially leaking off-packet memory onto the link. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MCUmgr (affected versions not specified) **Description** An integer underflow exists in the SMP-over-console transport when processing base64 frames. The function `mcumgr serial process frag()` in `subsys/mgmt/mcumgr/transport/src/serial util.c` unconditionally subtracts 2 from the buffer length to strip the CRC. Because `mcumgr serial extract len()` allows a declared length of 0 or 1, the `net buf::len` variable (a `uint16 t`) underflows, causing the system to treat a small buffer as having approximately 65 KB of payload. This can be triggered by an unauthenticated 7-byte line sent to the management console via transports using `CONFIG MCUMGR TRANSPORT UART` or `CONFIG MCUMGR TRANSPORT SHELL`. The underflow allows `smp process request packet()` in `subsys/mgmt/mcumgr/smp/src/smp.c` to bypass boundary checks. By staging specific buffer contents, an attacker can cause `net buf pull()` to move the parse cursor out of bounds, leading to an out-of-bounds read. This may result in a denial of service by faulting the MCUmgr thread or lead to memory disclosure via the `CONFIG MCUMGR GRP OS ECHO` handler. **Recommendations** Update the software to a version where `mcumgr serial extract len()` rejects declared packet lengths of two bytes or fewer. As a temporary mitigation, restrict write access to the management console, such as the USB CDC-ACM port or UART header.

**اسم البرنامج المعرض للخطر والإصدارات المتأثرة** إصدارات Squid حتى الإصدار 7.1 **الوصف** يقوم ذاكرة التخزين المؤقتة للوكيل الويب Squid بمعالجة ترميز ASN.1 لـ OIDs SNMP الطويلة بشكل غير صحيح. تكمن هذه المشكلة في الدالة `asn build objid` الموجودة في الملف `lib/snmplib/asn1.c`. تؤدي هذه المشكلة إلى حدوث تجاوز سعة المخزن المؤقت في المكدس أثناء معالجة رسائل SNMP. **التوصيات** قم بالتحديث إلى إصدار أحدث من 7.1.