Synacktiv

توجد حالة تنافس في استدعاء النظام `execve()` أثناء تنفيذ ملف ثنائي SUID. يقوم النواة بتثبيت مساحة العناوين الافتراضية الجديدة قبل تحديث بيانات اعتماد العملية. يؤدي هذا إلى ظهور نافذة يمكن من خلالها لعملية تعمل تحت حساب المستخدم نفسه الوصول إلى ذاكرة العملية المستهدفة عبر procfs أو linprocfs، حيث لا يزال فحص أذونات تصحيح أخطاء النواة يستخدم بيانات الاعتماد الأصلية. يمكن لمستخدم محلي غير متمتع بامتيازات استغلال خطأ التزامن هذا لتعديل مساحة عناوين ملف ثنائي SUID قبل رفع مستوى بيانات اعتماده، مما قد يتيح له الحصول على السيطرة الكاملة على النظام.

قام مُنشِّط صورة ELF بمسح علامات تفضيل ASLR (توزيع عشوائي لمساحة العناوين، وهي تقنية أمنية تعمل على توزيع عناوين الذاكرة بشكل عشوائي لمنع الاستغلال) لكل عملية على حدة بالنسبة للملفات الثنائية setuid بعد حساب العنوان الأساسي لـ PIE (ملف قابل للتنفيذ مستقل عن الموضع). سمح هذا التسلسل لبطلان ASLR الذي طلبه المستخدم بالبقاء نشطًا أثناء اختيار العنوان الأساسي. يمكن لمستخدم محلي غير متمتع بامتيازات تعطيل ASLR لملف ثنائي PIE ذي setuid عن طريق استدعاء الدالة `procctl(2)` قبل `execve(2)`، مما يسهل استغلال مشكلات تلف الذاكرة الأخرى داخل ذلك الملف الثنائي.

تتعلق المشكلة بتجاوز سعة عدد صحيح في بروتوكول SDP الخاص بتقنية البلوتوث، مما قد يؤدي إلى تنفيذ تعليمات برمجية عن بُعد. وقد تم إثبات ذلك في مسابقة Pwn2Own.

تتعلق المشكلة بثغرة أمنية تسمح بتجاوز المصادقة بسبب العزل غير الكافي في وظيفة البلوتوث. اكتشفها ميخائيل إيفدوكيموف من شركة PCAutomotive.

اسم البرنامج المعرض للخطر والإصدارات المتأثرة: إصدارات FCGI من 0.44 إلى 0.82 الوصف: تتأثر مكتبة FastCGI المضمنة في FCGI، مما يتسبب في حدوث تجاوز سعة عدد صحيح وما يترتب على ذلك من تجاوز سعة المخزن المؤقت القائم على الـ«هيوب» (heap) عبر قيم `nameLen` أو `valueLen` مُعدَّلة خصيصًا في البيانات المرسلة إلى مقبس IPC. ويحدث هذا في الدالة `ReadParams` في ملف `fcgiapp.c`. التوصيات: بالنسبة لإصدارات FCGI من 0.44 إلى 0.82، يُنصح بتعطيل الدالة `ReadParams` في ملف `fcgiapp.c` كحل مؤقت حتى يتوفر تصحيح. قم بتقييد الوصول إلى مقبس IPC لتقليل مخاطر الاستغلال. تجنب استخدام قيم `nameLen` أو `valueLen` مُعدلة في البيانات المرسلة إلى مقبس IPC حتى يتم حل المشكلة.

The virtio vq recordon function is subject to a time-of-check to time-of-use (TOCTOU) race condition.

A guest can trigger an infinite loop in the hda audio driver.

The issue concerns a buffer over-read in the hda driver, which is triggered by a guest-controlled value. This allows for potential exploitation. No information is provided about the estimated number of affected devices or real-world incidents.

The NVMe driver queue processing is vulnerable to guest-induced infinite loops.

The issue allows the caller to specify an arbitrary size using the `ctl persistent reserve out` command, which will be passed to the kernel's memory allocator. This could potentially lead to unbounded allocation in the ctl(4) CAM Target Layer. There is a mention of potential exploitation over unauthenticated iSCSI connections, but no further details are provided.

The NVMe driver function nvme opc get log page is vulnerable to a buffer over-read from a guest-controlled value. This issue is related to the bhyve hypervisor and affects the NVMe driver.

The issue is related to an insufficient boundary validation in the USB code, which could lead to an out-of-bounds read on the heap, potentially resulting in an arbitrary write and remote code execution. This vulnerability affects the bhyve hypervisor's XHCI emulation functionality. The process bhyve typically runs with root privileges, increasing the potential impact. Although bhyve operates in an isolated environment using Capsicum, which limits available capabilities, the risk of exploitation remains. All supported versions of FreeBSD are affected, with systems using XHCI emulation being particularly vulnerable.

A missing null-termination character in the last element of an nvlist array string can lead to writing outside the allocated buffer.

Name of the Vulnerable Software and Affected Versions: libnv (affected versions not specified) Description: The issue is related to an integer overflow in the libnv library, which can occur due to a malicious value of size in a structure of packed libnv. This overflow leads to the allocation of a smaller buffer than required for the parsed data. The exploitation of this issue may allow a remote attacker to elevate their privileges or cause a denial of service. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The function `ctl write buffer` incorrectly set a flag, resulting in a kernel Use-After-Free when a command finished processing. Malicious software running in a guest VM that exposes virtio scsi can exploit this issue to achieve code execution on the host in the bhyve userspace process, which typically runs as root. Note that bhyve runs in a Capsicum sandbox, so malicious code is constrained by the capabilities available to the bhyve process. A malicious iSCSI initiator could achieve remote code execution on the iSCSI target host.

The issue is related to the `ctl request sense()` function in the ctl subsystem of FreeBSD operating systems, which can lead to a buffer overflow in memory. This can allow an attacker to execute arbitrary code. Malicious software running in a guest VM that exposes `virtio scsi` can exploit this to achieve code execution on the host in the `bhyve` userspace process, typically running as root. Note that `bhyve` runs in a Capsicum sandbox, constraining malicious code to the capabilities available to the `bhyve` process. A malicious iSCSI initiator could also achieve remote code execution on the iSCSI target host.

The issue is related to the `ctl write buffer` and `ctl read buffer` functions, which allocated memory to be returned to userspace without initializing it. This can be exploited by malicious software running in a guest VM that exposes virtio scsi to achieve code execution on the host in the bhyve userspace process, which typically runs as root. Note that bhyve runs in a Capsicum sandbox, so malicious code is constrained by the capabilities available to the bhyve process. A malicious iSCSI initiator could achieve remote code execution on the iSCSI target host.

The issue is related to the `ctl report supported opcodes` function, which did not sufficiently validate a field provided by userspace, allowing an arbitrary write to a limited amount of kernel help memory. This could be exploited by malicious software running in a guest VM that exposes `virtio scsi` to achieve code execution on the host in the `bhyve` userspace process, which typically runs as root. Note that `bhyve` runs in a Capsicum sandbox, so malicious code is constrained by the capabilities available to the `bhyve` process. A malicious iSCSI initiator could achieve remote code execution on the iSCSI target host.

Malicious software running in a guest VM can exploit a buffer overflow to achieve code execution on the host in the bhyve userspace process, which typically runs as root. The bhyve process runs in a Capsicum sandbox, constraining malicious code to the capabilities available to the bhyve process.

The issue is related to a use-after-free vulnerability in the UMTX OP SHM operation's handling of anonymous shared memory used for process-shared mutexes. Concurrent removals of certain anonymous shared memory mappings by using the UMTX SHM DESTROY sub-request of UMTX OP SHM can lead to decreasing the reference count of the object representing the mapping too many times, causing it to be freed too early. A malicious code exercising the UMTX SHM DESTROY sub-request in parallel can panic the kernel or enable further use-after-free attacks, potentially including code execution or Capsicum sandbox escape.