Maxime Villard

O problema está relacionado à filtragem incompleta de elementos especiais no software do módulo Intel(R) TDX, o que pode permitir que um usuário autenticado potencialmente consiga escalar privilégios por meio de acesso local.

The issue is related to improper input validation in the Intel(R) TDX module software, which may allow a privileged user to potentially enable escalation of privilege via local access. This could lead to a potential system compromise.

The issue is related to improper input validation in some Intel TDX module software, which may allow a privileged user to potentially enable escalation of privilege via local access. This could permit an attacker to increase their privileges.

Um problema de negação de serviço foi resolvido com o aprimoramento do gerenciamento de memória. Um invasor em posição privilegiada pode ser capaz de realizar um ataque de negação de serviço.

O problema diz respeito à aceitação inesperada de pacotes IPv4 com roteamento de origem, que estavam desativados por padrão.

Um problema de “use after free” foi corrigido com um gerenciamento de memória aprimorado. Um invasor remoto pode conseguir provocar a execução de código arbitrário.

Um problema de desreferência de ponteiro nulo foi corrigido por meio de uma validação de entrada aprimorada. Esse problema permite que um invasor remoto possa, potencialmente, causar a execução de código arbitrário.

O problema está relacionado à validação incompleta de dados de pacotes, o que pode resultar no acesso à memória fora dos limites. Isso pode levar a um kernel panic ou a outros resultados imprevisíveis.

O problema é causado por uma validação incompleta dos dados dos pacotes, o que pode resultar em acesso à memória após ela ter sido liberada. Isso pode levar a um kernel panic ou a outros resultados imprevisíveis.

Name of the Vulnerable Software and Affected Versions: FreeBSD versions prior to 11.1-STABLE FreeBSD versions prior to 11.1-RELEASE-p9 FreeBSD versions prior to 10.4-STABLE FreeBSD versions prior to 10.4-RELEASE-p8 FreeBSD versions prior to 10.3-RELEASE-p28 Description: The issue is related to the length field of the ipsec option header, which does not count the size of the option header itself. This can cause an infinite loop when the length is zero, allowing a remote attacker to crash the machine by sending an arbitrary packet. The vulnerability can be exploited by a remote attacker to cause a denial of service. Recommendations: For versions prior to 11.1-STABLE, update to 11.1-STABLE or later. For versions prior to 11.1-RELEASE-p9, update to 11.1-RELEASE-p9 or later. For versions prior to 10.4-STABLE, update to 10.4-STABLE or later. For versions prior to 10.4-RELEASE-p8, update to 10.4-RELEASE-p8 or later. For versions prior to 10.3-RELEASE-p28, update to 10.3-RELEASE-p28 or later.

Name of the Vulnerable Software and Affected Versions: FreeBSD versions prior to 11.1-STABLE FreeBSD versions prior to 11.1-RELEASE-p7 FreeBSD versions prior to 10.4-STABLE FreeBSD versions prior to 10.4-RELEASE-p7 FreeBSD versions prior to 10.3-RELEASE-p28 Description: The issue is related to the kernel's improper validation of IPsec packets from a trusted host and a use-after-free vulnerability in the IPsec AH handling code. This could lead to a system crash or other unpredictable results. The vulnerability may also allow a remote attacker to execute arbitrary code. Recommendations: For versions prior to 11.1-STABLE, update to 11.1-STABLE or later. For versions prior to 11.1-RELEASE-p7, update to 11.1-RELEASE-p7 or later. For versions prior to 10.4-STABLE, update to 10.4-STABLE or later. For versions prior to 10.4-RELEASE-p7, update to 10.4-RELEASE-p7 or later. For versions prior to 10.3-RELEASE-p28, update to 10.3-RELEASE-p28 or later.

An out-of-bounds read issue was discovered, involving the `Kernel` component. This issue allows local users to bypass intended memory-read restrictions.

The issue is caused by a buffer overflow in the memory, allowing remote attackers to cause a denial of service or possibly have other impacts, such as memory corruption, via a crafted mach binary. This can be achieved by exploiting the "Kernel" component.

The issue is caused by a buffer overflow in the operating system's kernel. It may allow a local attacker to elevate privileges or cause a denial of service.

The issue is related to the NetworkExtension component in the kernel, which does not properly initialize a data structure, allowing attackers to obtain sensitive memory-layout information via a crafted app. This can enable a remote attacker to access protected information stored in memory using a specially formed application.

The issue is caused by a buffer overflow in the operating system's kernel. It may allow a local attacker to elevate their privileges or cause a denial of service.

The issue is related to errors in the code of the operating system, specifically in how HFS volumes are mounted. This can be exploited by a local attacker to cause a denial of service by mounting a crafted HFS volume.

The issue allows attackers to cause a denial of service or obtain sensitive memory-content information via a crafted app. This is due to out-of-bounds memory access in the kernel.