Andy Nguyen

A sequence of processor instructions can lead to unexpected behavior in some Intel processors, potentially allowing an authenticated user to enable escalation of privilege, information disclosure, or denial of service via local access. This issue is related to the interpretation of redundant prefixes and can cause the system to crash or become unresponsive. The vulnerability, termed Reptar, primarily affects multi-tenant virtualized environments where multiple virtual machines are run on the same host.

The issue is related to insufficient input validation in the Core component of Oracle VM VirtualBox, allowing a high-privileged attacker with logon access to the infrastructure to compromise Oracle VM VirtualBox. Successful attacks can result in the takeover of Oracle VM VirtualBox and may significantly impact additional products due to scope change.

The issue is related to insufficient input validation in the Core component of Oracle VM VirtualBox, allowing a high-privileged attacker with logon to the infrastructure to compromise Oracle VM VirtualBox. Successful attacks can result in the takeover of Oracle VM VirtualBox and may significantly impact additional products. The vulnerability is easily exploitable and can lead to confidentiality, integrity, and availability impacts.

The issue is related to insufficient input validation in the Core component of Oracle VM VirtualBox, allowing a high-privileged attacker with logon to the infrastructure to compromise Oracle VM VirtualBox. Successful attacks can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data and the ability to cause a hang or frequently repeatable crash of Oracle VM VirtualBox. This may significantly impact additional products due to scope change.

A critical issue affects the `exFAT Handler` component, specifically the `UVFAT readupcasetable` function. The manipulation of the `dataLength` argument leads to a heap-based buffer overflow. This issue can be exploited by launching an attack on the physical device.

A heap out-of-bounds memory write exists in the `build open gop key points()` function due to an integer overflow. This occurs when the size calculation adds `sc->ctts data[i].count` to `sc->sample offsets count`, potentially resulting in a small allocation with `av calloc()`. An attacker can cause remote code execution via a malicious mp4 file.

A kernel data leak issue has been identified in the Linux kernel, specifically in the KVM: SVM component. The issue arises when using certain sev ioctl interfaces, where the length parameter passed may be less than or equal to SEV FW BLOB MAX SIZE but larger than the data returned by PSP firmware. As a result, kmalloc allocates memory based on the input size rather than the data size, and since PSP firmware does not fully overwrite the allocated buffer, these sev ioctl interfaces may return uninitialized kernel slab memory.

The issue is related to a heap out-of-bounds write in the netfilter subsystem of the Linux kernel, specifically in the net/netfilter/x tables.c file. This allows an attacker to gain privileges or cause a denial of service through user name space by exploiting the vulnerability in the xt compat target from user() function. The vulnerability can be exploited by calling compat setsockopt() with IPT SO SET REPLACE or IP6T SO SET REPLACE values set. A proof of concept exploit has been developed, which can bypass security mechanisms such as KASLR, SMAP, and SMEP, and achieve kernel code execution. The researcher who discovered the vulnerability received a $20,000 reward from Google for identifying a method to bypass container isolation in a Kubernetes cluster.

The issue involves multiple memory corruption problems that have been resolved through improved state management. A malicious application may be able to execute arbitrary code with system privileges.

Name of the Vulnerable Software and Affected Versions: BlueZ (affected versions not specified) Linux kernel (affected versions not specified) Description: The issue is related to improper access control in BlueZ and a vulnerability in the Linux kernel's net/bluetooth/a2mp.c component, which lacks protection of service data. This could allow an unauthenticated user or a remote attacker to potentially enable information disclosure via adjacent access or by using specially crafted AMP packets. Recommendations: For BlueZ, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Linux kernel, consider restricting access to the net/bluetooth/a2mp.c component to minimize the risk of exploitation until a patch is available.

Name of the Vulnerable Software and Affected Versions: BlueZ (affected versions not specified) Description: The issue is related to improper input validation in BlueZ, which may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access. This vulnerability can be exploited by sending specially crafted Bluetooth packets, potentially allowing a remote attacker to execute arbitrary code with Linux kernel privileges. The vulnerability is also known as BleedingTooth. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to the use of uninitialized memory in the TIFFReadRGBAImageOriented function of the Evince document viewer. This can be exploited by a remote attacker to gain unauthorized access to information. The tiff document render() and tiff document get thumbnail() functions in the TIFF document backend did not handle errors from TIFFReadRGBAImageOriented(), leading to uninitialized memory use when processing certain TIFF image files.