Gwangun Jung

**Name of the Vulnerable Software and Affected Versions** Windows Cloud Files Mini Filter Driver (affected versions not specified) **Description** An elevation of privilege issue exists in the Windows Cloud Files Mini Filter Driver `cldflt.sys`. The flaw is a heap-based buffer overflow that can be triggered by crafting a custom reparse point to corrupt an adjacent ` WNF STATE DATA` object. This corruption can be leveraged to leak kernel pointers from an ALPC handle table object. Further exploitation involves a second buffer overflow to corrupt another ` WNF STATE DATA` object and a subsequent PipeAttribute object. By forging a PipeAttribute object in userspace, an attacker can leak the token address and override privileges to escalate a regular user account to NT AUTHORITYSYSTEM. Technical exploitation strategies include the use of WNF Out-of-Bounds (OOB), ALPC, I/O Ring mechanisms, and flipping the ` KTHREAD.PreviousMode` variable. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** VMware Workstation and Fusion (affected versions not specified) **Description** The issue is related to an information disclosure vulnerability in the Host Guest File Sharing (HGFS) functionality. A malicious actor with local administrative privileges on a virtual machine may be able to read privileged information contained in hypervisor memory from a virtual machine. This is due to insufficient access control in the HGFS functionality. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** VMware Workstation versions prior to 17.5 VMware Fusion versions prior to 13.5 **Description** An out-of-bounds read issue exists in the functionality used to share host Bluetooth devices with a virtual machine. A malicious actor with local administrative privileges on a virtual machine can exploit this to read privileged information stored in the hypervisor memory. **Recommendations** Update VMware Workstation to version 17.5 or later. Update VMware Fusion to version 13.5 or later.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 6.2.13 **Description** The issue is related to the `qfq change class` function in the Linux kernel, which allows an out-of-bounds write because `lmax` can exceed `QFQ MIN LMAX`. This can potentially impact the confidentiality, integrity, and availability of protected information. The vulnerability may be exploited to gain local privilege escalation. **Recommendations** For Linux kernel versions prior to 6.2.13, update to version 6.2.13 or later to resolve the issue. As a temporary workaround, consider restricting access to the `qfq change class` function in the `net/sched/sch qfq.c` file until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Linux Kernel (affected versions not specified) **Description** A problematic issue has been found in the Linux Kernel, affecting the `fib nh match` function of the `net/ipv4/fib semantics.c` file in the IPv4 Handler component. This issue leads to an out-of-bounds read. The attack can be initiated remotely, potentially allowing an attacker to cause a denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 6.0-rc7 **Description** A slab-out-of-bounds access was reported in the `fib nh match` function. The issue occurs when attempting to delete a multipath route while the `fib info` contains an `nh` reference. Separate nexthop objects are mutually exclusive with the legacy multipath spec. The `fib nh match` function has been fixed to return if the config for the to-be-deleted route contains a multipath spec while the `fib info` is using a nexthop object. **Recommendations** For Linux kernel versions prior to 6.0-rc7, update to a version that includes the fix for the `fib nh match` function to prevent slab-out-of-bounds access. As a temporary workaround, consider restricting the use of multipath routes with nexthop objects to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Linux Kernel version 6.0-rc2 **Description** The issue is related to the use of memory after it has been freed, specifically within the `nft osf eval` function. This can allow an attacker to disclose sensitive information on affected installations. To exploit this, an attacker must first obtain the ability to execute high-privileged code on the target system. The problem stems from the lack of proper initialization of memory prior to accessing it, which can be leveraged in conjunction with other vulnerabilities to execute arbitrary code in the context of the kernel. **Recommendations** For Linux Kernel version 6.0-rc2, consider disabling the `nft osf eval` function as a temporary workaround until a patch is available. Restrict access to sensitive information and ensure that only authorized personnel have high-privileged access to the system. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 5.19.6 **Description** An issue in the Linux kernel's net/netfilter/nf tables api.c component can cause a denial of service when binding to an already bound chain. The vulnerability is related to errors in resource release, which can be exploited to cause a denial of service. **Recommendations** For Linux kernel versions prior to 5.19.6, update to version 5.19.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the `nf tables api.c` component to minimize the risk of exploitation.