Mark Esler

The `OnCallNotificationActivity` is declared as exported in the `AndroidManifest.xml` without a permission guard. This allows a co-installed malicious application to launch the activity using attacker-controlled Intent extras: `on call page content`, which is rendered as full-screen lock-screen text; `page id`, used to enqueue an on-call Acknowledge worker; and `on call page intent`, a Parcelable Intent. When a user taps the Acknowledge button, the application sends a forged Acknowledge request to the backend using the victim's authenticated session for the specified `page id`. Additionally, the attacker-controlled Intent is launched from the Datadog process via `startActivity()`, enabling access to non-exported components of the application through a confused-deputy pattern. The activity also enables lock-screen display and wakes the device, which can be used for social engineering. This issue requires a malicious application to be co-installed on the device and an active Datadog session.

The application associates the user's Datadog UUID—a stable per-user identifier—with the device's Firebase installation ID on Google's backend by calling `FirebaseCrashlytics.setUserId` upon successful login. Uncaught exceptions are then forwarded to Firebase Crashlytics via the `recordException()` function, attaching stack traces and breadcrumbs to that same UUID. This process occurs without a visible consent gate or user-facing opt-out mechanism, making the UUID and crash data visible within Firebase Crashlytics.

The launcher activity `AppActivity` is declared as exported with `launchMode="singleTask"` and lacks a permission guard. The application invokes `Intent.getUserSession()` during `onCreate` and `onNewIntent`, which deserializes a `UserSession` containing user identity, OAuth access and refresh tokens, host, organization, datacenter, and permissions from Bundle extras under the `com.datadog.app.*` namespace. A co-installed malicious application can invoke the launcher with arbitrary session extras, allowing the attacker to inject a session and perform an automatic login under an attacker-chosen identity. The session preparer returns a Ready state without contacting the backend if the injected access token is not flagged as expired, meaning no server-side token introspection occurs before auto-login. This results in an account-confusion issue where the victim's application is switched to a session controlled by the attacker.

Two Room-backed SQLite databases store sensitive content in plaintext. The `LocalNotificationDatabase` contains notification titles, messages, recipients, services, tags, and on-call or incident deep links. The `SearchRecentDatabase` stores the user's full in-app search history. These databases are stored as cleartext files in `/data/data/com.datadog.app/databases/`. An actor capable of bypassing the application sandbox—such as through rooted devices, misconfigured `android:allowBackup` settings, physical device access, or forensic acquisition—can read this operationally sensitive information.

The `BubbleChatActivity` is exported without a permission guard and accepts a SEND intent with a `mimeType` of text/plain. The activity reads a `conversation id` from Intent extras and, upon the `onDestroy()` function call, triggers `BubbleChatNotification.dismiss()` if no active in-process session matches the provided `conversation id`. This process unconditionally cancels notification ID 9201, which corresponds to the hard-coded Bits AI chat notification, via `NotificationManager.cancel` without validating the caller's identity or ownership of the `conversation id`. Consequently, a co-installed application with zero permissions can launch `BubbleChatActivity` using a random `conversation id` to silently dismiss the Bits AI chat notification on the device. This issue does not result in data exposure as chat content is protected by server authentication.

Six App Widget configuration activities—IncidentWidgetActivity, MonitorSavedViewWidgetActivity, OnCallShiftsWidgetActivity, OnCallPagesWidgetActivity, SloWidgetActivity, and DashboardWidgetActivity—are exported without a permission guard. These activities use a caller-supplied `AppWidgetManager.EXTRA APPWIDGET ID` to load a stored session and automatically log in as the user when no deep-link destination is resolved. Since Android widget IDs are small sequential integers, a co-installed malicious application can brute-force this value to identify a widget configured on the victim's device. If a match is found, the activity opens in the foreground under the victim's session, rendering live infrastructure data. This creates a visual side channel where data can be exposed via screen recording, accessibility services, or screenshot capture, although the calling application cannot programmatically read the data.

Уязвимость таблиц предоставления прав Grant Table гипервизора Xen связана с ошибками синхронизации при использовании общего ресурса. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, раскрыть защищаемую информацию или вызвать отказ в обслуживании

Уязвимость таблиц предоставления прав Grant Table гипервизора Xen связана с ошибками синхронизации при использовании общего ресурса. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, раскрыть защищаемую информацию или вызвать отказ в обслуживании

The issue is related to the Modules::ScanDeps library, which does not properly sanitize input. This can allow an attacker to execute arbitrary shell commands. A local attacker could exploit this by passing unsanitized input to the library, potentially allowing them to run commands as root.

The issue is related to an uncontrolled search path element in the needrestart utility. Exploitation of this issue may allow an attacker to execute arbitrary code in the context of the root user by manipulating the `RUBYLIB` environment variable. This can be achieved by tricking needrestart into running the Ruby interpreter with an attacker-controlled `RUBYLIB` variable.

The needrestart utility, versions prior to 3.8, contains a flaw due to improper handling of the `PYTHONPATH` environment variable. This allows local attackers to execute arbitrary code with root privileges by manipulating the `PYTHONPATH` during Python interpreter initialization. The vulnerability stems from an uncontrolled search path element. A publicly available exploit exists for this issue. The vulnerability affects systems running Ubuntu and Debian.

The issue is related to a race condition that allows local attackers to execute arbitrary code as root by tricking needrestart into running a fake Python interpreter. This is achieved by winning a race condition and substituting the system's real Python interpreter with a malicious one. The initial security fix introduced a regression, which was subsequently resolved.

The issue is related to needrestart passing unsanitized data to a library, which expects safe input. This could allow a local attacker to execute arbitrary shell commands with root privileges.

A local attacker who can register user names could spoof another user's ID and gain their privileges due to insufficient randomization of user IDs. The issue arises from the `GenerateID` method, which assigns user IDs as a pure function of the user name, and the set of UIDs is too small for pseudo-random assignment to work. This allows an adversary to register multiple users with colliding IDs or register a single user whose ID collides with a target user's. The attacker can bypass the uniqueness check by engineering a situation where the system administrator purges `/var/cache`, targeting a system account whose UID is in `authd`'s range, or targeting an account that hasn't logged into a specific system in more than 6 months.

Name of the Vulnerable Software and Affected Versions: Authd PAM module versions prior to 0.3.5 Description: The issue is related to errors in privilege management, allowing a remote attacker to gain access to another user's account by executing commands such as `su`, `sudo`, or `ssh` and modifying their transactions. This can enable broker-managed users to impersonate any other user managed by the same broker and perform any PAM operation with it, including authenticating as them. Recommendations: For Authd PAM module versions prior to 0.3.5, update to version 0.3.5 or later to resolve the issue. As a temporary workaround, consider restricting the use of `su`, `sudo`, and `ssh` commands to minimize the risk of exploitation. Additionally, ensure that tools such as `su`, `sudo`, and `ssh` are updated to versions that include the necessary fixes, such as `su` version that will include https://github.com/util-linux/util-linux/pull/3206, `ssh` version that will include https://github.com/openssh/openssh-portable/pull/521, and `sudo` version that will include https://github.com/sudo-project/sudo/pull/412.

Name of the Vulnerable Software and Affected Versions: juju versions prior to 2.9.51 juju versions prior to 3.1.10 juju versions prior to 3.3.7 juju versions prior to 3.4.6 juju versions prior to 3.5.4 Description: The issue concerns an abstract UNIX domain socket used for juju introspection, which is available without authentication locally to network namespace users. This enables denial of service attacks. Specifically, on a juju controller agent, denial of service can be performed by using the "/leases/revoke" endpoint, which can cause availability issues. On a juju machine agent hosting units, disabling the unit component can be performed using the "/units" endpoint with a "stop" action. Recommendations: For versions prior to 2.9.51, update to version 2.9.51 or later. For versions prior to 3.1.10, update to version 3.1.10 or later. For versions prior to 3.3.7, update to version 3.3.7 or later. For versions prior to 3.4.6, update to version 3.4.6 or later. For versions prior to 3.5.4, update to version 3.5.4 or later. As a temporary workaround, consider restricting access to the "/leases/revoke" and "/units" endpoints to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: juju versions prior to 2.9.51 juju versions prior to 3.1.10 juju versions prior to 3.3.7 juju versions prior to 3.4.6 juju versions prior to 3.5.4 Description: The juju hook tool's abstract UNIX domain socket is vulnerable. When combined with an attack of `JUJU CONTEXT ID`, any user on the local system with access to the default network namespace may connect to the `/var/lib/juju/agents/unit-xxxx-yyyy/agent.socket` and perform actions that are normally reserved to a juju charm. Recommendations: For versions prior to 2.9.51, update to version 2.9.51 or later. For versions prior to 3.1.10, update to version 3.1.10 or later. For versions prior to 3.3.7, update to version 3.3.7 or later. For versions prior to 3.4.6, update to version 3.4.6 or later. For versions prior to 3.5.4, update to version 3.5.4 or later.

The `JUJU CONTEXT ID` is a predictable authentication secret. On a Juju machine or Juju charm container, an unprivileged user in the same network namespace can connect to an abstract domain socket and guess the `JUJU CONTEXT ID` value. This gives the unprivileged user access to the same information and tools as the Juju charm. The `JUJU CONTEXT ID` has components including the application name, unit number, current hook, and a uint63 decimal number. The random number generator used is not cryptographically secure, making it highly predictable. There is no rate limiting on the abstract domain socket, allowing an unprivileged user to try multiple connections.

An issue was discovered in Juju that resulted in the leak of the sensitive context ID, which allows a local unprivileged attacker to access other sensitive data or relation accessible to the local charm. A potential exploit where a user can run a bash loop attempting to execute hook tools. If running while another hook is executing, we log an error with the context ID, making it possible for the user to then use that ID in a following call successfully. This means an unprivileged user can access anything available via a hook tool such as config, relation data and secrets.

The issue is related to an uncontrolled search path element in wpa supplicant, allowing a local unprivileged attacker to escalate privileges to the user that wpa supplicant runs as, usually root. Membership in the netdev group or access to the dbus interface of wpa supplicant allows an unprivileged user to specify an arbitrary path to a module to be loaded by the wpa supplicant process. The estimated number of potentially affected devices is in the millions.