Mathias Payer

**Name of the Vulnerable Software and Affected Versions** mruby versions prior to 2.1.2-rc **Description** The issue is a heap-based buffer overflow in the `mrb yield with class` function, located in vm.c, due to incorrect VM stack handling. This can be triggered via the `stack copy` function. **Recommendations** For versions prior to 2.1.2-rc, update to version 2.1.2-rc or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions through 5.2.9 **Description** The issue is related to a Double Free error in the Linux kernel, specifically in the drivers/net/wireless/rsi/rsi 91x usb.c file. This error can be triggered by crafted USB device traffic, which may be remote via usbip or usbredir, potentially allowing a remote attacker to impact the confidentiality, integrity, and availability of protected information. **Recommendations** For Linux kernel versions through 5.2.9, update to a version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions through 5.2.9 **Description** The issue is related to the `check input term` function in the `sound/usb/mixer.c` file of the Linux kernel, which mishandles recursion. This leads to kernel stack exhaustion. **Recommendations** For Linux kernel versions through 5.2.9, update to a version newer than 5.2.9 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions through 5.2.9 **Description** The issue is related to the `parse audio mixer unit` function in the `sound/usb/mixer.c` file of the Linux kernel, which mishandles a short descriptor, leading to out-of-bounds memory access. This can potentially allow an attacker to access confidential information or cause a denial of service. **Recommendations** For Linux kernel versions through 5.2.9, update to a version newer than 5.2.9 to resolve the issue. At the moment, there is no information about other specific mitigation measures for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** TRENDnet TEW-632BRP version 1.010B32 TRENDnet TEW-673GRU (affected versions not specified) **Description** The issue is related to a buffer overflow in the apply.cgi file, which can be exploited by crafting a POST request payload with authentication. This allows attackers to hijack the control flow to any location specified by the attacker. **Recommendations** For TRENDnet TEW-632BRP version 1.010B32, consider restricting access to the apply.cgi file until a patch is available. For TRENDnet TEW-673GRU, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** TRENDnet TV-IP110WN versions 1.2.2 build 64 through 1.2.2 build 68 TRENDnet TV-IP110WN version 1.2.2.65 TRENDnet TV-IP121WN version 1.2.2 build 28 **Description** The issue allows attackers to hijack the control flow to any attacker-specified location by crafting a POST request payload without authentication. This is due to a buffer overflow in the video.cgi component. **Recommendations** For TRENDnet TV-IP110WN versions 1.2.2 build 64 through 1.2.2 build 68, consider restricting access to the video.cgi component until a patch is available. For TRENDnet TV-IP110WN version 1.2.2.65, consider restricting access to the video.cgi component until a patch is available. For TRENDnet TV-IP121WN version 1.2.2 build 28, consider restricting access to the video.cgi component until a patch is available. As a temporary workaround, avoid using the video.cgi component in the affected devices until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** TRENDnet TV-IP110WN versions 1.2.2 build 64 through 1.2.2 build 68 TRENDnet TV-IP110WN version 1.2.2.65 TRENDnet TV-IP121WN version 1.2.2 build 28 **Description** The issue allows attackers to hijack the control flow to any attacker-specified location by crafting a POST request payload without authentication. This is due to a buffer overflow in the network.cgi. **Recommendations** For TRENDnet TV-IP110WN versions 1.2.2 build 64 through 1.2.2 build 68, consider restricting access to the network.cgi until a patch is available. For TRENDnet TV-IP110WN version 1.2.2.65, consider restricting access to the network.cgi until a patch is available. For TRENDnet TV-IP121WN version 1.2.2 build 28, consider restricting access to the network.cgi until a patch is available.

**Name of the Vulnerable Software and Affected Versions** TRENDnet TEW-673GRU version 1.00b40 **Description** The issue allows remote attackers to execute arbitrary commands on the device. This is achieved by exploiting an OS command injection vulnerability in the start arpping function of the timer binary. The vulnerability can be triggered by passing malicious input to the `dhcpd start`, `dhcpd end`, and `lan ipaddr` parameters in a POST request to the "apply.cgi" binary. **Recommendations** For TRENDnet TEW-673GRU version 1.00b40, as a temporary workaround, consider restricting access to the apply.cgi binary to minimize the risk of exploitation. Avoid using the parameters `dhcpd start`, `dhcpd end`, and `lan ipaddr` in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 4.19.9 **Description** The issue is related to the function `hso get config data` in the Linux kernel, which reads data from a USB device and uses it to index an array. This can result in an object out-of-bounds read, potentially allowing arbitrary read access in the kernel address space. The vulnerability may be exploited to cause a denial of service. **Recommendations** For Linux kernel versions prior to 4.19.9, update to version 4.19.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the `hso get config data` function in the `drivers/net/usb/hso.c` file until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 4.19.7 **Description** The issue is related to a use-after-free in the ALSA driver. A local user could exploit this by supplying a malicious USB Sound device that is mishandled in the `usb audio probe` function in `sound/usb/card.c`. This could allow an attacker to execute arbitrary code or cause a denial of service. **Recommendations** For Linux kernel versions prior to 4.19.7, consider updating to version 4.19.7 or later to resolve the issue. As a temporary workaround, consider restricting the use of USB Sound devices to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 4.19.9 **Description** An issue in the Linux kernel's USB subsystem mishandles size checks during the reading of an extra descriptor, related to the ` usb get extra descriptor` function in `drivers/usb/core/usb.c`. This issue may allow an attacker to impact the confidentiality and integrity of protected information. **Recommendations** For Linux kernel versions prior to 4.19.9, update to version 4.19.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the USB subsystem to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions 2.6.32 through 4.x **Description** The issue is related to the Kernel Samepage Merging (KSM) component in the Linux kernel, which does not prevent the use of a write-timing side channel. This allows guest OS users to defeat the Address Space Layout Randomization (ASLR) protection mechanism on other guest OS instances via a Cross-VM ASL Introspection (CAIN) attack. The vendor suggests disabling deduplication to mitigate this attack vector. This issue can be classified as a potentially misunderstood behavior rather than a vulnerability, as share-until-written approaches for memory conservation among mutually untrusting tenants are inherently detectable for information disclosure. **Recommendations** For Linux kernel versions 2.6.32 through 4.x, consider disabling deduplication to mitigate the risk of exploitation. As a temporary workaround, restrict the use of the Kernel Samepage Merging (KSM) component until a more comprehensive solution is available.