Maxim Suhanov

**Name of the Vulnerable Software and Affected Versions** Nmap versions prior to 8.0 **Description** A denial of service issue allows remote attackers to crash the application by sending a crafted packet containing a zero-length TCP option. This malformed packet triggers the `Packet:parse options()` function in nselib/packet.lua to allocate objects in an infinite loop, leading to an out-of-memory condition. **Recommendations** Update to version 8.0 or later.

**Name of the Vulnerable Software and Affected Versions** Windows Recovery Environment Agent (affected versions not specified) **Description** Improper removal of sensitive information before storage or transfer in the Windows Recovery Environment Agent allows an unauthorized attacker to bypass a security feature through a physical attack. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows Boot Manager (affected versions not specified) **Description** Use of an uninitialized resource allows an unauthorized attacker to bypass a security feature through a physical attack. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Settings.java (affected versions not specified) **Description** A logic error in the `enableSystemPackageLPw` function within Settings.java may prevent location access from functioning correctly. This could lead to local escalation of privilege without requiring additional execution privileges or user interaction. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** APTIOV (affected versions not specified) **Description** APTIOV BIOS contains a flaw that allows a local attacker to trigger an Out-of-bounds Write. Successful exploitation of this issue may result in data corruption and a loss of system availability. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** APTIOV (affected versions not specified) **Description** APTIOV BIOS contains a flaw that allows a local attacker to perform an Improper Restriction of Operations within the Bounds of a Memory Buffer. Successful exploitation of this issue could lead to memory corruption, impacting system integrity and availability. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** APTIOV (affected versions not specified) **Description** The BIOS software, APTIOV, contains a flaw where a buffer copy operation does not properly validate the size of the input data. A local attacker can exploit this to potentially execute arbitrary code. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** APTIOV (affected versions not specified) **Description** APTIOV BIOS contains a flaw that allows a local attacker to trigger an Out-of-bounds Write. Successful exploitation of this issue may result in data corruption and a loss of system availability. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows BitLocker (affected versions not specified) **Description** A critical issue in Windows BitLocker exposes the encryption mechanism to a novel randomization attack targeting the AES-XTS mode. This allows attackers to bypass BitLocker encryption by corrupting a registry key, causing unencrypted hibernation images to be written to disk. The attack, known as CrashXTS, can compromise encrypted data by finding and corrupting a specific 16-byte block to leak unencrypted hibernation images. This issue risks sensitive data and poses significant risks to data security. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows (affected versions not specified) **Description** The issue is related to a security feature bypass in the BitLocker data protection function of Microsoft Windows operating systems. This bypass is due to a disruption in the data protection mechanism. Exploitation of this issue could allow an attacker to circumvent existing security restrictions. There is no information provided about the estimated number of potentially affected devices worldwide or details about real-world incidents where this issue was exploited. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Windows (affected versions not specified) Description: The issue is related to a buffer overflow in the stack of the Secure Boot protocol implementation in Windows operating systems. This could allow an attacker to bypass existing security restrictions. A security-feature bypass vulnerability allows attackers to affect the system. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** 7-Zip versions prior to 24.01 **Description** The issue is related to a heap-based buffer overflow in the NtfsHandler.cpp NTFS handler. This overflow allows an attacker to overwrite two bytes at multiple offsets beyond the allocated buffer size, specifically at buffer+512*i-2, for i=9, i=10, i=11, etc. The exploitation of this issue may enable a remote attacker to execute arbitrary code. **Recommendations** For versions prior to 24.01, update to version 24.01 or later to resolve the issue. As a temporary workaround, consider restricting the use of the NTFS handler in 7-Zip until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Dell Client BIOS (affected versions not specified) **Description** The issue is related to an Out-of-bounds Write vulnerability. A local authenticated malicious user with admin privileges could potentially exploit this vulnerability, leading to platform denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** exfatprogs versions prior to 1.2.2 **Description** The issue is related to the `read file dentry set` function in the exfatprogs utility, which is associated with out-of-bounds memory access. This could allow an attacker to impact data integrity. **Recommendations** For versions prior to 1.2.2, update to version 1.2.2 or later to resolve the issue. As a temporary workaround, consider restricting the use of the `read file dentry set` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** msdosfs (affected versions not specified) **Description** The issue arises when the 'truncate' or 'ftruncate' system calls are used on an msdosfs filesystem under certain circumstances. Instead of populating the additional space in the file with zero bytes, these calls fill the space with unallocated data from the underlying disk device. This may allow a user with write access to files on the msdosfs filesystem to read unintended data, such as from a previously deleted file. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Grub2 (affected versions not specified) **Description** An out-of-bounds write flaw was found in Grub2's NTFS filesystem driver. This issue may allow an attacker to present a specially crafted NTFS filesystem image, leading to Grub's heap metadata corruption. In some circumstances, the attack may also corrupt the UEFI firmware heap metadata. As a result, arbitrary code execution and secure boot protection bypass may be achieved. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Grub2 (affected versions not specified) **Description** The issue is related to an out-of-bounds read flaw in Grub2's NTFS filesystem driver. This flaw may allow a physically present attacker to present a specially crafted NTFS file system image to read arbitrary memory locations, potentially leading to the leakage of sensitive data cached in memory or EFI variable values. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** 7-Zip versions prior to 24.01 **Description** The issue is related to an out-of-bounds read in the NTFS handler of 7-Zip. This allows an attacker to read beyond the intended buffer, with the bytes read presented as part of a filename in the file system image. The security relevance of this issue is notable in web-service use cases where untrusted users can upload files that are then extracted by a server-side 7-Zip process. The vulnerability can be exploited by a remote attacker to upload arbitrary files and gain unauthorized access to protected information. **Recommendations** For versions prior to 24.01, update to version 24.01 or later to resolve the issue. As a temporary workaround, consider restricting the use of the NTFS handler in 7-Zip to minimize the risk of exploitation. Avoid using 7-Zip to extract files from untrusted sources until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A flaw was found in the exFAT driver of the Linux kernel. The vulnerability exists in the implementation of the file name reconstruction function, which is responsible for reading file name entries from a directory index and merging file name parts belonging to one file into a single long file name. Since the file name characters are copied into a stack variable, a local privileged attacker could use this flaw to overflow the kernel stack. The vulnerability is related to the `exfat get uniname from ext entry()` function in the `fs/exfat/dir.c` module, which is associated with accessing memory beyond the allocated buffer. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows Early Launch Antimalware Driver (affected versions not specified) **Description** The issue is related to a security feature bypass in the Windows Early Launch Antimalware Driver, which may allow an attacker to bypass security features. This could potentially lead to information disclosure. The vulnerability may be exploited to affect the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.