Valentina Palmiotti

**Name of the Vulnerable Software and Affected Versions** NVIDIA Display Driver for Linux (affected versions not specified) **Description** The NVIDIA Display Driver for Linux contains a race condition that may allow a local attacker to escalate privileges. Exploitation of this issue could lead to code execution, privilege escalation, data tampering, denial of service, and information disclosure. A race condition occurs when multiple processes or threads access shared resources simultaneously, resulting in unpredictable behavior and potential security breaches. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Streaming Service (affected versions not specified) Windows (affected versions not specified) **Description** The issue is related to a use-after-free vulnerability in the Microsoft Streaming Service of Windows operating systems, which can allow an attacker to elevate their privileges. This vulnerability can be exploited locally. **Recommendations** For Microsoft Streaming Service, consider restricting access to the service until a patch is available. For Windows, apply the recommended security updates as soon as they are available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Streaming Service Proxy (affected versions not specified) **Description** An elevation-of-privilege issue exists in the Microsoft Streaming Service Proxy for Windows operating systems. The flaw is caused by a memory buffer overflow, which occurs when an operation exceeds the allocated memory boundaries. A successful exploit could allow an attacker to increase their privilege level on the affected system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows (affected versions not specified) **Description** The issue is related to the SPNEGO Extended Negotiation (NEGOEX) security mechanism in Microsoft Windows, which can lead to information disclosure. It allows remote attackers to execute arbitrary code and affect the system. The vulnerability can be exploited through various Windows application protocols that authenticate, such as RDP and SMB. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions 5.10 through 5.14.6 **Description** The issue is related to a buffer overflow in the loop rw iter function in the Linux kernel's io uring subsystem, allowing local users to gain privileges. This is due to an error in the implementation of the io uring interface, leading to access to already freed memory blocks. The vulnerability can be exploited to create a working exploit, allowing for privilege escalation. **Recommendations** For Linux kernel versions 5.10 through 5.14.6, update to a version that includes the patch for this issue. As a temporary workaround, consider restricting access to the io uring subsystem to minimize the risk of exploitation. Avoid using the `loop rw iter()` function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.