Yuxiang Yang

The `ptrace(PT SC REMOTE)` function failed to properly validate parameters for the `syscall(2)` and ` syscall(2)` meta-system calls. This allows a user with debugging capabilities to trigger arbitrary code execution in the kernel, regardless of the target process's privileges. An unprivileged local user can exploit this to escalate privileges and potentially gain full control of the system.

The issue allows a remote attacker to cause a denial of service via the Routing functionality and ICMP packet handling.

The issue allows an attacker in the same WLAN as the victim to hijack traffic between the victim and any remote server by sending forged ICMP redirect messages. This can be exploited by an attacker in the same wireless network.

The issue allows an attacker in the same WLAN as the victim to disconnect or hijack the traffic between the victim and any remote server by sending out forged TCP RST messages to evict NAT mappings in the router. This can lead to TCP DoS or hijacking attacks.

Name of the Vulnerable Software and Affected Versions: TP-LINK TL-7DR5130 version 1.0.23 Description: The issue is related to the mechanism of transmitting routing information to hosts via ICMP Redirect in the TP-LINK TL-7DR5130 wireless router's firmware. It is associated with insufficient verification of the communication channel source. An attacker in the same WLAN as the victim can exploit this by sending specially crafted ICMP messages to hijack the traffic between the victim and any remote server. Recommendations: For TP-LINK TL-7DR5130 version 1.0.23, consider restricting access to the network to minimize the risk of exploitation until a patch is available. As a temporary workaround, disabling the handling of ICMP redirect messages could help mitigate the issue. However, specific steps for this action are not provided. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: TP-LINK TL-7DR5130 version 1.0.23 Description: The issue is related to insufficient validation of the communication channel source, which can be exploited by an attacker to perform a TCP Reset attack. This can be done by sending specially crafted RST messages to a remote server, potentially allowing the attacker to disconnect or hijack the traffic between the victim and the server. An attacker in the same WLAN as the victim can exploit this by sending forged TCP RST messages to evict NAT mappings in the router. Recommendations: For TP-LINK TL-7DR5130 version 1.0.23, consider restricting access to port 50005 as a temporary workaround to minimize the risk of exploitation. Additionally, avoid using the router's WLAN functionality until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

An issue in the routers allows attackers to hijack TCP sessions, potentially leading to a denial of service.

An issue in OpenWrt allows off-path attackers to hijack TCP sessions. This could lead to a denial of service, impersonating the client to the server, and impersonating the server to the client, potentially allowing access to sensitive information. The issue occurs because `nf conntrack tcp no window check` is true by default.

An issue in the routers allows attackers to hijack TCP sessions, which could lead to a denial of service.

The issue allows attackers to hijack TCP sessions, potentially leading to a denial of service. It is related to incorrect clearance or release of resources, which can be exploited by a remote attacker to cause a denial of service by intercepting a TCP/IP session.

An issue in Wavlink QUANTUM D2G routers allows attackers to hijack TCP sessions, potentially leading to a denial of service.

An issue in Linksys E5600 routers allows attackers to hijack TCP sessions, potentially leading to a denial of service.

An issue in the routers allows attackers to hijack TCP sessions, which could lead to a denial of service.

An issue in the listed TP-LINK routers allows attackers to hijack TCP sessions, potentially leading to a denial of service.

An issue in the mentioned Ruijie routers allows attackers to hijack TCP sessions, potentially leading to a denial of service.

An issue in Comfast CF-616AC routers allows attackers to hijack TCP sessions, potentially leading to a denial of service.

The pf(4) packet filter in FreeBSD incorrectly validates TCP sequence numbers, which could allow a malicious actor to execute a denial-of-service attack against hosts behind the firewall. This issue is related to improper access control in the packet filter component.

The issue is related to the improper handling of ICMP requests, which can lead to information disclosure. It is also associated with the lack of proper filtering of fake ICMP messages, allowing a remote attacker to implement a spoofing attack. Additionally, the vulnerability can be exploited to intercept traffic in wireless networks protected by WPA, WPA2, and WPA3 protocols by manipulating ICMP packets with the "redirect" flag.