Устройства доп. рабочего места отображаются в устройствах seat0

При нажатии кнопки "Удалить" сбрасываются настройки рабочих мест

Уязвимость набора стандартов связи для коммуникации IEEE 802.11 операционной системы Windows, позволяющая нарушителю внедрить произвольные сетевые пакеты

Уязвимость реализации алгоритмов WPA и WPA2 драйвера 6.1316.1209 Wi-Fi адаптера ALFA, позволяющая нарушителю внедрить и расшифровать пакеты в сетях WPA или WPA2

Уязвимость реализации алгоритмов WPA, WPA2 и WPA3 набора стандартов связи для коммуникации IEEE 802.11, позволяющая нарушителю оказать воздействие на целостность защищаемой информации

Уязвимость реализации алгоритмов WEP, WPA, WPA2 и WPA3 набора стандартов связи для коммуникации IEEE 802.11, позволяющая нарушителю внедрить произвольные сетевые пакеты и/или оказать воздействие на целостность защищаемой информации

Уязвимость реализации алгоритмов WEP, WPA, WPA2 и WPA3 ядра операционной системы Linux, позволяющая нарушителю внедрить произвольные сетевые пакеты независимо от конфигурации сети

Уязвимость реализации алгоритмов WEP, WPA, WPA2 и WPA3 ядра операционной системы Linux, позволяющая нарушителю оказать воздействие на целостность защищаемой информации

The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that received fragments be cleared from memory after (re)connecting to a network. Under the right circumstances, when another device sends fragmented frames encrypted using WEP, CCMP, or GCMP, this can be abused to inject arbitrary network packets and/or exfiltrate user data.

The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that all fragments of a frame are encrypted under the same key. An adversary can abuse this to decrypt selected fragments when another device sends fragmented frames and the WEP, CCMP, or GCMP encryption key is periodically renewed.

The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that the A-MSDU flag in the plaintext QoS header field is authenticated. Against devices that support receiving non-SSP A-MSDU frames (which is mandatory as part of 802.11n), an adversary can abuse this to inject arbitrary network packets.

An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. The Wi-Fi implementation does not verify the Message Integrity Check (authenticity) of fragmented TKIP frames. An adversary can abuse this to inject and possibly decrypt packets in WPA or WPA2 networks that support the TKIP data-confidentiality protocol.

An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2, and WPA3 implementations accept second (or subsequent) broadcast fragments even when sent in plaintext and process them as full unfragmented frames. An adversary can abuse this to inject arbitrary network packets independent of the network configuration.

An issue was discovered in the Linux kernel 5.8.9. The WEP, WPA, WPA2, and WPA3 implementations reassemble fragments even though some of them were sent in plaintext. This vulnerability can be abused to inject packets and/or exfiltrate selected fragments when another device sends fragmented frames and the WEP, CCMP, or GCMP data-confidentiality protocol is used.

Уязвимость браузера Mozilla Firefox, связанная с выходом операции за границы буфера в памяти, позволяющая нарушителю выполнить произвольный код

Уязвимость почтового клиента Mozilla Thunderbird, связанная с чтением за границами буфера в памяти, позволяющая нарушителю получить доступ к конфиденциальной информации

Уязвимость браузера Mozilla Firefox, связанная с записью за границами буфера в памяти, позволяющая нарушителю выполнить произвольный код

Уязвимость браузера Mozilla Firefox, связанная с отсутствием проверки корректности принимаемых запросов, позволяющая нарушителю получить доступ к конфиденциальным данным и нарушить их целостность

Уязвимость функции "Приватный Просмотр" браузера Mozilla Firefox, позволяющая нарушителю вызвать отказ в обслуживании

Уязвимость браузера Mozilla Firefox, связанная c некорректной зачисткой или освобождением ресурсов, позволяющая нарушителю вызвать отказ в обслуживании

Уязвимость браузера Mozilla Firefox, связанная с ошибками авторизации, позволяющая нарушителю обойти существующие ограничения безопасности

Уязвимость браузера Mozilla Firefox, связанная с недостатками контроля доступа, позволяющая нарушителю видоизменять пользовательский интерфейс

Уязвимость браузера Firefox for Android, связанная с ошибками при обработке гипертекстовых ссылок, позволяющая нарушителю получить доступ к конфиденциальным данным

When a user has already allowed a website to access microphone and camera, disabling camera sharing would not fully prevent the website from re-enabling it without an additional prompt. This was only possible if the website kept recording with the microphone until re-enabling the camera. This vulnerability affects Firefox < 89.

Firefox used to cache the last filename used for printing a file. When generating a filename for printing, Firefox usually suggests the web page title. The caching and suggestion techniques combined may have lead to the title of a website visited during private browsing mode being stored on disk. This vulnerability affects Firefox < 89.

When styling and rendering an oversized `` element, Firefox did not apply correct clipping which allowed an attacker to paint over the user interface. This vulnerability affects Firefox < 89.

Severity: MEDIUM (4.3) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

References:

• https://bugzilla.mozilla.org/show_bug.cgi?id=1700235
• https://bugzilla.mozilla.org/show_bug.cgi?id=1700235
• GLSA-202107-09
• GLSA-202107-09
• https://www.mozilla.org/security/advisories/mfsa2021-23/
• https://www.mozilla.org/security/advisories/mfsa2021-23/

Published: 2021-06-24
Modified: 2024-11-21

CVE-2021-29962

Firefox for Android would become unstable and hard-to-recover when a website opened too many popups. *This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 89.

Severity: MEDIUM (4.3) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

References:

• https://bugzilla.mozilla.org/show_bug.cgi?id=1701673
• https://bugzilla.mozilla.org/show_bug.cgi?id=1701673
• https://www.mozilla.org/security/advisories/mfsa2021-23/
• https://www.mozilla.org/security/advisories/mfsa2021-23/

Published: 2021-06-24
Modified: 2024-11-21

CVE-2021-29963

Address bar search suggestions in private browsing mode were re-using session data from normal mode. *This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 89.

Severity: MEDIUM (4.3) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

References:

• https://bugzilla.mozilla.org/show_bug.cgi?id=1705068
• https://bugzilla.mozilla.org/show_bug.cgi?id=1705068
• https://www.mozilla.org/security/advisories/mfsa2021-23/
• https://www.mozilla.org/security/advisories/mfsa2021-23/

Published: 2021-06-24
Modified: 2024-11-21

CVE-2021-29964

A locally-installed hostile program could send `WM_COPYDATA` messages that Firefox would process incorrectly, leading to an out-of-bounds read. *This bug only affects Firefox on Windows. Other operating systems are unaffected.*. This vulnerability affects Thunderbird < 78.11, Firefox < 89, and Firefox ESR < 78.11.

Severity: HIGH (7.1) Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

References:

• https://bugzilla.mozilla.org/show_bug.cgi?id=1706501
• https://bugzilla.mozilla.org/show_bug.cgi?id=1706501
• https://www.mozilla.org/security/advisories/mfsa2021-23/
• https://www.mozilla.org/security/advisories/mfsa2021-23/
• https://www.mozilla.org/security/advisories/mfsa2021-24/
• https://www.mozilla.org/security/advisories/mfsa2021-24/
• https://www.mozilla.org/security/advisories/mfsa2021-26/
• https://www.mozilla.org/security/advisories/mfsa2021-26/

Published: 2021-06-24
Modified: 2024-11-21

CVE-2021-29965

A malicious website that causes an HTTP Authentication dialog to be spawned could trick the built-in password manager to suggest passwords for the currently active website instead of the website that triggered the dialog. *This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 89.

Severity: MEDIUM (5.3) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References:

• https://bugzilla.mozilla.org/show_bug.cgi?id=1709257
• https://bugzilla.mozilla.org/show_bug.cgi?id=1709257
• https://www.mozilla.org/security/advisories/mfsa2021-23/
• https://www.mozilla.org/security/advisories/mfsa2021-23/

Published: 2021-06-24
Modified: 2024-11-21

CVE-2021-29966

Mozilla developers reported memory safety bugs present in Firefox 88. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 89.

Severity: HIGH (8.8) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References:

• https://bugzilla.mozilla.org/buglist.cgi?bug_id=1660307%2C1686154%2C1702948%2C1708124
• https://bugzilla.mozilla.org/buglist.cgi?bug_id=1660307%2C1686154%2C1702948%2C1708124
• GLSA-202107-09
• GLSA-202107-09
• https://www.mozilla.org/security/advisories/mfsa2021-23/
• https://www.mozilla.org/security/advisories/mfsa2021-23/

Published: 2021-06-24
Modified: 2024-11-21

CVE-2021-29967

Mozilla developers reported memory safety bugs present in Firefox 88 and Firefox ESR 78.11. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 78.11, Firefox < 89, and Firefox ESR < 78.11.

Severity: HIGH (8.8) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References:

• https://bugzilla.mozilla.org/buglist.cgi?bug_id=1602862%2C1703191%2C1703760%2C1704722%2C1706041
• https://bugzilla.mozilla.org/buglist.cgi?bug_id=1602862%2C1703191%2C1703760%2C1704722%2C1706041
• GLSA-202208-14
• GLSA-202208-14
• https://www.mozilla.org/security/advisories/mfsa2021-23/
• https://www.mozilla.org/security/advisories/mfsa2021-23/
• https://www.mozilla.org/security/advisories/mfsa2021-24/
• https://www.mozilla.org/security/advisories/mfsa2021-24/
• https://www.mozilla.org/security/advisories/mfsa2021-26/
• https://www.mozilla.org/security/advisories/mfsa2021-26/

ALT-PU-2021-1920-1

Package kernel-image-std-kvm updated to version 5.10.42-alt1 for branch sisyphus in task 273546.

Closed vulnerabilities

Published: 2021-05-10

BDU:2021-02663

Уязвимость набора стандартов связи для коммуникации IEEE 802.11 операционной системы Windows, позволяющая нарушителю внедрить произвольные сетевые пакеты

Severity: LOW (3.5) Vector: AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

References:

• CVE-2020-24588

Published: 2021-05-10

BDU:2021-03088

Уязвимость реализации алгоритмов WPA, WPA2 и WPA3 набора стандартов связи для коммуникации IEEE 802.11, позволяющая нарушителю оказать воздействие на целостность защищаемой информации

Severity: LOW (2.6) Vector: AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

References:

• CVE-2020-24587

Published: 2021-05-10

BDU:2021-03095

Уязвимость реализации алгоритмов WEP, WPA, WPA2 и WPA3 набора стандартов связи для коммуникации IEEE 802.11, позволяющая нарушителю внедрить произвольные сетевые пакеты и/или оказать воздействие на целостность защищаемой информации

Severity: LOW (3.5) Vector: AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

References:

• CVE-2020-24586

Published: 2021-05-10

BDU:2021-03177

Уязвимость реализации алгоритмов WEP, WPA, WPA2 и WPA3 ядра операционной системы Linux, позволяющая нарушителю оказать воздействие на целостность защищаемой информации

Severity: MEDIUM (5.4) Vector: AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N

References:

• CVE-2020-26147

Published: 2021-05-11

BDU:2021-04825

Уязвимость функции bpf_ringbuf_reserve() ядра операционной системы Linux , связанная с записью за границами буфера в памяти, позволяющая нарушителю выполнить произвольный код в контексте ядра

Severity: HIGH (7.8) Vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References:

• CVE-2021-3489

Published: 2021-05-11

BDU:2021-04842

Уязвимость подсистемы eBPF ядра операционной системы Linux , связанная с чтением за границами буфера в памяти, позволяющая нарушителю выполнить произвольный код в контексте ядра

Severity: HIGH (7.8) Vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References:

• CVE-2021-3490

Published: 2021-05-05

BDU:2021-04843

Уязвимость подсистемы io_uring ядра операционной системы Linux, связанная с записью за границами буфера в памяти, позволяющая нарушителю выполнить произвольный код

Severity: HIGH (8.8) Vector: AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References:

• CVE-2021-3491

Published: 2021-04-14

BDU:2022-04604

Уязвимость функции decode_nfs_fh() ядра операционной системы Linux, позволяющая нарушителю повысить свои привилегии и вызвать аварийное завершение системы

Severity: HIGH (8.0) Vector: AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References:

• CVE-2021-4157

Published: 2021-05-11
Modified: 2024-11-21

CVE-2020-24586

The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that received fragments be cleared from memory after (re)connecting to a network. Under the right circumstances, when another device sends fragmented frames encrypted using WEP, CCMP, or GCMP, this can be abused to inject arbitrary network packets and/or exfiltrate user data.

Severity: LOW (3.5) Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

References:

• [oss-security] 20210511 various 802.11 security issues - fragattacks.com
• [oss-security] 20210511 various 802.11 security issues - fragattacks.com
• https://github.com/vanhoefm/fragattacks/blob/master/SUMMARY.md
• https://github.com/vanhoefm/fragattacks/blob/master/SUMMARY.md
• [debian-lts-announce] 20210623 [SECURITY] [DLA 2690-1] linux-4.19 security update
• [debian-lts-announce] 20210623 [SECURITY] [DLA 2690-1] linux-4.19 security update
• [debian-lts-announce] 20210623 [SECURITY] [DLA 2689-1] linux security update
• [debian-lts-announce] 20210623 [SECURITY] [DLA 2689-1] linux security update
• [debian-lts-announce] 20230401 [SECURITY] [DLA 3380-1] firmware-nonfree LTS new upstream version (security updates and newer firmware for Linux 5.10)
• [debian-lts-announce] 20230401 [SECURITY] [DLA 3380-1] firmware-nonfree LTS new upstream version (security updates and newer firmware for Linux 5.10)
• 20210511 Multiple Vulnerabilities in Frame Aggregation and Fragmentation Implementations of 802.11 Specification Affecting Cisco Products: May 2021
• 20210511 Multiple Vulnerabilities in Frame Aggregation and Fragmentation Implementations of 802.11 Specification Affecting Cisco Products: May 2021
• https://www.arista.com/en/support/advisories-notices/security-advisories/12602-security-advisory-63
• https://www.arista.com/en/support/advisories-notices/security-advisories/12602-security-advisory-63
• https://www.fragattacks.com
• https://www.fragattacks.com
• https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00473.html
• https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00473.html

Published: 2021-05-11
Modified: 2024-11-21

CVE-2020-24587

The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that all fragments of a frame are encrypted under the same key. An adversary can abuse this to decrypt selected fragments when another device sends fragmented frames and the WEP, CCMP, or GCMP encryption key is periodically renewed.

Severity: LOW (2.6) Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

References:

• [oss-security] 20210511 various 802.11 security issues - fragattacks.com
• [oss-security] 20210511 various 802.11 security issues - fragattacks.com
• https://github.com/vanhoefm/fragattacks/blob/master/SUMMARY.md
• https://github.com/vanhoefm/fragattacks/blob/master/SUMMARY.md
• [debian-lts-announce] 20210623 [SECURITY] [DLA 2690-1] linux-4.19 security update
• [debian-lts-announce] 20210623 [SECURITY] [DLA 2690-1] linux-4.19 security update
• [debian-lts-announce] 20210623 [SECURITY] [DLA 2689-1] linux security update
• [debian-lts-announce] 20210623 [SECURITY] [DLA 2689-1] linux security update
• [debian-lts-announce] 20230401 [SECURITY] [DLA 3380-1] firmware-nonfree LTS new upstream version (security updates and newer firmware for Linux 5.10)
• [debian-lts-announce] 20230401 [SECURITY] [DLA 3380-1] firmware-nonfree LTS new upstream version (security updates and newer firmware for Linux 5.10)
• 20210511 Multiple Vulnerabilities in Frame Aggregation and Fragmentation Implementations of 802.11 Specification Affecting Cisco Products: May 2021
• 20210511 Multiple Vulnerabilities in Frame Aggregation and Fragmentation Implementations of 802.11 Specification Affecting Cisco Products: May 2021
• https://www.arista.com/en/support/advisories-notices/security-advisories/12602-security-advisory-63
• https://www.arista.com/en/support/advisories-notices/security-advisories/12602-security-advisory-63
• https://www.fragattacks.com
• https://www.fragattacks.com
• https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00473.html
• https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00473.html

Published: 2021-05-11
Modified: 2024-11-21

CVE-2020-24588

The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that the A-MSDU flag in the plaintext QoS header field is authenticated. Against devices that support receiving non-SSP A-MSDU frames (which is mandatory as part of 802.11n), an adversary can abuse this to inject arbitrary network packets.

Severity: LOW (3.5) Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

References:

• [oss-security] 20210511 various 802.11 security issues - fragattacks.com
• [oss-security] 20210511 various 802.11 security issues - fragattacks.com
• https://cert-portal.siemens.com/productcert/pdf/ssa-913875.pdf
• https://cert-portal.siemens.com/productcert/pdf/ssa-913875.pdf
• https://github.com/vanhoefm/fragattacks/blob/master/SUMMARY.md
• https://github.com/vanhoefm/fragattacks/blob/master/SUMMARY.md
• [debian-lts-announce] 20210623 [SECURITY] [DLA 2690-1] linux-4.19 security update
• [debian-lts-announce] 20210623 [SECURITY] [DLA 2690-1] linux-4.19 security update
• [debian-lts-announce] 20210623 [SECURITY] [DLA 2689-1] linux security update
• [debian-lts-announce] 20210623 [SECURITY] [DLA 2689-1] linux security update
• [debian-lts-announce] 20230401 [SECURITY] [DLA 3380-1] firmware-nonfree LTS new upstream version (security updates and newer firmware for Linux 5.10)
• [debian-lts-announce] 20230401 [SECURITY] [DLA 3380-1] firmware-nonfree LTS new upstream version (security updates and newer firmware for Linux 5.10)
• 20210511 Multiple Vulnerabilities in Frame Aggregation and Fragmentation Implementations of 802.11 Specification Affecting Cisco Products: May 2021
• 20210511 Multiple Vulnerabilities in Frame Aggregation and Fragmentation Implementations of 802.11 Specification Affecting Cisco Products: May 2021
• https://www.arista.com/en/support/advisories-notices/security-advisories/12602-security-advisory-63
• https://www.arista.com/en/support/advisories-notices/security-advisories/12602-security-advisory-63
• https://www.fragattacks.com
• https://www.fragattacks.com
• https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00473.html
• https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00473.html

Published: 2021-05-11
Modified: 2024-11-21

CVE-2020-26147

An issue was discovered in the Linux kernel 5.8.9. The WEP, WPA, WPA2, and WPA3 implementations reassemble fragments even though some of them were sent in plaintext. This vulnerability can be abused to inject packets and/or exfiltrate selected fragments when another device sends fragmented frames and the WEP, CCMP, or GCMP data-confidentiality protocol is used.

Severity: MEDIUM (5.4) Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N

References:

• [oss-security] 20210511 various 802.11 security issues - fragattacks.com
• [oss-security] 20210511 various 802.11 security issues - fragattacks.com
• https://cert-portal.siemens.com/productcert/pdf/ssa-913875.pdf
• https://cert-portal.siemens.com/productcert/pdf/ssa-913875.pdf
• https://github.com/vanhoefm/fragattacks/blob/master/SUMMARY.md
• https://github.com/vanhoefm/fragattacks/blob/master/SUMMARY.md
• [debian-lts-announce] 20210623 [SECURITY] [DLA 2690-1] linux-4.19 security update
• [debian-lts-announce] 20210623 [SECURITY] [DLA 2690-1] linux-4.19 security update
• [debian-lts-announce] 20210623 [SECURITY] [DLA 2689-1] linux security update
• [debian-lts-announce] 20210623 [SECURITY] [DLA 2689-1] linux security update
• 20210511 Multiple Vulnerabilities in Frame Aggregation and Fragmentation Implementations of 802.11 Specification Affecting Cisco Products: May 2021
• 20210511 Multiple Vulnerabilities in Frame Aggregation and Fragmentation Implementations of 802.11 Specification Affecting Cisco Products: May 2021
• https://www.arista.com/en/support/advisories-notices/security-advisories/12602-security-advisory-63
• https://www.arista.com/en/support/advisories-notices/security-advisories/12602-security-advisory-63
• https://www.fragattacks.com
• https://www.fragattacks.com

Published: 2021-06-04
Modified: 2024-11-21

CVE-2021-3489

The eBPF RINGBUF bpf_ringbuf_reserve() function in the Linux kernel did not check that the allocated size was smaller than the ringbuf size, allowing an attacker to perform out-of-bounds writes within the kernel and therefore, arbitrary code execution. This issue was fixed via commit 4b81ccebaeee ("bpf, ringbuf: Deny reserve of buffers larger than ringbuf") (v5.13-rc4) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37. It was introduced via 457f44363a88 ("bpf: Implement BPF ring buffer and verifier support for it") (v5.8-rc1).

Severity: HIGH (7.8) Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References:

• https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=4b81ccebaeee885ab1aa1438133f2991e3a2b6ea
• https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=4b81ccebaeee885ab1aa1438133f2991e3a2b6ea
• https://security.netapp.com/advisory/ntap-20210716-0004/
• https://security.netapp.com/advisory/ntap-20210716-0004/
• https://ubuntu.com/security/notices/USN-4949-1
• https://ubuntu.com/security/notices/USN-4949-1
• https://ubuntu.com/security/notices/USN-4950-1
• https://ubuntu.com/security/notices/USN-4950-1
• [oss-security] CVE-2021-3489 - Linux kernel eBPF RINGBUF map oversized allocation
• [oss-security] CVE-2021-3489 - Linux kernel eBPF RINGBUF map oversized allocation
• https://www.zerodayinitiative.com/advisories/ZDI-21-590/
• https://www.zerodayinitiative.com/advisories/ZDI-21-590/

Published: 2021-06-04
Modified: 2024-11-21

CVE-2021-3490

The eBPF ALU32 bounds tracking for bitwise ops (AND, OR and XOR) in the Linux kernel did not properly update 32-bit bounds, which could be turned into out of bounds reads and writes in the Linux kernel and therefore, arbitrary code execution. This issue was fixed via commit 049c4e13714e ("bpf: Fix alu32 const subreg bound tracking on bitwise operations") (v5.13-rc4) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37. The AND/OR issues were introduced by commit 3f50f132d840 ("bpf: Verifier, do explicit ALU32 bounds tracking") (5.7-rc1) and the XOR variant was introduced by 2921c90d4718 ("bpf:Fix a verifier failure with xor") ( 5.10-rc1).

Severity: HIGH (7.8) Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References:

• http://packetstormsecurity.com/files/164015/Linux-eBPF-ALU32-32-bit-Invalid-Bounds-Tracking-Local-Privilege-Escalation.html
• http://packetstormsecurity.com/files/164015/Linux-eBPF-ALU32-32-bit-Invalid-Bounds-Tracking-Local-Privilege-Escalation.html
• https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=049c4e13714ecbca567b4d5f6d563f05d431c80e
• https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit/?id=049c4e13714ecbca567b4d5f6d563f05d431c80e
• https://security.netapp.com/advisory/ntap-20210716-0004/
• https://security.netapp.com/advisory/ntap-20210716-0004/
• https://ubuntu.com/security/notices/USN-4949-1
• https://ubuntu.com/security/notices/USN-4949-1
• https://ubuntu.com/security/notices/USN-4950-1
• https://ubuntu.com/security/notices/USN-4950-1
• [oss-security] CVE-2021-3490 - Linux kernel eBPF bitwise ops ALU32 bounds tracking
• [oss-security] CVE-2021-3490 - Linux kernel eBPF bitwise ops ALU32 bounds tracking
• https://www.zerodayinitiative.com/advisories/ZDI-21-606/
• https://www.zerodayinitiative.com/advisories/ZDI-21-606/

Published: 2021-06-04
Modified: 2024-11-21

CVE-2021-3491

The io_uring subsystem in the Linux kernel allowed the MAX_RW_COUNT limit to be bypassed in the PROVIDE_BUFFERS operation, which led to negative values being usedin mem_rw when reading /proc//mem. This could be used to create a heap overflow leading to arbitrary code execution in the kernel. It was addressed via commit d1f82808877b ("io_uring: truncate lengths larger than MAX_RW_COUNT on provide buffers") (v5.13-rc1) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37. It was introduced in ddf0322db79c ("io_uring: add IORING_OP_PROVIDE_BUFFERS") (v5.7-rc1).

Severity: HIGH (8.8) Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References:

• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d1f82808877bb10d3deee7cf3374a4eb3fb582db
• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d1f82808877bb10d3deee7cf3374a4eb3fb582db
• https://security.netapp.com/advisory/ntap-20210716-0004/
• https://security.netapp.com/advisory/ntap-20210716-0004/
• https://ubuntu.com/security/notices/USN-4949-1
• https://ubuntu.com/security/notices/USN-4949-1
• https://ubuntu.com/security/notices/USN-4950-1
• https://ubuntu.com/security/notices/USN-4950-1
• [oss-security] CVE-2021-3491 - Linux kernel io_uring PROVIDE_BUFFERS MAX_RW_COUNT bypass
• [oss-security] CVE-2021-3491 - Linux kernel io_uring PROVIDE_BUFFERS MAX_RW_COUNT bypass
• https://www.zerodayinitiative.com/advisories/ZDI-21-589/
• https://www.zerodayinitiative.com/advisories/ZDI-21-589/

Published: 2022-03-25
Modified: 2024-11-21

CVE-2021-4157

An out of memory bounds write flaw (1 or 2 bytes of memory) in the Linux kernel NFS subsystem was found in the way users use mirroring (replication of files with NFS). A user, having access to the NFS mount, could potentially use this flaw to crash the system or escalate privileges on the system.

Severity: HIGH (8.0) Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References:

• https://bugzilla.redhat.com/show_bug.cgi?id=2034342
• https://bugzilla.redhat.com/show_bug.cgi?id=2034342
• https://lore.kernel.org/lkml/20210517140244.822185482%40linuxfoundation.org/
• https://lore.kernel.org/lkml/20210517140244.822185482%40linuxfoundation.org/
• https://security.netapp.com/advisory/ntap-20220602-0007/
• https://security.netapp.com/advisory/ntap-20220602-0007/
• https://www.oracle.com/security-alerts/cpujul2022.html
• https://www.oracle.com/security-alerts/cpujul2022.html

ALT-PU-2021-1921-1

Package tomcat updated to version 9.0.38-alt1_1jpp11 for branch sisyphus in task 273547.

Closed vulnerabilities

Published: 2020-10-12
Modified: 2024-11-21

CVE-2020-13943

If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.

Severity: MEDIUM (4.3) Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References:

• openSUSE-SU-2020:1799
• openSUSE-SU-2020:1842
• https://lists.apache.org/thread.html/r4a390027eb27e4550142fac6c8317cc684b157ae314d31514747f307%40%3Cannounce.tomcat.apache.org%3E
• [debian-lts-announce] 20201014 [SECURITY] [DLA 2407-1] tomcat8 security update
• https://security.netapp.com/advisory/ntap-20201016-0007/
• DSA-4835
• https://www.oracle.com/security-alerts/cpuApr2021.html
• openSUSE-SU-2020:1799
• https://www.oracle.com/security-alerts/cpuApr2021.html
• DSA-4835
• https://security.netapp.com/advisory/ntap-20201016-0007/
• [debian-lts-announce] 20201014 [SECURITY] [DLA 2407-1] tomcat8 security update
• https://lists.apache.org/thread.html/r4a390027eb27e4550142fac6c8317cc684b157ae314d31514747f307%40%3Cannounce.tomcat.apache.org%3E
• openSUSE-SU-2020:1842

VKontakte | Telegram | YouTube | Forum | GitHub | Bugzilla

Version: 2.1.0

Back to top