Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2024.1016
ICS Advisory | ICSA-24-046-11 Siemens SCALANCE XCM-/XRM-300
16 February 2024
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Siemens SCALANCE XCM-/XRM-300
Publisher: ICS-CERT
Operating System: Network Appliance
Resolution: Patch/Upgrade
CVE Names: CVE-2023-40283 CVE-2023-38559 CVE-2023-37920
CVE-2023-36664 CVE-2023-36617 CVE-2023-36054
CVE-2023-35828 CVE-2023-35824 CVE-2023-35823
CVE-2023-35789 CVE-2023-35788 CVE-2023-35001
CVE-2023-34969 CVE-2023-34872 CVE-2023-34256
CVE-2023-33203 CVE-2023-32573 CVE-2023-32233
CVE-2023-32067 CVE-2023-31489 CVE-2023-31436
CVE-2023-31147 CVE-2023-31130 CVE-2023-31124
CVE-2023-31084 CVE-2023-30772 CVE-2023-30456
CVE-2023-30086 CVE-2023-29409 CVE-2023-29406
CVE-2023-29405 CVE-2023-29404 CVE-2023-29402
CVE-2023-28755 CVE-2023-28487 CVE-2023-28486
CVE-2023-28466 CVE-2023-28450 CVE-2023-27536
CVE-2023-27535 CVE-2023-27534 CVE-2023-27522
CVE-2023-26965 CVE-2023-26081 CVE-2023-25727
CVE-2023-25690 CVE-2023-25588 CVE-2023-25193
CVE-2023-25155 CVE-2023-25153 CVE-2023-24538
CVE-2023-23946 CVE-2023-23934 CVE-2023-23931
CVE-2023-23454 CVE-2023-22745 CVE-2023-22742
CVE-2023-22490 CVE-2023-21255 CVE-2023-20593
CVE-2023-4194 CVE-2023-4128 CVE-2023-3863
CVE-2023-3776 CVE-2023-3611 CVE-2023-3390
CVE-2023-3316 CVE-2023-3301 CVE-2023-3268
CVE-2023-3247 CVE-2023-3212 CVE-2023-3141
CVE-2023-3111 CVE-2023-3090 CVE-2023-3006
CVE-2023-2953 CVE-2023-2861 CVE-2023-2269
CVE-2023-2194 CVE-2023-2124 CVE-2023-2002
CVE-2023-1990 CVE-2023-1989 CVE-2023-1859
CVE-2023-1855 CVE-2023-1838 CVE-2023-1670
CVE-2023-1611 CVE-2023-1393 CVE-2023-1380
CVE-2023-1206 CVE-2023-1076 CVE-2023-0662
CVE-2023-0590 CVE-2023-0568 CVE-2023-0567
CVE-2023-0494 CVE-2023-0361 CVE-2023-0330
CVE-2023-0160 CVE-2022-48434 CVE-2022-48303
CVE-2022-47629 CVE-2022-46393 CVE-2022-46392
CVE-2022-45919 CVE-2022-45142 CVE-2022-45061
CVE-2022-44370 CVE-2022-42919 CVE-2022-41903
CVE-2022-41862 CVE-2022-41861 CVE-2022-41860
CVE-2022-41723 CVE-2022-41717 CVE-2022-41715
CVE-2022-41556 CVE-2022-41409 CVE-2022-39260
CVE-2022-39253 CVE-2022-39189 CVE-2022-38725
CVE-2022-37797 CVE-2022-37454 CVE-2022-37436
CVE-2022-36760 CVE-2022-36227 CVE-2022-36021
CVE-2022-34918 CVE-2022-34903 CVE-2022-32250
CVE-2022-32148 CVE-2022-29536 CVE-2022-29187
CVE-2022-29162 CVE-2022-29154 CVE-2022-28739
CVE-2022-28738 CVE-2022-28737 CVE-2022-26691
CVE-2022-24834 CVE-2022-24765 CVE-2022-23521
CVE-2022-23471 CVE-2022-4904 CVE-2022-4900
CVE-2022-4744 CVE-2022-4743 CVE-2022-4415
CVE-2022-3515 CVE-2022-3437 CVE-2022-3294
CVE-2022-2880 CVE-2022-2586 CVE-2022-1348
CVE-2022-1015 CVE-2021-45451 CVE-2021-43666
CVE-2021-36369 CVE-2021-4037 CVE-2021-3638
CVE-2021-3445 CVE-2020-10735 CVE-2018-13405
CVE-2006-20001
Original Bulletin:
https://www.cisa.gov/news-events/ics-advisories/icsa-24-046-11
Comment: CVSS (Max): 9.8 CVE-2022-3515 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS Source: ICS-CERT
Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- --------------------------BEGIN INCLUDED TEXT--------------------
ICS Advisory (ICSA-24-046-11)
Siemens SCALANCE XCM-/XRM-300
Release Date
February 15, 2024
As of January 10, 2023, CISA will no longer be updating ICS security advisories
for Siemens product vulnerabilities beyond the initial advisory. For the most
up-to-date information on vulnerabilities in this advisory, please see Siemens'
ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
1. EXECUTIVE SUMMARY
o CVSS v3 9.8
o ATTENTION : Exploitable remotely/low attack complexity
o Vendor : Siemens
o Equipment : SCALANCE XCM-/XRM-300
o Vulnerabilities : Out-of-bounds Write, Incorrect Type Conversion or Cast,
Improper Verification of Cryptographic Signature, Improper Access Control,
Improper Authentication, Missing Encryption of Sensitive Data, Use of a
Broken or Risky Cryptographic Algorithm, Incorrect Permission Assignment
for Critical Resource, Use After Free, HTTP Request/Response Smuggling,
Improper Input Validation, Heap-based Buffer Overflow, Integer Overflow or
Wraparound, Missing Release of Memory after Effective Lifetime, Double
Free, Improper Validation of Specified Quantity in Input, Uncontrolled
Resource Consumption, Incorrect Comparison, Out-of-bounds Read, Incorrect
Default Permissions, Improper Ownership Management, Injection, Type
Confusion, Inefficient Algorithmic Complexity, NULL Pointer Dereference,
HTTP Request/Response Splitting, Allocation of Resources Without Limits or
Throttling, Improper Validation of Integrity Check Value, Observable
Discrepancy, Improper Locking, Incorrect Calculation of Buffer Size,
Incorrect Authorization, Improper Removal of Sensitive Information Before
Storage or Transfer, Unchecked Return Value, Race Condition, Link
Following, Classic Buffer Overflow, Improper Check for Unusual or
Exceptional Conditions, Path Traversal, Code Injection, Use of
Uninitialized Resource, Cross-site Scripting, Exposure of Resource to Wrong
Sphere, Improper Encoding or Escaping of Output, Interpretation Conflict,
Use of Insufficiently Random Values, Buffer Underflow, Divide By Zero,
Insufficiently Protected Credentials, Access of Uninitialized Pointer,
Inefficient Regular Expression Complexity, OS Command Injection,
Insufficient Verification of Data Authenticity
2. RISK EVALUATION
Successful exploitation of these vulnerabilities could affect confidentiality,
integrity, or system availability.
3. TECHNICAL DETAILS
3.1 AFFECTED PRODUCTS
Siemens reports that the following versions of SCALANCE XCM-/XRM-300, switches
used to connect industrial components, are affected:
o SCALANCE XCH328 (6GK5328-4TS01-2EC2): versions prior to V2.4
o SCALANCE XCM324 (6GK5324-8TS01-2AC2): versions prior to V2.4
o SCALANCE XCM328 (6GK5328-4TS01-2AC2): versions prior to V2.4
o SCALANCE XCM332 (6GK5332-0GA01-2AC2): versions prior to V2.4
o SCALANCE XRH334 (24 V DC, 8xFO, CC) (6GK5334-2TS01-2ER3): versions prior to
V2.4
o SCALANCE XRM334 (2x230 V AC, 8xFO) (6GK5334-2TS01-4AR3): versions prior to
V2.4
o SCALANCE XRM334 (2x230 V AC, 12xFO) (6GK5334-3TS01-4AR3): versions prior to
V2.4
o SCALANCE XRM334 (24 V DC, 8xFO) (6GK5334-2TS01-2AR3): versions prior to
V2.4
o SCALANCE XRM334 (24 V DC, 12xFO) (6GK5334-3TS01-2AR3): versions prior to
V2.4
o SCALANCE XRM334 (230 V AC, 8xFO) (6GK5334-2TS01-3AR3): versions prior to
V2.4
o SCALANCE XRM334 (230 V AC, 12xFO) (6GK5334-3TS01-3AR3): versions prior to
V2.4
3.2 Vulnerability Overview
3.2.1 OUT-OF-BOUNDS WRITE CWE-787
A carefully crafted If: request header can cause a memory read or write of a
single zero byte, in a pool (heap) memory location beyond the header value
sent. This could cause the process to crash. This issue affects Apache HTTP
Server 2.4.54 and earlier.
CVE-2006-20001 has been assigned to this vulnerability. A CVSS v3 base score of
7.5 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:L/PR:N/
UI:N/S:U/C:N/I:N/A:H ).
3.2.2 INCORRECT TYPE CONVERSION OR CAST CWE-704
A flaw was found in python. In algorithms with quadratic time complexity using
non-binary bases, when using int("text"), a system could take 50ms to parse an
int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal,
int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not
affected). The highest threat from this vulnerability is to system
availability.
CVE-2020-10735 has been assigned to this vulnerability. A CVSS v3 base score of
7.5 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:L/PR:N/
UI:N/S:U/C:N/I:N/A:H ).
3.2.3 IMPROPER VERIFICATION OF CRYPTOGRAPHIC SIGNATURE CWE-347
A flaw was found in libdnf's signature verification functionality in versions
before 0.60.1. This flaw allows an attacker to achieve code execution if they
can alter the header information of an RPM package and then trick a user or
system into installing it. The highest risk of this vulnerability is to
confidentiality, integrity, as well as system availability.
CVE-2021-3445 has been assigned to this vulnerability. A CVSS v3 base score of
7.5 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:H/PR:N/
UI:R/S:U/C:H/I:H/A:H ).
3.2.4 OUT-OF-BOUNDS WRITE CWE-787
An out-of-bounds memory access flaw was found in the ATI VGA device emulation
of QEMU. This flaw occurs in the ati_2d_blt() routine while handling MMIO write
operations when the guest provides invalid values for the destination display
parameters. A malicious guest could use this flaw to crash the QEMU process on
the host, resulting in a denial of service.
CVE-2021-3638 has been assigned to this vulnerability. A CVSS v3 base score of
6.5 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:L/PR:L/
UI:N/S:C/C:N/I:N/A:H ).
3.2.5 IMPROPER ACCESS CONTROL CWE-284
A vulnerability was found in the fs/inode.c:inode_init_owner() function logic
of the Linux kernel that allows local users to create files for the XFS
file-system with an unintended group ownership and with group execution and
SGID permission bits set, in a scenario where a directory is SGID and belongs
to a certain group and is writable by a user who is not a member of this group.
This can lead to excessive permissions granted in case when they should not.
This vulnerability is similar to the previous CVE-2018-13405 and adds the
missed fix for the XFS.
CVE-2021-4037 has been assigned to this vulnerability. A CVSS v3 base score of
7.8 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:L/PR:L/
UI:N/S:U/C:H/I:H/A:H ).
3.2.6 IMPROPER AUTHENTICATION CWE-287
An issue was discovered in Dropbear through 2020.81. It is possible for an SSH
server to change the login process in its favor due to a non-RFC-compliant
check of the available authentication methods in the client-side SSH code. This
attack can bypass additional security measures such as FIDO2 tokens or
SSH-Askpass. Thus, it allows an attacker to abuse a forwarded agent for logging
on to another server unnoticed.
CVE-2021-36369 has been assigned to this vulnerability. A CVSS v3 base score of
7.5 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:L/PR:N/
UI:N/S:U/C:N/I:H/A:N ).
3.2.7 MISSING ENCRYPTION OF SENSITIVE DATA CWE-311
A denial of service vulnerability exists in mbed TLS 3.0.0 and earlier in the
mbedtls_pkcs12_derivation function when an input password's length is 0.
CVE-2021-43666 has been assigned to this vulnerability. A CVSS v3 base score of
7.5 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:L/PR:N/
UI:N/S:U/C:N/I:N/A:H ).
3.2.8 USE OF A BROKEN OR RISKY CRYPTOGRAPHIC ALGORITHM CWE-327
In Mbed TLS before 3.1.0, psa_aead_generate_nonce allows policy bypass or
oracle-based decryption when the output buffer is at memory locations
accessible to an untrusted application.
CVE-2021-45451 has been assigned to this vulnerability. A CVSS v3 base score of
7.5 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:L/PR:N/
UI:N/S:U/C:H/I:N/A:N ).
3.2.9 OUT-OF-BOUNDS WRITE CWE-787
There is a flaw in the Linux kernel in linux/net/netfilter/nf_tables_api.c of
the netfilter subsystem. This flaw allows a local user to cause an
out-of-bounds write issue.
CVE-2022-1015 has been assigned to this vulnerability. A CVSS v3 base score of
6.6 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:L/PR:L/
UI:N/S:U/C:L/I:L/A:H ).
3.2.10 INCORRECT PERMISSION ASSIGNMENT FOR CRITICAL RESOURCE CWE-732
There is a vulnerability in the way the state file is created in logrotate. The
state file is used to prevent parallel executions of multiple instances of
logrotate by acquiring and releasing a file lock. When the state file does not
exist, it is created with world-readable permission, allowing an unprivileged
user to lock the state file, stopping any rotation. This flaw affects logrotate
versions before 3.20.0.
CVE-2022-1348 has been assigned to this vulnerability. A CVSS v3 base score of
6.5 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:L/PR:L/
UI:N/S:U/C:N/I:N/A:H ).
3.2.11 USE AFTER FREE CWE-416
A use-after-free flaw was found in nf_tables cross-table in the net/netfilter/
nf_tables_api.c function in the Linux kernel. This flaw allows a local,
privileged attacker to cause a use-after-free problem at the time of table
deletion, possibly leading to local privilege escalation.
CVE-2022-2586 has been assigned to this vulnerability. A CVSS v3 base score of
6.7 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:L/PR:H/
UI:N/S:U/C:H/I:H/A:H ).
3.2.12 INCONSISTENT INTERPRETATION OF HTTP REQUESTS ('HTTP REQUEST/RESPONSE
SMUGGLING') CWE-444
Requests forwarded by ReverseProxy include raw query parameters from the
inbound request, including unparsable parameters rejected by net/http. This
could permit query parameter smuggling when a Go proxy forwards a parameter
with an unparsable value. Once the fix is applied, ReverseProxy sanitizes the
query parameters in the forwarded query when the outbound request's Form field
is set after the ReverseProxy. Director function returns, indicating that the
proxy has parsed the query parameters. Proxies which do not parse query
parameters continue to forward the original query parameters unchanged.
CVE-2022-2880 has been assigned to this vulnerability. A CVSS v3 base score of
7.5 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:L/PR:N/
UI:N/S:U/C:N/I:H/A:N ).
3.2.13 IMPROPER INPUT VALIDATION CWE-20
Users may have access to secure endpoints in the control plane network.
Kubernetes clusters are only affected if an untrusted user can modify Node
objects and send proxy requests to them. Kubernetes supports node proxying,
which allows clients of kube-apiserver to access endpoints of a Kubelet to
establish connections to Pods, retrieve container logs, and more. While
Kubernetes already validates the proxying address for Nodes, a bug in
kube-apiserver made it possible to bypass this validation. Bypassing this
validation could allow authenticated requests destined for Nodes to to the API
server's private network.
CVE-2022-3294 has been assigned to this vulnerability. A CVSS v3 base score of
6.6 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:H/PR:H/
UI:N/S:U/C:H/I:H/A:H ).
3.2.14 HEAP-BASED BUFFER OVERFLOW CWE-122
A heap-based buffer overflow vulnerability was found in Samba within the GSSAPI
unwrap_des() and unwrap_des3() routines of Heimdal. The DES and Triple-DES
decryption routines in the Heimdal GSSAPI library allow a length-limited write
buffer overflow on malloc() allocated memory when presented with a maliciously
small packet. This flaw allows a remote user to send specially crafted
malicious data to the application, possibly resulting in a denial-of-service
attack.
CVE-2022-3437 has been assigned to this vulnerability. A CVSS v3 base score of
6.5 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:L/PR:L/
UI:N/S:U/C:N/I:N/A:H ).
3.2.15 INTEGER OVERFLOW OR WRAPAROUND CWE-190
A vulnerability was found in the Libksba library due to an integer overflow
within the CRL parser. The vulnerability can be exploited remotely for code
execution on the target system by passing specially crafted data to the
application.
CVE-2022-3515 has been assigned to this vulnerability. A CVSS v3 base score of
9.8 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:L/PR:N/
UI:N/S:U/C:H/I:H/A:H ).
3.2.16 MISSING ENCRYPTION OF SENSITIVE DATA CWE-311
A vulnerability was found in systemd. This security flaw can cause a local
information leak due to systemd-coredump not respecting the fs.suid_dumpable
kernel setting.
CVE-2022-4415 has been assigned to this vulnerability. A CVSS v3 base score of
5.5 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:L/PR:L/
UI:N/S:U/C:H/I:N/A:N ).
3.2.17 MISSING RELEASE OF MEMORY AFTER EFFECTIVE LIFETIME CWE-401
A potential memory leak issue was discovered in SDL2 in GLES_CreateTexture()
function in SDL_render_gles.c. The vulnerability allows an attacker to cause a
denial-of-service attack. The vulnerability affects SDL2 v2.0.4 and above.
SDL-1.x are not affected.
CVE-2022-4743 has been assigned to this vulnerability. A CVSS v3 base score of
7.5 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:L/PR:N/
UI:N/S:U/C:N/I:N/A:H ).
3.2.18 DOUBLE FREE CWE-415
A double-free flaw was found in the Linux kernel's TUN/TAP device driver
functionality in how a user registers the device when the register_netdevice
function fails (NETDEV_REGISTER notifier). This flaw allows a local user to
crash or potentially escalate their privileges on the system.
CVE-2022-4744 has been assigned to this vulnerability. A CVSS v3 base score of
7.8 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:L/PR:L/
UI:N/S:U/C:H/I:H/A:H ).
3.2.19 OUT-OF-BOUNDS WRITE CWE-787
A vulnerability was found in PHP where setting the environment variable
PHP_CLI_SERVER_WORKERS to a large value leads to a heap buffer overflow.
CVE-2022-4900 has been assigned to this vulnerability. A CVSS v3 base score of
5.5 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:L/PR:L/
UI:N/S:U/C:N/I:N/A:H ).
3.2.20 IMPROPER VALIDATION OF SPECIFIED QUANTITY IN INPUT CWE-1284
A flaw was found in the c-ares package. The ares_set_sortlist is missing checks
for the validity of the input string, which allows a possible arbitrary length
stack overflow. This issue may cause a denial of service or a limited impact on
confidentiality and integrity.
CVE-2022-4904 has been assigned to this vulnerability. A CVSS v3 base score of
8.6 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:L/PR:N/
UI:N/S:U/C:L/I:L/A:H ).
3.2.21 UNCONTROLLED RESOURCE CONSUMPTION CWE-400
containerd is an open source container runtime. A bug was found in containerd's
CRI implementation where a user can exhaust memory on the host. In the CRI
stream server, a goroutine is launched to handle terminal resize events if a
TTY is requested. If the user's process fails to launch due to, for example, a
faulty command, the goroutine will be stuck waiting to send without a receiver,
resulting in a memory leak. Kubernetes and crictl can both be configured to use
containerd's CRI implementation and the stream server is used for handling
container IO. This bug has been fixed in containerd 1.6.12 and 1.5.16. Users
should update to these versions to resolve the issue. Users unable to upgrade
should ensure that only trusted images and commands are used and that only
trusted users have permissions to execute commands in running containers.
CVE-2022-23471 has been assigned to this vulnerability. A CVSS v3 base score of
5.7 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:L/PR:L/
UI:R/S:U/C:N/I:N/A:H ).
3.2.22 INTEGER OVERFLOW OR WRAPAROUND CWE-190
Git is distributed revision control system. gitattributes are a mechanism to
allow defining attributes for paths. These attributes can be defined by adding
a .gitattributes file to the repository, which contains a set of file patterns
and the attributes that should be set for paths matching this pattern. When
parsing gitattributes, multiple integer overflows can occur when there is a
huge number of path patterns, a huge number of attributes for a single pattern,
or when the declared attribute names are huge. These overflows can be triggered
via a crafted .gitattributes file that may be part of the commit history. Git
silently splits lines longer than 2KB when parsing gitattributes from a file,
but not when parsing them from the index. Consequentially, the failure mode
depends on whether the file exists in the working tree, the index or both. This
integer overflow can result in arbitrary heap reads and writes, which may
result in remote code execution. The problem has been patched in the versions
published on 2023-01-17, going back to v2.30.7. Users are advised to upgrade.
There are no known workarounds for this issue.
CVE-2022-23521 has been assigned to this vulnerability. A CVSS v3 base score of
9.8 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:L/PR:N/
UI:N/S:U/C:H/I:H/A:H ).
3.2.23 HEAP-BASED BUFFER OVERFLOW CWE-122
Redis is an in-memory database that persists on disk. A specially crafted Lua
script executing in Redis can trigger a heap overflow in the cjson library, and
result with heap corruption and potentially remote code execution. The problem
exists in all versions of Redis with Lua scripting support, starting from 2.6,
and affects only authenticated and authorized users. The problem is fixed in
versions 7.0.12, 6.2.13, and 6.0.20.
CVE-2022-24834 has been assigned to this vulnerability. A CVSS v3 base score of
7.0 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:H/PR:L/
UI:N/S:U/C:H/I:H/A:H ).
3.2.24 INCORRECT COMPARISON CWE-697
A logic issue was addressed with improved state management. This issue is fixed
in Security Update 2022-003 Catalina, macOS Monterey 12.3, macOS Big Sur
11.6.5. An application may be able to gain elevated privileges.
CVE-2022-26691 has been assigned to this vulnerability. A CVSS v3 base score of
6.7 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:L/PR:H/
UI:N/S:U/C:H/I:H/A:H ).
3.2.25 OUT-OF-BOUNDS WRITE CWE-787
There is a possible overflow in handle_image() when shim tries to load and
execute crafted EFI executables; The handle_image() function takes into account
the SizeOfRawData field from each section to be loaded. An attacker can
leverage this to perform out-of-bound writes to memory. Arbitrary code
execution is not discarded in such scenario.
CVE-2022-28737 has been assigned to this vulnerability. A CVSS v3 base score of
7.8 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:L/PR:N/
UI:R/S:U/C:H/I:H/A:H ).
3.2.26 DOUBLE FREE CWE-415
A double free was found in the Regexp compiler in Ruby 3.x before 3.0.4 and
3.1.x before 3.1.2. If a victim attempts to create a Regexp from untrusted user
input, an attacker may be able to write to unexpected memory locations.
CVE-2022-28738 has been assigned to this vulnerability. A CVSS v3 base score of
9.8 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:L/PR:N/
UI:N/S:U/C:H/I:H/A:H ).
3.2.27 OUT-OF-BOUNDS READ CWE-125
There is a buffer over read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x
before 3.0.4, and 3.1.x before 3.1.2. It occurs in string-to-float conversion,
including Kernel#Float and String#to_f.
CVE-2022-28739 has been assigned to this vulnerability. A CVSS v3 base score of
7.5 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:L/PR:N/
UI:N/S:U/C:H/I:N/A:N ).
3.2.28 IMPROPER INPUT VALIDATION CWE-20
An issue was discovered in rsync before 3.2.5 that allows malicious remote
servers to write arbitrary files inside the directories of connecting peers.
The server chooses which files or directories are sent to the client. However,
the rsync client performs insufficient validation of file names. A malicious
rsync server (or man-in-the-middle attacker) can overwrite arbitrary files in
the rsync client target directory and subdirectories (for example, overwrite
the .ssh/authorized_keys file).
CVE-2022-29154 has been assigned to this vulnerability. A CVSS v3 base score of
7.4 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:H/PR:N/
UI:N/S:U/C:N/I:H/A:H ).
3.2.29 INCORRECT DEFAULT PERMISSIONS CWE-276
runc is a CLI tool for spawning and running containers on Linux according to
the OCI specification. A bug was found in runc prior to version 1.1.2 where
runc exec --cap created processes with non-empty inheritable Linux process
capabilities, creating an atypical Linux environment and enabling programs with
inheritable file capabilities to elevate those capabilities to the permitted
set during execve(2). This bug did not affect the container security sandbox as
the inheritable set never contained more capabilities than were included in the
container's bounding set. This bug has been fixed in runc 1.1.2. This fix
changes runc exec --cap behavior such that the additional capabilities granted
to the process being executed (as specified via --caparguments) do not include
inheritable capabilities. In addition, runc spec is changed to not set any
inheritable capabilities in the created example OCI spec (config.json) file.
CVE-2022-29162 has been assigned to this vulnerability. A CVSS v3 base score of
5.9 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:L/PR:N/
UI:N/S:U/C:L/I:L/A:L ).
3.2.30 IMPROPER OWNERSHIP MANAGEMENT CWE-282
Git is a distributed revision control system. Git prior to versions 2.37.1,
2.36.2, 2.35.4, 2.34.4, 2.33.4, 2.32.3, 2.31.4, and 2.30.5, is vulnerable to
privilege escalation in all platforms. An unsuspecting user could still be
affected by the issue reported in CVE-2022-24765, for example when navigating
as root into a shared tmp directory that is owned by them, but where an
attacker could create a git repository. Versions 2.37.1, 2.36.2, 2.35.4,
2.34.4, 2.33.4, 2.32.3, 2.31.4, and 2.30.5 contain a patch for this issue. The
simplest way to avoid being affected by the exploit described in the example is
to avoid running git as root (or an administrator in Windows), and if needed to
reduce its use to a minimum. While a generic workaround is not possible, a
system could be hardened from the exploit described in the example by removing
any such repository if it exists already and creating one as root to block any
future attacks.
CVE-2022-29187 has been assigned to this vulnerability. A CVSS v3 base score of
7.8 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:L/PR:L/
UI:N/S:U/C:H/I:H/A:H ).
3.2.31 OUT-OF-BOUNDS WRITE CWE-787
In GNOME Epiphany before 41.4 and 42.x before 42.2, an HTML document can
trigger a client buffer overflow (in ephy_string_shorten in the UI process) via
a long page title. The issue occurs because the number of bytes for a UTF-8
ellipsis character is not properly considered.
CVE-2022-29536 has been assigned to this vulnerability. A CVSS v3 base score of
7.5 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:L/PR:N/
UI:N/S:U/C:N/I:N/A:H ).
3.2.32 MISSING ENCRYPTION OF SENSITIVE DATA CWE-311
Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go
1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a
Request.Header map containing a nil value for the X-Forwarded-For header, which
causes ReverseProxy to set the client IP as the value of the X-Forwarded-For
header.
CVE-2022-32148 has been assigned to this vulnerability. A CVSS v3 base score of
6.5 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:L/PR:N/
UI:N/S:U/C:L/I:L/A:N ).
3.2.33 IMPROPER NEUTRALIZATION OF SPECIAL ELEMENTS IN OUTPUT USED BY A
DOWNSTREAM COMPONENT ('INJECTION') CWE-74
GnuPG through 2.3.6, in unusual situations where an attacker possesses any
secret-key information from a victim's keyring and other constraints (e.g., use
of GPGME) are met, allows signature forgery via injection into the status line.
CVE-2022-34903 has been assigned to this vulnerability. A CVSS v3 base score of
6.5 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:H/PR:N/
UI:N/S:U/C:H/I:L/A:N ).
3.2.34 ACCESS OF RESOURCE USING INCOMPATIBLE TYPE ('TYPE CONFUSION') CWE-843
An issue was discovered in the Linux kernel through 5.18.9. A type confusion
bug in nft_set_elem_init (leading to a buffer overflow) could be used by a
local attacker to escalate privileges, a different vulnerability than
CVE-2022-32250. (The attacker can obtain root access, but must start with an
unprivileged user namespace to obtain CAP_NET_ADMIN access.) This can be fixed
in nft_setelem_parse_data in net/netfilter/nf_tables_api.c.
CVE-2022-34918 has been assigned to this vulnerability. A CVSS v3 base score of
7.8 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:L/PR:L/
UI:N/S:U/C:H/I:H/A:H ).
3.2.35 INEFFICIENT ALGORITHMIC COMPLEXITY CWE-407
Redis is an in-memory database that persists on disk. Authenticated users can
use string matching commands (like SCAN or KEYS) with a specially crafted
pattern to trigger a denial-of-service attack on Redis, causing it to hang and
consume 100% CPU time. The problem is fixed in Redis versions 6.0.18, 6.2.11,
7.0.9.
CVE-2022-36021 has been assigned to this vulnerability. A CVSS v3 base score of
5.5 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:L/PR:L/
UI:N/S:U/C:N/I:N/A:H ).
3.2.36 NULL POINTER DEREFERENCE CWE-476
In libarchive before 3.6.2, the software does not check for an error after
calling calloc function that can return with a NULL pointer if the function
fails, which leads to a resultant NULL pointer dereference. NOTE: the
discoverer cites this CWE-476 remark but third parties dispute the
code-execution impact: "In rare circumstances, when NULL is equivalent to the
0x0 memory address and privileged code can access it, then writing or reading
memory is possible, which may lead to code execution."
CVE-2022-36227 has been assigned to this vulnerability. A CVSS v3 base score of
9.8 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:L/PR:N/
UI:N/S:U/C:H/I:H/A:H ).
3.2.37 INCONSISTENT INTERPRETATION OF HTTP REQUESTS ('HTTP REQUEST/RESPONSE
SMUGGLING') CWE-444
Inconsistent interpretation of HTTP requests ('HTTP Request Smuggling')
vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to
smuggle requests to the AJP server it forwards requests to. This issue affects
Apache HTTP Server Apache HTTP Server 2.4 version 2.4.54 and prior versions.
CVE-2022-36760 has been assigned to this vulnerability. A CVSS v3 base score of
9.0 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:H/PR:N/
UI:N/S:C/C:H/I:H/A:H ).
3.2.38 IMPROPER NEUTRALIZATION OF CRLF SEQUENCES IN HTTP HEADERS ('HTTP REQUEST
/RESPONSE SPLITTING') CWE-113
Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response
headers to be truncated early, resulting in some headers being incorporated
into the response body. If the later headers have any security purpose, they
will not be interpreted by the client.
CVE-2022-37436 has been assigned to this vulnerability. A CVSS v3 base score of
5.3 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:L/PR:N/
UI:N/S:U/C:N/I:L/A:N ).
3.2.39 INTEGER OVERFLOW OR WRAPAROUND CWE-190
The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer
overflow and resultant buffer overflow that allows attackers to execute
arbitrary code or eliminate expected cryptographic properties. This occurs in
the sponge function interface.
CVE-2022-37454 has been assigned to this vulnerability. A CVSS v3 base score of
9.8 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:L/PR:N/
UI:N/S:U/C:H/I:H/A:H ).
3.2.40 NULL POINTER DEREFERENCE CWE-476
In lighttpd 1.4.65, mod_wstunnel does not initialize a handler function pointer
if an invalid HTTP request (websocket handshake) is received. It leads to null
pointer dereference which crashes the server. It could be used by an external
attacker to cause denial-of-service condition.
CVE-2022-37797 has been assigned to this vulnerability. A CVSS v3 base score of
7.5 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:L/PR:N/
UI:N/S:U/C:N/I:N/A:H ).
3.2.41 INTEGER OVERFLOW OR WRAPAROUND CWE-190
An integer overflow in the RFC3164 parser in One Identity syslog-ng 3.0 through
3.37 allows remote attackers to cause a denial of service via crafted syslog
input that is mishandled by the tcp or network function. syslog-ng Premium
Edition 7.0.30 and syslog-ng Store Box 6.10.0 are also affected.
CVE-2022-38725 has been assigned to this vulnerability. A CVSS v3 base score of
7.5 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:L/PR:N/
UI:N/S:U/C:N/I:N/A:H ).
3.2.42 MISSING ENCRYPTION OF SENSITIVE DATA CWE-311
An issue was discovered the x86 KVM subsystem in the Linux kernel before
5.18.17. Unprivileged guest users can compromise the guest kernel because TLB
flush operations are mishandled in certain KVM_VCPU_PREEMPTED situations.
CVE-2022-39189 has been assigned to this vulnerability. A CVSS v3 base score of
7.8 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:L/PR:L/
UI:N/S:U/C:H/I:H/A:H ).
3.2.43 OUT-OF-BOUNDS WRITE CWE-787
Git is an open source, scalable, distributed revision control system. git shell
is a restricted login shell that can be used to implement Git's push/pull
functionality via SSH. In versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5,
2.34.5, 2.35.5, 2.36.3, and 2.37.4, the function that splits the command
arguments into an array improperly uses an int to represent the number of
entries in the array, allowing a malicious actor to intentionally overflow the
return value, leading to arbitrary heap writes. Because the resulting array is
then passed to execv(), it is possible to leverage this attack to gain remote
code execution on a victim machine. Note that a victim must first allow access
to git shell as a login shell in order to be vulnerable to this attack. This
problem is patched in versions 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5,
2.36.3, and 2.37.4 and users are advised to upgrade to the latest version.
Disabling git shell access via remote logins is a viable short-term workaround.
CVE-2022-39260 has been assigned to this vulnerability. A CVSS v3 base score of
8.5 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:H/PR:L/
UI:N/S:C/C:H/I:H/A:H ).
3.2.44 INTEGER OVERFLOW OR WRAPAROUND CWE-190
An integer overflow vulnerability in pcre2test before 10.41 allows attackers to
cause a denial of service or other unspecified impacts via negative input.
CVE-2022-41409 has been assigned to this vulnerability. A CVSS v3 base score of
7.5 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:L/PR:N/
UI:N/S:U/C:N/I:N/A:H ).
3.2.45 MISSING RELEASE OF MEMORY AFTER EFFECTIVE LIFETIME CWE-401
A resource leak in gw_backend.c in lighttpd 1.4.56 through 1.4.66 could lead to
a denial of service (connection-slot exhaustion) after a large amount of
anomalous TCP behavior by clients. It is related to RDHUP mishandling in
certain HTTP/1.1 chunked situations. Use of mod_fastcgi is, for example,
affected. This is fixed in 1.4.67.
CVE-2022-41556 has been assigned to this vulnerability. A CVSS v3 base score of
7.5 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:L/PR:N/
UI:N/S:U/C:N/I:N/A:H ).
3.2.46 MISSING ENCRYPTION OF SENSITIVE DATA CWE-311
Programs which compile regular expressions from untrusted sources may be
vulnerable to memory exhaustion or denial of service. The parsed regexp
representation is linear in the size of the input, but in some cases the
constant factor can be as high as 40,000, making relatively small regexps
consume much larger amounts of memory. After fix, each regexp being parsed is
limited to a 256 MB memory footprint. Regular expressions whose representation
would use more space than that are rejected. Normal use of regular expressions
is unaffected.
CVE-2022-41715 has been assigned to this vulnerability. A CVSS v3 base score of
7.5 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:L/PR:N/
UI:N/S:U/C:N/I:N/A:H ).
3.2.47 ALLOCATION OF RESOURCES WITHOUT LIMITS OR THROTTLING CWE-770
An attacker can cause excessive memory growth in a Go server accepting HTTP/2
requests. HTTP/2 server connections contain a cache of HTTP header keys sent by
the client. While the total number of entries in this cache is capped, an
attacker sending very large keys can cause the server to allocate approximately
64 MiB per open connection.
CVE-2022-41717 has been assigned to this vulnerability. A CVSS v3 base score of
5.3 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:L/PR:N/
UI:N/S:U/C:N/I:N/A:L ).
3.2.48 MISSING ENCRYPTION OF SENSITIVE DATA CWE-311
A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in
the HPACK decoder, sufficient to cause a denial of service from a small number
of small requests.
CVE-2022-41723 has been assigned to this vulnerability. A CVSS v3 base score of
7.5 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:L/PR:N/
UI:N/S:U/C:N/I:N/A:H ).
3.2.49 NULL POINTER DEREFERENCE CWE-476
In freeradius, when an EAP-SIM supplicant sends an unknown SIM option, the
server will try to look that option up in the internal dictionaries. This
lookup will fail, but the SIM code will not check for that failure. Instead, it
will dereference a NULL pointer, and cause the server to crash.
CVE-2022-41860 has been assigned to this vulnerability. A CVSS v3 base score of
7.5 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:L/PR:N/
UI:N/S:U/C:N/I:N/A:H ).
3.2.50 IMPROPER INPUT VALIDATION CWE-20
A flaw was found in freeradius. A malicious RADIUS client or home server can
send a malformed binary attribute which can cause the server to crash.
CVE-2022-41861 has been assigned to this vulnerability. A CVSS v3 base score of
6.5 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:L/PR:L/
UI:N/S:U/C:N/I:N/A:H ).
3.2.51 MISSING ENCRYPTION OF SENSITIVE DATA CWE-311
In PostgreSQL, a modified, unauthenticated server can send an unterminated
string during the establishment of Kerberos transport encryption. In certain
conditions a server can cause a libpq client to over-read and report an error
message containing uninitialized bytes.
CVE-2022-41862 has been assigned to this vulnerability. A CVSS v3 base score of
3.7 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:H/PR:N/
UI:N/S:U/C:L/I:N/A:N ).
3.2.52 INTEGER OVERFLOW OR WRAPAROUND CWE-190
Git is distributed revision control system. git log can display commits in an
arbitrary format using its --format specifiers. This functionality is also
exposed to git archive via the export-subst gitattribute. When processing the
padding operators, there is a integer overflow in
pretty.c::format_and_pad_commit() where a size_t is stored improperly as an
int, and then added as an offset to a memcpy(). This overflow can be triggered
directly by a user running a command which invokes the commit formatting
machinery (e.g., git log --format=...). It may also be triggered indirectly
through git archive via the export-subst mechanism, which expands format
specifiers inside of files within the repository during a git archive. This
integer overflow can result in arbitrary heap writes, which may result in
arbitrary code execution. The problem has been patched in the versions
published on 2023-01-17, going back to v2.30.7. Users are advised to upgrade.
Users who are unable to upgrade should disable git archive in untrusted
repositories. If you expose git archive via git daemon, disable it by running
git config --global daemon.uploadArch false.
CVE-2022-41903 has been assigned to this vulnerability. A CVSS v3 base score of
9.8 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:L/PR:N/
UI:N/S:U/C:H/I:H/A:H ).
3.2.53 MISSING ENCRYPTION OF SENSITIVE DATA CWE-311
Python 3.9.x before 3.9.16 and 3.10.x before 3.10.9 on Linux allows local
privilege escalation in a non-default configuration. The Python multiprocessing
library, when used with the forkserver start method on Linux, allows pickles to
be deserialized from any user in the same machine local network namespace,
which in many system configurations means any user on the same machine. Pickles
can execute arbitrary code. Thus, this allows for local user privilege
escalation that any forkserver process is running as. Setting
multiprocessing.util.abstract_sockets_supported to False is a workaround. The
forkserver start method for multiprocessing is not the default start method.
This issue is Linux specific because only Linux supports abstract namespace
sockets. CPython before 3.9 does not make use of Linux abstract namespace
sockets by default. Support for users manually specifying an abstract namespace
socket was added as a bugfix in 3.7.8 and 3.8.3, but users would need to make
specific uncommon API calls in order to do that in CPython before 3.9.
CVE-2022-42919 has been assigned to this vulnerability. A CVSS v3 base score of
7.8 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:L/PR:L/
UI:N/S:U/C:H/I:H/A:H ).
3.2.54 OUT-OF-BOUNDS WRITE CWE-787
NASM v2.16 was discovered to contain a heap buffer overflow in the component
quote_for_pmake() asm/nasm.c:856
CVE-2022-44370 has been assigned to this vulnerability. A CVSS v3 base score of
7.8 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:L/PR:N/
UI:R/S:U/C:H/I:H/A:H ).
3.2.55 INEFFICIENT ALGORITHMIC COMPLEXITY CWE-407
An issue was discovered in Python before 3.11.1. An unnecessary quadratic
algorithm exists in one path when processing some inputs to the IDNA (RFC 3490)
decoder, such that a crafted, unreasonably long name being presented to the
decoder could lead to a CPU denial of service. Hostnames are often supplied by
remote servers that could be controlled by a malicious actor; in such a
scenario, they could trigger excessive CPU consumption on the client attempting
to make use of an attacker-supplied supposed hostname. For example, the attack
payload could be placed in the Location header of an HTTP response with status
code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16.
CVE-2022-45061 has been assigned to this vulnerability. A CVSS v3 base score of
7.5 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:L/PR:N/
UI:N/S:U/C:N/I:N/A:H ).
3.2.56 IMPROPER VALIDATION OF INTEGRITY CHECK VALUE CWE-354
The fix for CVE-2022-3437 included changing memcmp to be constant time and a
workaround for a compiler bug by adding "!= 0" comparisons to the result of
memcmp. When these patches were backported to the heimdal-7.7.1 and
heimdal-7.8.0 branches (and possibly other branches) a logic inversion sneaked
in causing the validation of message integrity codes in gssapi/arcfour to be
inverted.
CVE-2022-45142 has been assigned to this vulnerability. A CVSS v3 base score of
7.5 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:L/PR:N/
UI:N/S:U/C:N/I:H/A:N ).
3.2.57 USE AFTER FREE CWE-416
An issue was discovered in the Linux kernel through 6.0.10. In drivers/media/
dvb-core/dvb_ca_en50221.c, a use-after-free can occur is there is a disconnect
after an open, because of the lack of a wait_event.
CVE-2022-45919 has been assigned to this vulnerability. A CVSS v3 base score of
7.0 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:H/PR:L/
UI:N/S:U/C:H/I:H/A:H ).
3.2.58 OBSERVABLE DISCREPANCY CWE-203
An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. An
adversary with access to precise enough information about memory accesses
(typically, an untrusted operating system attacking a secure enclave) can
recover an RSA private key after observing the victim performing a single
private-key operation, if the window size (MBEDTLS_MPI_WINDOW_SIZE) used for
the exponentiation is 3 or smaller.
CVE-2022-46392 has been assigned to this vulnerability. A CVSS v3 base score of
5.3 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:H/PR:N/
UI:R/S:U/C:H/I:N/A:N ).
3.2.59 OUT-OF-BOUNDS READ CWE-125
An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. There
is a potential heap-based buffer overflow and heap-based buffer over-read in
DTLS if MBEDTLS_SSL_DTLS_CONNECTION_ID is enabled and
MBEDTLS_SSL_CID_IN_LEN_MAX > 2 * MBEDTLS_SSL_CID_OUT_LEN_MAX.
CVE-2022-46393 has been assigned to this vulnerability. A CVSS v3 base score of
9.8 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:L/PR:N/
UI:N/S:U/C:H/I:H/A:H ).
3.2.60 INTEGER OVERFLOW OR WRAPAROUND CWE-190
Libksba before 1.6.3 is prone to an integer overflow vulnerability in the CRL
signature parser.
CVE-2022-47629 has been assigned to this vulnerability. A CVSS v3 base score of
9.8 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:L/PR:N/
UI:N/S:U/C:H/I:H/A:H ).
3.2.61 OUT-OF-BOUNDS READ CWE-125
GNU Tar through 1.34 has a one-byte, out-of-bounds read that results in use of
uninitialized memory for a conditional jump. Exploitation to change the flow of
control has not been demonstrated. The issue occurs in from_header in list.c
via a V7 archive in which mtime has approximately 11 whitespace characters.
CVE-2022-48303 has been assigned to this vulnerability. A CVSS v3 base score of
5.5 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:L/PR:N/
UI:R/S:U/C:N/I:N/A:H ).
3.2.62 USE AFTER FREE CWE-416
libavcodec/pthread_frame.c in FFmpeg before 5.1.2, as used in VLC and other
products, leaves stale hwaccel state in worker threads, which allows attackers
to trigger a use-after-free and execute arbitrary code in some circumstances
(e.g., hardware re-initialization upon a mid-video SPS change when Direct3D11
is used).
CVE-2022-48434 has been assigned to this vulnerability. A CVSS v3 base score of
8.1 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:H/PR:N/
UI:N/S:U/C:H/I:H/A:H ).
3.2.63 IMPROPER LOCKING CWE-667
A deadlock flaw was found in the Linux kernel's BPF subsystem. This flaw allows
a local user to potentially crash the system.
CVE-2023-0160 has been assigned to this vulnerability. A CVSS v3 base score of
5.5 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:L/PR:L/
UI:N/S:U/C:N/I:N/A:H ).
3.2.64 OUT-OF-BOUNDS WRITE CWE-787
A vulnerability in the lsi53c895a device affects the latest version of qemu. A
DMA-MMIO reentrancy problem may lead to memory corruption bugs like stack
overflow or use-after-free.
CVE-2023-0330 has been assigned to this vulnerability. A CVSS v3 base score of
6.0 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:L/PR:H/
UI:N/S:C/C:N/I:N/A:H ).
3.2.65 OBSERVABLE DISCREPANCY CWE-203
A timing side channel in the handling of RSA ClientKeyExchange messages was
discovered in GnuTLS. This side channel can be sufficient to recover the key
encrypted in the RSA ciphertext across a network in a Bleichenbacher style
attack. To achieve a successful decryption the attacker would need to send a
large amount of specially crafted messages to the vulnerable server. By
recovering the secret from the ClientKeyExchange message, the attacker would be
able to decrypt the application data exchanged over that connection.
CVE-2023-0361 has been assigned to this vulnerability. A CVSS v3 base score of
7.4 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:H/PR:N/
UI:N/S:U/C:H/I:H/A:N ).
3.2.66 USE AFTER FREE CWE-416
A vulnerability was found in X.Org. This issue occurs due to a dangling pointer
in DeepCopyPointerClasses that can be exploited by ProcXkbSetDeviceInfo() and
ProcXkbGetDeviceInfo() to read and write into freed memory. This can lead to
local privilege elevation on systems where the X server runs privileged and
remote code execution for ssh X forwarding sessions.
CVE-2023-0494 has been assigned to this vulnerability. A CVSS v3 base score of
7.8 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:L/PR:L/
UI:N/S:U/C:H/I:H/A:H ).
3.2.67 IMPROPER INPUT VALIDATION CWE-20
In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3,
password_verify() function may accept some invalid Blowfish hashes as valid. If
such invalid hash ever ends up in the password database, it may lead to an
application allowing any password for this entry as valid.
CVE-2023-0567 has been assigned to this vulnerability. A CVSS v3 base score of
7.7 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:L/PR:N/
UI:N/S:U/C:H/I:H/A:N ).
3.2.68 INCORRECT CALCULATION OF BUFFER SIZE CWE-131
In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, core
path resolution function allocate buffer one byte too small. When resolving
paths with lengths close to system MAXPATHLEN setting, this may lead to the
byte after the allocated buffer being overwritten with NUL value, which might
lead to unauthorized data access or modification.
CVE-2023-0568 has been assigned to this vulnerability. A CVSS v3 base score of
7.5 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:H/PR:N/
UI:R/S:U/C:H/I:H/A:H ).
3.2.69 USE AFTER FREE CWE-416
A use-after-free flaw was found in qdisc_graft in net/sched/sch_api.c in the
Linux kernel due to a race problem. This flaw leads to a denial-of-service
issue. If patch ebda44da44f6 ("net: sched: fix race condition in qdisc_graft()
") not applied yet, then kernel could be affected.
CVE-2023-0590 has been assigned to this vulnerability. A CVSS v3 base score of
4.7 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:H/PR:L/
UI:N/S:U/C:N/I:N/A:H ).
3.2.70 UNCONTROLLED RESOURCE CONSUMPTION CWE-400
In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3,
excessive number of parts in HTTP form upload can cause high resource
consumption and excessive number of log entries. This can cause denial of
service on the affected server by exhausting CPU resources or disk space.
CVE-2023-0662 has been assigned to this vulnerability. A CVSS v3 base score of
7.5 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:L/PR:N/
UI:N/S:U/C:N/I:N/A:H ).
3.2.71 UNCONTROLLED RESOURCE CONSUMPTION CWE-400
A hash collision flaw was found in the IPv6 connection lookup table in the
Linux kernel's IPv6 functionality when a user makes a new kind of SYN flood
attack. A user located in the local network or with a high bandwidth connection
can increase the CPU usage of the server that accepts IPV6 connections up to
95%.
CVE-2023-1206 has been assigned to this vulnerability. A CVSS v3 base score of
5.7 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:A/AC:L/PR:L/
UI:N/S:U/C:N/I:N/A:H ).
3.2.72 OUT-OF-BOUNDS READ CWE-125
A slab-out-of-bounds read problem was found in brcmf_get_assoc_ies in drivers/
net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux kernel. This
issue could occur when assoc_info->req_len data is bigger than the size of the
buffer, defined as WL_EXTRA_BUF_MAX, leading to a denial of service.
CVE-2023-1380 has been assigned to this vulnerability. A CVSS v3 base score of
7.1 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:L/PR:L/
UI:N/S:U/C:H/I:N/A:H ).
3.2.73 USE AFTER FREE CWE-416
A flaw was found in X.Org Server Overlay Window. A use after free may lead to
local privilege escalation. If a client explicitly destroys the compositor
overlay window (aka COW), the Xserver would leave a dangling pointer to that
window in the CompScreen structure, which will trigger a use after free later.
CVE-2023-1393 has been assigned to this vulnerability. A CVSS v3 base score of
7.8 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:L/PR:L/
UI:N/S:U/C:H/I:H/A:H ).
3.2.74 USE AFTER FREE CWE-416
A use-after-free flaw was found in btrfs_search_slot in fs/btrfs/ctree.c in
btrfs in the Linux kernel.
CVE-2023-1611 has been assigned to this vulnerability. A CVSS v3 base score of
6.3 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:H/PR:L/
UI:N/S:U/C:H/I:N/A:H ).
3.2.75 USE AFTER FREE CWE-416
A use-after-free flaw in the Linux kernel Xircom 16-bit PCMCIA (PC-card)
Ethernet driver was found. A local user could use this flaw to crash the system
or potentially escalate their privileges on the system.
CVE-2023-1670 has been assigned to this vulnerability. A CVSS v3 base score of
7.8 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:L/PR:L/
UI:N/S:U/C:H/I:H/A:H ).
3.2.76 USE AFTER FREE CWE-416
A use-after-free flaw was found in vhost_net_set_backend in drivers/vhost/net.c
in virtio network subcomponent in the Linux kernel due to a double fget. This
flaw could allow a local attacker to crash the system, and could even lead to a
kernel information leak problem.
CVE-2023-1838 has been assigned to this vulnerability. A CVSS v3 base score of
7.1 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:L/PR:L/
UI:N/S:U/C:H/I:N/A:H ).
3.2.77 USE AFTER FREE CWE-416
A use-after-free flaw was found in xgene_hwmon_remove in drivers/hwmon/
xgene-hwmon.c in the Hardware Monitoring Linux kernel Driver (xgene-hwmon).
This flaw could allow a local attacker to crash the system due to a race
problem. This vulnerability could even lead to a kernel information leak
problem.
CVE-2023-1855 has been assigned to this vulnerability. A CVSS v3 base score of
6.3 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:H/PR:L/
UI:N/S:U/C:H/I:N/A:H ).
3.2.78 USE AFTER FREE CWE-416
A use-after-free flaw was found in xen_9pfs_front_removet in net/9p/trans_xen.c
in Xen transport for 9pfs in the Linux kernel. This flaw could allow a local
attacker to crash the system due to a race problem, possibly leading to a
kernel information leak.
CVE-2023-1859 has been assigned to this vulnerability. A CVSS v3 base score of
4.7 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:H/PR:L/
UI:N/S:U/C:N/I:N/A:H ).
3.2.79 USE AFTER FREE CWE-416
A use-after-free flaw was found in btsdio_remove in drivers\bluetooth\btsdio.c
in the Linux kernel. In this flaw, a call to btsdio_remove with an unfinished
job may cause a race problem leading to a UAF on hdev devices.
CVE-2023-1989 has been assigned to this vulnerability. A CVSS v3 base score of
7.0 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:H/PR:L/
UI:N/S:U/C:H/I:H/A:H ).
3.2.80 USE AFTER FREE CWE-416
A use-after-free flaw was found in ndlc_remove in drivers/nfc/st-nci/ndlc.c in
the Linux kernel. This flaw could allow an attacker to crash the system due to
a race problem.
CVE-2023-1990 has been assigned to this vulnerability. A CVSS v3 base score of
4.7 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:H/PR:L/
UI:N/S:U/C:N/I:N/A:H ).
3.2.81 INCORRECT AUTHORIZATION CWE-863
A vulnerability was found in the HCI sockets implementation due to a missing
capability check in net/bluetooth/hci_sock.c in the Linux kernel. This flaw
allows an attacker to unauthorized execution of management commands,
compromising the confidentiality, integrity, and availability of Bluetooth
communication.
CVE-2023-2002 has been assigned to this vulnerability. A CVSS v3 base score of
6.8 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:A/AC:L/PR:L/
UI:N/S:U/C:L/I:L/A:H ).
3.2.82 OUT-OF-BOUNDS WRITE CWE-787
An out-of-bounds memory access flaw was found in the Linux kernel's XFS file
system in how a user restores an XFS image after failure (with a dirty log
journal). This flaw allows a local user to crash or potentially escalate their
privileges on the system.
CVE-2023-2124 has been assigned to this vulnerability. A CVSS v3 base score of
7.8 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:L/PR:L/
UI:N/S:U/C:H/I:H/A:H ).
3.2.83 OUT-OF-BOUNDS WRITE CWE-787
An out-of-bounds write vulnerability was found in the Linux kernel's SLIMpro
I2C device driver. The userspace "data->block[0]" variable was not capped to a
number between 0-255 and was used as the size of a memcpy, possibly writing
beyond the end of dma_buffer. This flaw could allow a local privileged user to
crash the system or potentially achieve code execution.
CVE-2023-2194 has been assigned to this vulnerability. A CVSS v3 base score of
6.7 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:L/PR:H/
UI:N/S:U/C:H/I:H/A:H ).
3.2.84 IMPROPER LOCKING CWE-667
A denial-of-service problem was found, due to a possible recursive locking
scenario, resulting in a deadlock in table_clear in drivers/md/dm-ioctl.c in
the Linux kernel Device Mapper-Multipathing sub-component.
CVE-2023-2269 has been assigned to this vulnerability. A CVSS v3 base score of
4.4 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:L/PR:H/
UI:N/S:U/C:N/I:N/A:H ).
3.2.85 MISSING ENCRYPTION OF SENSITIVE DATA CWE-311
A flaw was found in the 9p passthrough filesystem (9pfs) implementation in
QEMU. The 9pfs server did not prohibit opening special files on the host side,
potentially allowing a malicious client to escape from the exported 9p tree by
creating and opening a device file in the shared folder.
CVE-2023-2861 has been assigned to this vulnerability. A CVSS v3 base score of
7.1 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:L/PR:L/
UI:N/S:U/C:H/I:H/A:N ).
3.2.86 NULL POINTER DEREFERENCE CWE-476
A vulnerability was found in openldap. This security flaw causes a null pointer
dereference in ber_memalloc_x() function.
CVE-2023-2953 has been assigned to this vulnerability. A CVSS v3 base score of
7.5 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:L/PR:N/
UI:N/S:U/C:N/I:N/A:H ).
3.2.87 IMPROPER REMOVAL OF SENSITIVE INFORMATION BEFORE STORAGE OR TRANSFER
CWE-212
A known cache speculation vulnerability, known as branch history injection
(BHI) or Spectre-BHB, becomes actual again for the new hw AmpereOne.
Spectre-BHB is similar to Spectre v2, except that malicious code uses the
shared branch history (stored in the CPU Branch History Buffer, or BHB) to
influence mispredicted branches within the victim's hardware context. Once that
occurs, speculation caused by mispredicted branches can cause cache allocation.
This issue leads to obtaining information that should not be accessible.
CVE-2023-3006 has been assigned to this vulnerability. A CVSS v3 base score of
5.5 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:L/PR:L/
UI:N/S:U/C:H/I:N/A:N ).
3.2.88 OUT-OF-BOUNDS WRITE CWE-787
A heap out-of-bounds write vulnerability in the Linux kernel ipvlan network
driver can be exploited to achieve local privilege escalation.The out-of-bounds
write is caused by missing skb->cb initialization in the ipvlan network driver.
The vulnerability is reachable if CONFIG_IPVLAN is enabled.
CVE-2023-3090 has been assigned to this vulnerability. A CVSS v3 base score of
7.8 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:L/PR:L/
UI:N/S:U/C:H/I:H/A:H ).
3.2.89 USE AFTER FREE CWE-416
A use-after-free vulnerability was found in prepare_to_relocate in fs/btrfs/
relocation.c in btrfs in the Linux kernel. This possible flaw can be triggered
by calling btrfs_ioctl_balance() before calling btrfs_ioctl_defrag().
CVE-2023-3111 has been assigned to this vulnerability. A CVSS v3 base score of
7.8 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:L/PR:L/
UI:N/S:U/C:H/I:H/A:H ).
3.2.90 USE AFTER FREE CWE-416
A use-after-free flaw was found in r592_remove in drivers/memstick/host/r592.c
in media access in the Linux kernel. This flaw allows a local attacker to crash
the system at device disconnect, possibly leading to a kernel information leak.
CVE-2023-3141 has been assigned to this vulnerability. A CVSS v3 base score of
7.1 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:L/PR:L/
UI:N/S:U/C:H/I:N/A:H ).
3.2.91 NULL POINTER DEREFERENCE CWE-476
A NULL pointer dereference issue was found in the gfs2 file system in the Linux
kernel. It occurs on corrupt gfs2 file systems when the evict code tries to
reference the journal descriptor structure after it has been freed and set to
NULL. A privileged local user could use this flaw to cause a kernel panic.
CVE-2023-3212 has been assigned to this vulnerability. A CVSS v3 base score of
4.4 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:L/PR:H/
UI:N/S:U/C:N/I:N/A:H ).
3.2.92 UNCHECKED RETURN VALUE CWE-252
In PHP versions 8.0.* before 8.0.29, 8.1.* before 8.1.20, 8.2.* before 8.2.7
when using SOAP HTTP digest authentication, random value generator was not
checked for failure, and was using narrower range of values than it should
have. In case of random generator failure, it could lead to a disclosure of 31
bits of uninitialized memory from the client to the server, and it also made it
easier for a malicious server to guess the client's nonce.
CVE-2023-3247 has been assigned to this vulnerability. A CVSS v3 base score of
2.6 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:H/PR:L/
UI:R/S:U/C:L/I:N/A:N ).
3.2.93 OUT-OF-BOUNDS READ CWE-125
An out-of-bounds memory access flaw was found in the Linux kernel in
relay_file_read_start_pos in kernel/relay.c in the relayfs. This flaw could
allow a local attacker to crash the system or leak kernel internal information.
CVE-2023-3268 has been assigned to this vulnerability. A CVSS v3 base score of
7.1 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:L/PR:L/
UI:N/S:U/C:H/I:N/A:H ).
3.2.94 CONCURRENT EXECUTION USING SHARED RESOURCE WITH IMPROPER SYNCHRONIZATION
('RACE CONDITION') CWE-362
A flaw was found in QEMU. The async nature of hot-unplug enables a race
scenario where the net device backend is cleared before the virtio-net pci
frontend has been unplugged. A malicious guest could use this time window to
trigger an assertion and cause a denial of service.
CVE-2023-3301 has been assigned to this vulnerability. A CVSS v3 base score of
5.6 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:H/PR:L/
UI:N/S:C/C:N/I:N/A:H ).
3.2.95 NULL POINTER DEREFERENCE CWE-476
A NULL pointer dereference in TIFFClose() is caused by a failure to open an
output file (non-existent path or a path that requires permissions like /dev/
null) while specifying zones.
CVE-2023-3316 has been assigned to this vulnerability. A CVSS v3 base score of
5.9 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:H/PR:N/
UI:N/S:U/C:N/I:N/A:H ).
3.2.96 USE AFTER FREE CWE-416
A use-after-free vulnerability was found in the Linux kernel's netfilter
subsystem in net/netfilter/nf_tables_api.c.Mishandled error handling with
NFT_MSG_NEWRULE makes it possible to use a dangling pointer in the same
transaction causing a use-after-free vulnerability. This flaw allows a local
attacker with user access to cause a privilege escalation issue.
CVE-2023-3390 has been assigned to this vulnerability. A CVSS v3 base score of
7.8 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:L/PR:L/
UI:N/S:U/C:H/I:H/A:H ).
3.2.97 OUT-OF-BOUNDS WRITE CWE-787
An out-of-bounds write vulnerability in the Linux kernel's net/sched: sch_qfq
component can be exploited to achieve local privilege escalation. The
qfq_change_agg() function in net/sched/sch_qfq.c allows an out-of-bounds write
because lmax is updated according to packet sizes without bounds checks.
CVE-2023-3611 has been assigned to this vulnerability. A CVSS v3 base score of
7.8 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:L/PR:L/
UI:N/S:U/C:H/I:H/A:H ).
3.2.98 USE AFTER FREE CWE-416
A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw
component can be exploited to achieve local privilege escalation. If
tcf_change_indev() fails, fw_set_parms() will immediately return an error after
incrementing or decrementing the reference counter in tcf_bind_filter(). If an
attacker can control the reference counter and set it to zero, they can cause
the reference to be freed, leading to a use-after-free vulnerability.
CVE-2023-3776 has been assigned to this vulnerability. A CVSS v3 base score of
7.8 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:L/PR:L/
UI:N/S:U/C:H/I:H/A:H ).
3.2.99 USE AFTER FREE CWE-416
A use-after-free flaw was found in nfc_llcp_find_local in net/nfc/llcp_core.c
in NFC in the Linux kernel. This flaw allows a local user with special
privileges to impact a kernel information leak issue.
CVE-2023-3863 has been assigned to this vulnerability. A CVSS v3 base score of
4.1 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:H/PR:H/
UI:N/S:U/C:H/I:N/A:N ).
3.2.100 USE AFTER FREE CWE-416
A use-after-free vulnerability in net/sched/cls_fw.c in classifiers (cls_fw,
cls_u32, and cls_route) in the Linux kernel allows a local attacker to perform
a local privilege escalation due to incorrect handling of the existing filter,
leading to a kernel information leak.
CVE-2023-4128 has been assigned to this vulnerability. A CVSS v3 base score of
7.8 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:L/PR:L/
UI:N/S:U/C:H/I:H/A:H ).
3.2.101 INCORRECT AUTHORIZATION CWE-863
A flaw was found in the Linux kernel's TUN/TAP functionality. This issue could
allow a local user to bypass network filters and gain unauthorized access to
some resources. The original patches fixing CVE-2023-1076 are incorrect or
incomplete. The problem is that the following upstream commits - a096ccca6e50
("tun: tun_chr_open(): correctly initialize socket uid"), - 66b2c338adce ("tap:
tap_open(): correctly initialize socket uid"), pass "inode->i_uid" to
sock_init_data_uid() as the last parameter and that is not accurate.
CVE-2023-4194 has been assigned to this vulnerability. A CVSS v3 base score of
5.5 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:L/PR:L/
UI:N/S:U/C:N/I:H/A:N ).
3.2.102 MISSING ENCRYPTION OF SENSITIVE DATA CWE-311
An issue in "Zen 2" CPUs, under specific microarchitectural circumstances, may
allow an attacker to potentially access sensitive information.
CVE-2023-20593 has been assigned to this vulnerability. A CVSS v3 base score of
5.5 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:L/PR:L/
UI:N/S:U/C:H/I:N/A:N ).
3.2.103 OUT-OF-BOUNDS WRITE CWE-787
In multiple functions of binder.c, there is a possible memory corruption due to
a use after free. This could lead to local escalation of privilege with no
additional execution privileges needed. User interaction is not needed for
exploitation.
CVE-2023-21255 has been assigned to this vulnerability. A CVSS v3 base score of
7.8 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:L/PR:L/
UI:N/S:U/C:H/I:H/A:H ).
3.2.104 IMPROPER LINK RESOLUTION BEFORE FILE ACCESS ('LINK FOLLOWING') CWE-59
Git is a revision control system. Using a specially-crafted repository, Git
prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7,
2.32.6, 2.31.7, and 2.30.8 can be tricked into using its local clone
optimization even when using a non-local transport. Though Git will abort local
clones whose source $GIT_DIR/objects directory contains symbolic links, the
objects directory itself may still be a symbolic link. These two may be
combined to include arbitrary files based on known paths on the victim's
filesystem within the malicious repository's working copy, allowing for data
exfiltration in a similar manner as CVE-2022-39253.A fix has been prepared and
will appear in v2.39.2 v2.38.4 v2.37.6 v2.36.5 v2.35.7 v2.34.7 v2.33.7 v2.32.6,
v2.31.7 and v2.30.8. If upgrading is impractical, two short-term workarounds
are available. Avoid cloning repositories from untrusted sources with
- --recurse-submodules. Instead, consider cloning repositories without
recursively cloning their submodules, and instead run git submodule update at
each layer. Before doing so, inspect each new .gitmodules file to ensure that
it does not contain suspicious module URLs.
CVE-2023-22490 has been assigned to this vulnerability. A CVSS v3 base score of
5.5 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:L/PR:N/
UI:R/S:U/C:H/I:N/A:N ).
3.2.105 IMPROPER VERIFICATION OF CRYPTOGRAPHIC SIGNATURE CWE-347
libgit2 is a cross-platform, linkable library implementation of Git. When using
an SSH remote with the optional libssh2 backend, libgit2 does not perform
certificate checking by default. Prior versions of libgit2 require the caller
to set the certificate_check field of libgit2's git_remote_callbacks structure
- - if a certificate check callback is not set, libgit2 does not perform any
certificate checking. This means that by default - without configuring a
certificate check callback, clients will not perform validation on the server
SSH keys and may be subject to a man-in-the-middle attack. Users are encouraged
to upgrade to v1.4.5 or v1.5.1. Users unable to upgrade should ensure that all
relevant certificates are manually checked.
CVE-2023-22742 has been assigned to this vulnerability. A CVSS v3 base score of
5.3 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:H/PR:N/
UI:R/S:U/C:N/I:H/A:N ).
3.2.106 BUFFER COPY WITHOUT CHECKING SIZE OF INPUT ('CLASSIC BUFFER OVERFLOW')
CWE-120
tpm2-tss is an open source software implementation of the Trusted Computing
Group (TCG) Trusted Platform Module (TPM) 2 Software Stack (TSS2). In affected
versions Tss2_RC_SetHandler and Tss2_RC_Decode both index into layer_handler
with an 8 bit layer number, but the array only has
TPM2_ERROR_TSS2_RC_LAYER_COUNT entries, so trying to add a handler for
higher-numbered layers or decode a response code with such a layer number reads
/writes past the end of the buffer. This buffer overrun could result in
arbitrary code execution. An example attack would be a MiTM bus attack that
returns 0xFFFFFFFF for the RC. Given the common use case of TPM modules, an
attacker must have local access to the target machine with local system
privileges which allows access to the TPM system. Usually TPM access requires
administrative privilege.
CVE-2023-22745 has been assigned to this vulnerability. A CVSS v3 base score of
6.4 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:H/PR:H/
UI:N/S:U/C:H/I:H/A:H ).
3.2.107 ACCESS OF RESOURCE USING INCOMPATIBLE TYPE ('TYPE CONFUSION') CWE-843
cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows
attackers to cause a denial of service (slab-out-of-bounds read) because of
type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT
condition rather than valid classification results).
CVE-2023-23454 has been assigned to this vulnerability. A CVSS v3 base score of
5.5 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:L/PR:L/
UI:N/S:U/C:N/I:N/A:H ).
3.2.108 IMPROPER CHECK FOR UNUSUAL OR EXCEPTIONAL CONDITIONS CWE-754
cryptography is a package designed to expose cryptographic primitives and
recipes to Python developers. In affected versions Cipher.update_into would
accept Python objects which implement the buffer protocol, but provide only
immutable buffers. This would allow immutable objects (such as bytes) to be
mutated, thus violating fundamental rules of Python and resulting in corrupted
output. This now correctly raises an exception. This issue has been present
since update_into was originally introduced in cryptography 1.8.
CVE-2023-23931 has been assigned to this vulnerability. A CVSS v3 base score of
4.8 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:H/PR:N/
UI:N/S:U/C:N/I:L/A:L ).
3.2.109 IMPROPER INPUT VALIDATION CWE-20
Werkzeug is a comprehensive WSGI web application library. Browsers may allow
"nameless" cookies that look like =value instead of key=value. A vulnerable
browser may allow a compromised application on an adjacent subdomain to exploit
this to set a cookie like =__Host-test=bad for another subdomain. Werkzeug
prior to 2.2.3 will parse the cookie =__Host-test=bad as __Host-test=bad. If a
Werkzeug application is running next to a vulnerable or malicious subdomain
which sets such a cookie using a vulnerable browser, the Werkzeug application
will see the bad cookie value but the valid cookie key. The issue is fixed in
Werkzeug 2.2.3.
CVE-2023-23934 has been assigned to this vulnerability. A CVSS v3 base score of
2.6 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:A/AC:H/PR:N/
UI:R/S:U/C:N/I:L/A:N ).
3.2.110 IMPROPER LIMITATION OF A PATHNAME TO A RESTRICTED DIRECTORY ('PATH
TRAVERSAL') CWE-22
Git, a revision control system, is vulnerable to path traversal prior to
versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6,
2.31.7, and 2.30.8. By feeding a crafted input to git apply, a path outside the
working tree can be overwritten as the user who is running git apply. A fix has
been prepared and will appear in v2.39.2, v2.38.4, v2.37.6, v2.36.5, v2.35.7,
v2.34.7, v2.33.7, v2.32.6, v2.31.7, and v2.30.8. As a workaround, use git apply
- --stat to inspect a patch before applying; avoid applying one that creates a
symbolic link and then creates a file beyond the symbolic link.
CVE-2023-23946 has been assigned to this vulnerability. A CVSS v3 base score of
6.2 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:L/PR:N/
UI:N/S:U/C:N/I:H/A:N ).
3.2.111 IMPROPER CONTROL OF GENERATION OF CODE ('CODE INJECTION') CWE-94
Go templates do not properly consider backticks (`) as Javascript string
delimiters, and do not escape them as expected. Backticks are used, since ES6,
for JS template literals. If a template contains a Go template action within a
Javascript template literal, the contents of the action can be used to
terminate the literal, injecting arbitrary Javascript code into the Go
template. As ES6 template literals are rather complex, and themselves can do
string interpolation, the decision was made to simply disallow Go template
actions from being used inside of them (e.g. "var a = {{.}}"), since there is
no obviously safe way to allow this behavior. This takes the same approach as
github.com/google/safehtml. With fix, Template.Parse returns an error when it
encounters templates like this, with an ErrorCode of value 12. This ErrorCode
is currently unexported, but will be exported in the release of Go 1.21. Users
who rely on the previous behavior can re-enable it using the GODEBUG flag
jstmpllitinterp=1, with the caveat that backticks will now be escaped. This
should be used with caution.
CVE-2023-24538 has been assigned to this vulnerability. A CVSS v3 base score of
9.8 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:L/PR:N/
UI:N/S:U/C:H/I:H/A:H ).
3.2.112 ALLOCATION OF RESOURCES WITHOUT LIMITS OR THROTTLING CWE-770
containerd is an open source container runtime. Before versions 1.6.18 and
1.5.18, when importing an OCI image, there was no limit on the number of bytes
read for certain files. A maliciously crafted image with a large file where a
limit was not applied could cause a denial of service. This bug has been fixed
in containerd 1.6.18 and 1.5.18. Users should update to these versions to
resolve the issue. As a workaround, ensure that only trusted images are used
and that only trusted users have permissions to import images.
CVE-2023-25153 has been assigned to this vulnerability. A CVSS v3 base score of
6.2 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:L/PR:N/
UI:N/S:U/C:N/I:N/A:H ).
3.2.113 INTEGER OVERFLOW OR WRAPAROUND CWE-190
Redis is an in-memory database that persists on disk. Authenticated users
issuing specially crafted SRANDMEMBER, ZRANDMEMBER, and HRANDFIELD commands can
trigger an integer overflow, resulting in a runtime assertion and termination
of the Redis server process. This problem affects all Redis versions. Patches
were released in Redis version(s) 6.0.18, 6.2.11 and 7.0.9.
CVE-2023-25155 has been assigned to this vulnerability. A CVSS v3 base score of
5.5 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:L/PR:L/
UI:N/S:U/C:N/I:N/A:H ).
3.2.114 ALLOCATION OF RESOURCES WITHOUT LIMITS OR THROTTLING CWE-770
hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger
quadratic growth via consecutive marks during the process of looking back for
base glyphs when attaching marks.
CVE-2023-25193 has been assigned to this vulnerability. A CVSS v3 base score of
7.5 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:L/PR:N/
UI:N/S:U/C:N/I:N/A:H ).
3.2.115 USE OF UNINITIALIZED RESOURCE CWE-908
A flaw was found in Binutils. The field the_bfd of asymbol struct is
uninitialized in the bfd_mach_o_get_synthetic_symtab function, which may lead
to an application crash and local denial of service.
CVE-2023-25588 has been assigned to this vulnerability. A CVSS v3 base score of
5.5 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:L/PR:N/
UI:R/S:U/C:N/I:N/A:H ).
3.2.116 INCONSISTENT INTERPRETATION OF HTTP REQUESTS ('HTTP REQUEST/RESPONSE
SMUGGLING') CWE-444
Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through
2.4.55 allow a HTTP request smuggling attack. Configurations are affected when
mod_proxy is enabled along with some form of RewriteRule or ProxyPassMatch in
which a non-specific pattern matches some portion of the user-supplied
request-target (URL) data and is then re-inserted into the proxied
request-target using variable substitution. Request splitting/smuggling could
result in bypass of access controls in the proxy server, proxying unintended
URLs to existing origin servers, and cache poisoning. Users are recommended to
update to at least version 2.4.56 of Apache HTTP Server.
CVE-2023-25690 has been assigned to this vulnerability. A CVSS v3 base score of
9.8 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:L/PR:N/
UI:N/S:U/C:H/I:H/A:H ).
3.2.117 IMPROPER NEUTRALIZATION OF INPUT DURING WEB PAGE GENERATION
('CROSS-SITE SCRIPTING') CWE-79
In phpMyAdmin before 4.9.11 and 5.x before 5.2.1, an authenticated user can
trigger XSS by uploading a crafted .sql file through the drag-and-drop
interface.
CVE-2023-25727 has been assigned to this vulnerability. A CVSS v3 base score of
5.4 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:L/PR:L/
UI:R/S:C/C:L/I:L/A:N ).
3.2.118 EXPOSURE OF RESOURCE TO WRONG SPHERE CWE-668
In Epiphany (aka GNOME Web) through 43.0, untrusted web content can trick users
into exfiltrating passwords, because autofill occurs in sandboxed contexts.
CVE-2023-26081 has been assigned to this vulnerability. A CVSS v3 base score of
7.5 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:L/PR:N/
UI:N/S:U/C:H/I:N/A:N ).
3.2.119 OUT-OF-BOUNDS WRITE CWE-787
loadImage() in tools/tiffcrop.c in LibTIFF through 4.5.0 has a heap-based use
after free via a crafted TIFF image.
CVE-2023-26965 has been assigned to this vulnerability. A CVSS v3 base score of
5.5 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:L/PR:N/
UI:R/S:U/C:N/I:N/A:H ).
3.2.120 INCONSISTENT INTERPRETATION OF HTTP REQUESTS ('HTTP REQUEST/RESPONSE
SMUGGLING') CWE-444
HTTP response smuggling vulnerability in Apache HTTP Server via
mod_proxy_uwsgi. This issue affects Apache HTTP Server: from 2.4.30 through
2.4.55. Special characters in the origin response header can truncate/split the
response forwarded to the client.
CVE-2023-27522 has been assigned to this vulnerability. A CVSS v3 base score of
7.5 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:L/PR:N/
UI:N/S:U/C:N/I:H/A:N ).
3.2.121 IMPROPER LIMITATION OF A PATHNAME TO A RESTRICTED DIRECTORY ('PATH
TRAVERSAL') CWE-22
A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes
the tilde () character to be wrongly replaced when used as a prefix in the
first path element, in addition to its intended use as the first element to
indicate a path relative to the user's home directory. Attackers can exploit
this flaw to bypass filtering or execute arbitrary code by crafting a path like
/2/foo while accessing a server with a specific user.
CVE-2023-27534 has been assigned to this vulnerability. A CVSS v3 base score of
8.8 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:L/PR:L/
UI:N/S:U/C:H/I:H/A:H ).
3.2.122 IMPROPER AUTHENTICATION CWE-287
An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP
connection reuse feature that can result in wrong credentials being used during
subsequent transfers. Previously created connections are kept in a connection
pool for reuse if they match the current setup. However, certain FTP settings
such as CURLOPT_FTP_ACCOUNT, CURLOPT_FTP_ALTERNATIVE_TO_USER,
CURLOPT_FTP_SSL_CCC, and CURLOPT_USE_SSL were not included in the configuration
match checks, causing them to match too easily. This could lead to libcurl
using the wrong credentials when performing a transfer, potentially allowing
unauthorized access to sensitive information.
CVE-2023-27535 has been assigned to this vulnerability. A CVSS v3 base score of
5.9 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:H/PR:N/
UI:N/S:U/C:H/I:N/A:N ).
3.2.123 IMPROPER AUTHENTICATION CWE-287
An authentication bypass vulnerability exists libcurl prior to 8.0.0 in the
connection reuse feature which can reuse previously established connections
with incorrect user permissions due to a failure to check for changes in the
CURLOPT_GSSAPI_DELEGATION option. This vulnerability affects krb5/kerberos/
negotiate/GSSAPI transfers and could potentially result in unauthorized access
to sensitive information. The safest option is to not reuse connections if the
CURLOPT_GSSAPI_DELEGATION option has been changed.
CVE-2023-27536 has been assigned to this vulnerability. A CVSS v3 base score of
5.9 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:H/PR:N/
UI:N/S:U/C:H/I:N/A:N ).
3.2.124 MISSING ENCRYPTION OF SENSITIVE DATA CWE-311
An issue was discovered in Dnsmasq before 2.90. The default maximum EDNS.0 UDP
packet size was set to 4096 but should be 1232 because of DNS Flag Day 2020.
CVE-2023-28450 has been assigned to this vulnerability. A CVSS v3 base score of
7.5 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:L/PR:N/
UI:N/S:U/C:N/I:N/A:H ).
3.2.125 NULL POINTER DEREFERENCE CWE-476
do_tls_getsockopt in net/tls/tls_main.c in the Linux kernel through 6.2.6 lacks
a lock_sock call, leading to a race condition (with a resultant use after free
or NULL pointer dereference).
CVE-2023-28466 has been assigned to this vulnerability. A CVSS v3 base score of
7.0 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:H/PR:L/
UI:N/S:U/C:H/I:H/A:H ).
3.2.126 IMPROPER ENCODING OR ESCAPING OF OUTPUT CWE-116
Sudo before 1.9.13 does not escape control characters in log messages.
CVE-2023-28486 has been assigned to this vulnerability. A CVSS v3 base score of
5.3 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:L/PR:N/
UI:N/S:U/C:L/I:N/A:N ).
3.2.127 IMPROPER ENCODING OR ESCAPING OF OUTPUT CWE-116
Sudo before 1.9.13 does not escape control characters in sudoreplay output.
CVE-2023-28487 has been assigned to this vulnerability. A CVSS v3 base score of
5.3 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:L/PR:N/
UI:N/S:U/C:L/I:N/A:N ).
3.2.128 IMPROPER CONTROL OF GENERATION OF CODE ('CODE INJECTION') CWE-94
The go command may generate unexpected code at build time when using cgo. This
may result in unexpected behavior when running a go program which uses cgo.
This may occur when running an untrusted module which contains directories with
newline characters in their names. Modules which are retrieved using the go
command, i.e. via "go get", are not affected (modules retrieved using
GOPATH-mode, i.e. GO111MODULE=off, may be affected).
CVE-2023-29402 has been assigned to this vulnerability. A CVSS v3 base score of
9.8 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:L/PR:N/
UI:N/S:U/C:H/I:H/A:H ).
3.2.129 IMPROPER CONTROL OF GENERATION OF CODE ('CODE INJECTION') CWE-94
The go command may execute arbitrary code at build time when using cgo. This
may occur when running "go get" on a malicious module, or when running any
other command which builds untrusted code. This is can by triggered by linker
flags, specified via a "#cgo LDFLAGS" directive. The arguments for a number of
flags which are non-optional are incorrectly considered optional, allowing
disallowed flags to be smuggled through the LDFLAGS sanitization. This affects
usage of both the gc and gccgo compilers.
CVE-2023-29404 has been assigned to this vulnerability. A CVSS v3 base score of
9.8 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:L/PR:N/
UI:N/S:U/C:H/I:H/A:H ).
3.2.130 IMPROPER NEUTRALIZATION OF SPECIAL ELEMENTS IN OUTPUT USED BY A
DOWNSTREAM COMPONENT ('INJECTION') CWE-74
The go command may execute arbitrary code at build time when using cgo. This
may occur when running "go get" on a malicious module, or when running any
other command which builds untrusted code. This is can by triggered by linker
flags, specified via a "#cgo LDFLAGS" directive. Flags containing embedded
spaces are mishandled, allowing disallowed flags to be smuggled through the
LDFLAGS sanitization by including them in the argument of another flag. This
only affects usage of the gccgo compiler.
CVE-2023-29405 has been assigned to this vulnerability. A CVSS v3 base score of
9.8 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:L/PR:N/
UI:N/S:U/C:H/I:H/A:H ).
3.2.131 INTERPRETATION CONFLICT CWE-436
The HTTP/1 client does not fully validate the contents of the host header. A
maliciously crafted host header can inject additional headers or entire
requests. With fix, the HTTP/1 client now refuses to send requests containing
an invalid Request.Host or Request.URL.Host value.
CVE-2023-29406 has been assigned to this vulnerability. A CVSS v3 base score of
6.5 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:L/PR:N/
UI:R/S:U/C:N/I:H/A:N ).
3.2.132 UNCONTROLLED RESOURCE CONSUMPTION CWE-400
Extremely large RSA keys in certificate chains can cause a client/server to
expend significant CPU time verifying signatures. With fix, the size of RSA
keys transmitted during handshakes is restricted to <= 8192 bits. Based on a
survey of publicly trusted RSA keys, there are currently only three
certificates in circulation with keys larger than this, and all three appear to
be test certificates that are not actively deployed. It is possible there are
larger keys in use in private PKIs, but we target the web PKI, so causing
breakage here in the interests of increasing the default safety of users of
crypto/tls seems reasonable.
CVE-2023-29409 has been assigned to this vulnerability. A CVSS v3 base score of
5.3 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:L/PR:N/
UI:N/S:U/C:N/I:N/A:L ).
3.2.133 OUT-OF-BOUNDS WRITE CWE-787
A buffer overflow vulnerability found in Libtiff V.4.0.7 allows a local
attacker to cause a denial of service via the tiffcp function in tiffcp.c.
CVE-2023-30086 has been assigned to this vulnerability. A CVSS v3 base score of
5.5 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:L/PR:L/
UI:N/S:U/C:N/I:N/A:H ).
3.2.134 MISSING ENCRYPTION OF SENSITIVE DATA CWE-311
An issue was discovered in arch/x86/kvm/vmx/nested.c in the Linux kernel before
6.2.8. nVMX on x86_64 lacks consistency checks for CR0 and CR4.
CVE-2023-30456 has been assigned to this vulnerability. A CVSS v3 base score of
6.5 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:L/PR:L/
UI:N/S:C/C:N/I:N/A:H ).
3.2.135 USE AFTER FREE CWE-416
The Linux kernel before 6.2.9 has a race condition and resultant use after free
in drivers/power/supply/da9150-charger.c if a physically proximate attacker
unplugs a device.
CVE-2023-30772 has been assigned to this vulnerability. A CVSS v3 base score of
6.4 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:P/AC:H/PR:N/
UI:N/S:U/C:H/I:H/A:H ).
3.2.136 MISSING ENCRYPTION OF SENSITIVE DATA CWE-311
An issue was discovered in drivers/media/dvb-core/dvb_frontend.c in the Linux
kernel 6.2. There is a blocking operation when a task is in !TASK_RUNNING. In
dvb_frontend_get_event, wait_event_interruptible is called; the condition is
dvb_frontend_test_event(fepriv,events). In dvb_frontend_test_event, down(&
fepriv->sem) is called. However, wait_event_interruptible would put the process
to sleep, and down(&fepriv->sem) may block the process.
CVE-2023-31084 has been assigned to this vulnerability. A CVSS v3 base score of
5.5 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:L/PR:L/
UI:N/S:U/C:N/I:N/A:H ).
3.2.137 USE OF INSUFFICIENTLY RANDOM VALUES CWE-330
c-ares is an asynchronous resolver library. When cross-compiling c-ares and
using the autotools build system, CARES_RANDOM_FILE will not be set, as seen
when cross compiling aarch64 android. This will downgrade to using rand() as a
fallback which could allow an attacker to take advantage of the lack of entropy
by not using a CSPRNG. This issue was patched in version 1.19.1.
CVE-2023-31124 has been assigned to this vulnerability. A CVSS v3 base score of
3.7 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:H/PR:N/
UI:N/S:U/C:N/I:L/A:N ).
3.2.138 BUFFER UNDERWRITE ('BUFFER UNDERFLOW') CWE-124
c-ares is an asynchronous resolver library. ares_inet_net_pton() is vulnerable
to a buffer underflow for certain ipv6 addresses; in particular "0::00:00:00/2"
was found to cause an issue. C-ares only uses this function internally for
configuration purposes which would require an administrator to configure such
an address via ares_set_sortlist(). However, users may externally use
ares_inet_net_pton() for other purposes and thus be vulnerable to more severe
issues. This issue has been fixed in 1.19.1.
CVE-2023-31130 has been assigned to this vulnerability. A CVSS v3 base score of
4.1 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:H/PR:H/
UI:N/S:U/C:N/I:N/A:H ).
3.2.139 USE OF INSUFFICIENTLY RANDOM VALUES CWE-330
c-ares is an asynchronous resolver library. When /dev/urandom or RtlGenRandom()
are unavailable, c-ares uses rand() to generate random numbers used for DNS
query ids. This is not a CSPRNG, and it is also not seeded by srand() so will
generate predictable output. Input from the random number generator is fed into
a non-compilant RC4 implementation and may not be as strong as the original RC4
implementation. No attempt is made to look for modern OS-provided CSPRNGs like
arc4random() that is widely available. This issue has been fixed in version
1.19.1.
CVE-2023-31147 has been assigned to this vulnerability. A CVSS v3 base score of
5.9 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:H/PR:N/
UI:N/S:U/C:N/I:H/A:N ).
3.2.140 IMPROPER INPUT VALIDATION CWE-20
qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13
allows an out-of-bounds write because lmax can exceed QFQ_MIN_LMAX.
CVE-2023-31436 has been assigned to this vulnerability. A CVSS v3 base score of
7.8 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:L/PR:L/
UI:N/S:U/C:H/I:H/A:H ).
3.2.141 MISSING ENCRYPTION OF SENSITIVE DATA CWE-311
An issue found in Frrouting bgpd v.8.4.2 allows a remote attacker to cause a
denial of service via the bgp_capability_llgr() function.
CVE-2023-31489 has been assigned to this vulnerability. A CVSS v3 base score of
5.5 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:L/PR:N/
UI:R/S:U/C:N/I:N/A:H ).
3.2.142 UNCONTROLLED RESOURCE CONSUMPTION CWE-400
c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of
service. If a target resolver sends a query, the attacker forges a malformed
UDP packet with a length of 0 and returns them to the target resolver. The
target resolver erroneously interprets the 0 length as a graceful shutdown of
the connection. This issue has been patched in version 1.19.1.
CVE-2023-32067 has been assigned to this vulnerability. A CVSS v3 base score of
7.5 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:L/PR:N/
UI:N/S:U/C:N/I:N/A:H ).
3.2.143 IMPROPER INPUT VALIDATION CWE-20
In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when
processing batch requests can be abused to perform arbitrary read and write
operations on kernel memory. Unprivileged local users can obtain root
privileges. This occurs because anonymous sets are mishandled.
CVE-2023-32233 has been assigned to this vulnerability. A CVSS v3 base score of
7.8 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:L/PR:L/
UI:N/S:U/C:H/I:H/A:H ).
3.2.144 DIVIDE BY ZERO CWE-369
In Qt before 5.15.14, 6.0.x through 6.2.x before 6.2.9, and 6.3.x through 6.5.x
before 6.5.1, QtSvg QSvgFont m_unitsPerEm initialization is mishandled.
CVE-2023-32573 has been assigned to this vulnerability. A CVSS v3 base score of
6.5 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:L/PR:N/
UI:R/S:U/C:N/I:N/A:H ).
3.2.145 CONCURRENT EXECUTION USING SHARED RESOURCE WITH IMPROPER
SYNCHRONIZATION ('RACE CONDITION') CWE-362
The Linux kernel before 6.2.9 has a race condition and resultant use-after-free
in drivers/net/ethernet/qualcomm/emac/emac.c if a physically proximate attacker
unplugs an emac based device.
CVE-2023-33203 has been assigned to this vulnerability. A CVSS v3 base score of
6.4 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:P/AC:H/PR:N/
UI:N/S:U/C:H/I:H/A:H ).
3.2.146 IMPROPER INPUT VALIDATION CWE-20
An issue was discovered in the Linux kernel before 6.3.3. There is an
out-of-bounds read in crc16 in lib/crc16.c when called from fs/ext4/super.c
because ext4_group_desc_csum does not properly check an offset.
CVE-2023-34256 has been assigned to this vulnerability. A CVSS v3 base score of
5.5 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:L/PR:L/
UI:N/S:U/C:N/I:N/A:H ).
3.2.147 MISSING ENCRYPTION OF SENSITIVE DATA CWE-311
A vulnerability in Outline.cc for Poppler prior to 23.06.0 allows a remote
attacker to cause a denial of service (crash) via a crafted PDF file in
OutlineItem::open.
CVE-2023-34872 has been assigned to this vulnerability. A CVSS v3 base score of
5.5 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:L/PR:N/
UI:R/S:U/C:N/I:N/A:H ).
3.2.148 MISSING ENCRYPTION OF SENSITIVE DATA CWE-311
D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon.
If a privileged user with control over the dbus-daemon is using the
org.freedesktop.DBus.Monitoring interface to monitor message bus traffic, then
an unprivileged user with the ability to connect to the same dbus-daemon can
cause a dbus-daemon crash under some circumstances via an unreplyable message.
When done on the well-known system bus, this is a denial-of-service
vulnerability. The fixed versions are 1.12.28, 1.14.8, and 1.15.6.
CVE-2023-34969 has been assigned to this vulnerability. A CVSS v3 base score of
6.5 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:L/PR:L/
UI:N/S:U/C:N/I:N/A:H ).
3.2.149 OUT-OF-BOUNDS WRITE CWE-787
Linux kernel nftables out-of-bounds read/write vulnerability; nft_byteorder
poorly handled vm register contents when CAP_NET_ADMIN is in any user or
network namespace
CVE-2023-35001 has been assigned to this vulnerability. A CVSS v3 base score of
7.8 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:L/PR:L/
UI:N/S:U/C:H/I:H/A:H ).
3.2.150 OUT-OF-BOUNDS WRITE CWE-787
An issue was discovered in fl_set_geneve_opt in net/sched/cls_flower.c in the
Linux kernel before 6.3.7. It allows an out-of-bounds write in the flower
classifier code via TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets. This may result in
denial of service or privilege escalation.
CVE-2023-35788 has been assigned to this vulnerability. A CVSS v3 base score of
7.8 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:L/PR:L/
UI:N/S:U/C:H/I:H/A:H ).
3.2.151 INSUFFICIENTLY PROTECTED CREDENTIALS CWE-522
An issue was discovered in the C AMQP client library (aka rabbitmq-c) through
0.13.0 for RabbitMQ. Credentials can only be entered on the command line (e.g.,
for amqp-publish or amqp-consume) and are thus visible to local attackers by
listing a process and its arguments.
CVE-2023-35789 has been assigned to this vulnerability. A CVSS v3 base score of
5.5 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:L/PR:L/
UI:N/S:U/C:H/I:N/A:N ).
3.2.152 CONCURRENT EXECUTION USING SHARED RESOURCE WITH IMPROPER
SYNCHRONIZATION ('RACE CONDITION') CWE-362
An issue was discovered in the Linux kernel before 6.3.2. A use after free was
found in saa7134_finidev in drivers/media/pci/saa7134/saa7134-core.c.
CVE-2023-35823 has been assigned to this vulnerability. A CVSS v3 base score of
7.0 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:H/PR:L/
UI:N/S:U/C:H/I:H/A:H ).
3.2.153 CONCURRENT EXECUTION USING SHARED RESOURCE WITH IMPROPER
SYNCHRONIZATION ('RACE CONDITION') CWE-362
An issue was discovered in the Linux kernel before 6.3.2. A use after free was
found in dm1105_remove in drivers/media/pci/dm1105/dm1105.c.
CVE-2023-35824 has been assigned to this vulnerability. A CVSS v3 base score of
7.0 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:H/PR:L/
UI:N/S:U/C:H/I:H/A:H ).
3.2.154 CONCURRENT EXECUTION USING SHARED RESOURCE WITH IMPROPER
SYNCHRONIZATION ('RACE CONDITION') CWE-362
An issue was discovered in the Linux kernel before 6.3.2. A use after free was
found in renesas_usb3_remove in drivers/usb/gadget/udc/renesas_usb3.c.
CVE-2023-35828 has been assigned to this vulnerability. A CVSS v3 base score of
7.0 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:H/PR:L/
UI:N/S:U/C:H/I:H/A:H ).
3.2.155 ACCESS OF UNINITIALIZED POINTER CWE-824
lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x
before 1.21.1 frees an uninitialized pointer. A remote authenticated user can
trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does
not validate the relationship between n_key_data and the key_data array count.
CVE-2023-36054 has been assigned to this vulnerability. A CVSS v3 base score of
6.5 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:L/PR:L/
UI:N/S:U/C:N/I:N/A:H ).
3.2.156 INEFFICIENT REGULAR EXPRESSION COMPLEXITY CWE-1333
A regular expression denial of service issue was discovered in the URI
component before 0.12.2 for Ruby. The URI parser mishandles invalid URLs that
have specific characters. There is an increase in execution time for parsing
strings to URI objects with rfc2396_parser.rb and rfc3986_parser.rb. This issue
exists becuse of an incomplete fix for CVE-2023-28755. Version 0.10.3 is also a
fixed version.
CVE-2023-36617 has been assigned to this vulnerability. A CVSS v3 base score of
5.3 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:L/PR:N/
UI:N/S:U/C:N/I:N/A:L ).
3.2.157 IMPROPER NEUTRALIZATION OF SPECIAL ELEMENTS USED IN AN OS COMMAND ('OS
COMMAND INJECTION') CWE-78
Artifex Ghostscript through 10.01.2 mishandles permission validation for pipe
devices (with the %pipe% prefix or the | pipe character prefix).
CVE-2023-36664 has been assigned to this vulnerability. A CVSS v3 base score of
7.8 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:L/PR:N/
UI:R/S:U/C:H/I:H/A:H ).
3.2.158 INSUFFICIENT VERIFICATION OF DATA AUTHENTICITY CWE-345
Certifi is a curated collection of root certificates for validating the
trustworthiness of SSL certificates while verifying the identity of TLS hosts.
Certifi prior to version 2023.07.22 recognizes "e-Tugra" root certificates.
e-Tugra's root certificates were subject to an investigation prompted by
reporting of security issues in their systems. Certifi 2023.07.22 removes root
certificates from "e-Tugra" from the root store.
CVE-2023-37920 has been assigned to this vulnerability. A CVSS v3 base score of
7.5 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:N/AC:L/PR:N/
UI:N/S:U/C:N/I:H/A:N ).
3.2.159 BUFFER COPY WITHOUT CHECKING SIZE OF INPUT ('CLASSIC BUFFER OVERFLOW')
CWE-120
A buffer overflow flaw was found in base/gdevdevn.c:1973 in devn_pcx_write_rle
() in ghostscript. This issue may allow a local attacker to cause a denial of
service via outputting a crafted PDF file for a DEVN device with gs.
CVE-2023-38559 has been assigned to this vulnerability. A CVSS v3 base score of
5.5 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:L/PR:N/
UI:R/S:U/C:N/I:N/A:H ).
3.2.160 USE AFTER FREE CWE-416
An issue was discovered in l2cap_sock_release in net/bluetooth/l2cap_sock.c in
the Linux kernel before 6.4.10. There is a use-after-free because the children
of an sk are mishandled.
CVE-2023-40283 has been assigned to this vulnerability. A CVSS v3 base score of
7.8 has been calculated; the CVSS vector string is ( CVSS:3.1/AV:L/AC:L/PR:L/
UI:N/S:U/C:H/I:H/A:H ).
3.3 BACKGROUND
o CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing
o COUNTRIES/AREAS DEPLOYED: Worldwide
o COMPANY HEADQUARTERS LOCATION: Germany
3.4 RESEARCHER
Siemens reported these vulnerabilities to CISA.
4. MITIGATIONS
Siemens has released update V2.4 for SCALANCE X-300 and recommends updating to
the latest version.
As a general security measure, Siemens recommends protecting network access to
devices with appropriate mechanisms. To operate the devices in a protected IT
environment, Siemens recommends configuring the environment according to
Siemens' operational guidelines for industrial security and following
recommendations in the product manuals.
Additional information on industrial security by Siemens can be found on the
Siemens industrial security webpage .
For more information see the associated Siemens security advisory SSA-806742 in
HTML and CSAF .
CISA recommends users take defensive measures to minimize the risk of
exploitation of these vulnerabilities. CISA reminds organizations to perform
proper impact analysis and risk assessment prior to deploying defensive
measures.
CISA also provides a section for control systems security recommended practices
on the ICS webpage on cisa.gov . Several CISA products detailing cyber defense
best practices are available for reading and download, including Improving
Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies .
CISA encourages organizations to implement recommended cybersecurity strategies
for proactive defense of ICS assets .
Additional mitigation guidance and recommended practices are publicly available
on the ICS webpage at cisa.gov in the technical information paper,
ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation
Strategies .
Organizations observing suspected malicious activity should follow established
internal procedures and report findings to CISA for tracking and correlation
against other incidents.
No known public exploitation specifically targeting these vulnerabilities has
been reported to CISA at this time.
5. UPDATE HISTORY
o February 15, 2024: Initial Publication
This product is provided subject to this Notification and this Privacy & Use
policy.
Vendor
Siemens
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: https://auscert.org.au/gpg-key/
iQIVAwUBZc7Q+8kNZI30y1K9AQgfeRAAtPjPTNvMfYwRvTGjU4mr5mCRjTUX8P9d
Bk2laKpCCd1f/GCx/sCHQ8ngjFkgvoq5cU7yIC2Bq4V0t93n3+truOyypK9TMIno
RLAXa2+UD1mBY5oPEesCYDr/rby8f7x7ezvdijCZ4Kq8/5GvK19ewdhgFhx5eGoF
ir8sG3qz1DFuWc44vEdA8aYLh44eO2Jk3SkJihap1TxqrZPmFTASRd8oGZftuSff
pzJ349J3z3RLZ2YTU/PwNSh47631n3MNehr7wR10kXhvqyYrOIhcMRuM86zlojaB
d/xocQGwBZNYqPMwf3BQz2uPU0GLTfGV2CNbdWkUMBANSq+mNKyS5FMLZGiTtgYW
9IC/HiUmcuyEQSjDtrP6Y8Y/jOtKpe9tzuhNuggjtAXjOzreiVFQ+JD0ilgDlCh/
OBj7jpSUMvrRLVucPr9eN3J2lDcVSpjCrTjbIs5yq29dHHik4GvYTQ6jOSGdnPSR
y2oykhg1Rbx+g3sx+HZV8H/JDANa/9S5if9zrO1icMwUTFlbQ0y6YEUL0NfYAF7I
BkQTxtm1nlAGzX1AHV4Qn6sPJBMvbhXCdIHpkWifAZ20UaaPUYMdbmJbUn1SODp6
90/BujMDBjTgMwUdwWELAgZ7fnVVKHv7WC3RJ8LRGvtKfqkGqNkNq/X9OfklvlQx
reZy6DPkgwU=
=Asi3
-----END PGP SIGNATURE-----