VARIoT IoT vulnerabilities database

Non-transparent sharing of branch predictor selectors between contexts in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access. A new cross-privilege Spectre v2 vulnerability that impacts modern CPU architectures supporting speculative execution has been discovered. CPU hardware utilizing speculative execution that are vulnerable to Spectre v2 branch history injection (BHI) are likely affected. An unauthenticated attacker can exploit this vulnerability to leak privileged memory from the CPU by speculatively jumping to a chosen gadget. Current research shows that existing mitigation techniques of disabling privileged eBPF and enabling (Fine)IBT are insufficient in stopping BHI exploitation against the kernel/hypervisor.CVE-2022-0001 Not Affected CVE-2024-2201 AffectedCVE-2022-0001 Not Affected CVE-2024-2201 Affected. A flaw was found in hw. The Branch History Injection (BHI) describes a specific form of intra-mode BTI. This flaw allows an unprivileged malicious user to manipulate the branch history before transitioning to supervisor or VMX root mode. This issue is an effort to cause an indirect branch predictor to select a specific predictor entry for an indirect branch, and a disclosure gadget at the predicted target will transiently execute. This execution is possible since the relevant branch history may contain branches taken in previous security contexts, and in particular, in other predictor modes. ========================================================================= Ubuntu Security Notice USN-5362-1 April 01, 2022 linux-intel-5.13 vulnerabilities ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 20.04 LTS Summary: Several security issues were fixed in the Linux kernel. Software Description: - linux-intel-5.13: Linux kernel for Intel IOTG Details: Nick Gregory discovered that the Linux kernel incorrectly handled network offload functionality. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2022-25636) Enrico Barberis, Pietro Frigo, Marius Muench, Herbert Bos, and Cristiano Giuffrida discovered that hardware mitigations added by ARM to their processors to address Spectre-BTI were insufficient. A local attacker could potentially use this to expose sensitive information. (CVE-2022-23960) It was discovered that the BPF verifier in the Linux kernel did not properly restrict pointer types in certain situations. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-23222) Max Kellermann discovered that the Linux kernel incorrectly handled Unix pipes. A local attacker could potentially use this to modify any file that could be opened for reading. (CVE-2022-0847) Yiqi Sun and Kevin Wang discovered that the cgroups implementation in the Linux kernel did not properly restrict access to the cgroups v1 release_agent feature. A local attacker could use this to gain administrative privileges. (CVE-2022-0492) William Liu and Jamie Hill-Daniel discovered that the file system context functionality in the Linux kernel contained an integer underflow vulnerability, leading to an out-of-bounds write. A local attacker could use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2022-0185) Enrico Barberis, Pietro Frigo, Marius Muench, Herbert Bos, and Cristiano Giuffrida discovered that hardware mitigations added by Intel to their processors to address Spectre-BTI were insufficient. A local attacker could potentially use this to expose sensitive information. (CVE-2022-0001) Jann Horn discovered a race condition in the Unix domain socket implementation in the Linux kernel that could result in a read-after-free. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-4083) It was discovered that the NFS server implementation in the Linux kernel contained an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-4090) Kirill Tkhai discovered that the XFS file system implementation in the Linux kernel did not calculate size correctly when pre-allocating space in some situations. A local attacker could use this to expose sensitive information. (CVE-2021-4155) It was discovered that the AMD Radeon GPU driver in the Linux kernel did not properly validate writes in the debugfs file system. A privileged attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-42327) Sushma Venkatesh Reddy discovered that the Intel i915 graphics driver in the Linux kernel did not perform a GPU TLB flush in some situations. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2022-0330) Samuel Page discovered that the Transparent Inter-Process Communication (TIPC) protocol implementation in the Linux kernel contained a stack-based buffer overflow. A remote attacker could use this to cause a denial of service (system crash) for systems that have a TIPC bearer configured. (CVE-2022-0435) It was discovered that the KVM implementation for s390 systems in the Linux kernel did not properly prevent memory operations on PVM guests that were in non-protected mode. A local attacker could use this to obtain unauthorized memory write access. (CVE-2022-0516) It was discovered that the ICMPv6 implementation in the Linux kernel did not properly deallocate memory in certain situations. A remote attacker could possibly use this to cause a denial of service (memory exhaustion). (CVE-2022-0742) It was discovered that the VMware Virtual GPU driver in the Linux kernel did not properly handle certain failure conditions, leading to a stale entry in the file descriptor table. A local attacker could use this to expose sensitive information or possibly gain administrative privileges. (CVE-2022-22942) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 20.04 LTS: linux-image-5.13.0-1010-intel 5.13.0-1010.10 linux-image-intel 5.13.0.1010.11 After a standard system update you need to reboot your computer to make all the necessary changes. ATTENTION: Due to an unavoidable ABI change the kernel updates have been given a new version number, which requires you to recompile and reinstall all third party kernel modules you might have installed. Unless you manually uninstalled the standard kernel metapackages (e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual, linux-powerpc), a standard system upgrade will automatically perform this as well. References: https://ubuntu.com/security/notices/USN-5362-1 CVE-2021-4083, CVE-2021-4090, CVE-2021-4155, CVE-2021-42327, CVE-2022-0001, CVE-2022-0185, CVE-2022-0330, CVE-2022-0435, CVE-2022-0492, CVE-2022-0516, CVE-2022-0742, CVE-2022-0847, CVE-2022-22942, CVE-2022-23222, CVE-2022-23960, CVE-2022-25636 Package Information: https://launchpad.net/ubuntu/+source/linux-intel-5.13/5.13.0-1010.10 . This update corrects flaws in the following subsystems: - ARM32 architecture; - PowerPC architecture; - RISC-V architecture; - S390 architecture; - Core kernel; - x86 architecture; - Block layer subsystem; - ACPI drivers; - Android drivers; - Power management core; - Bus devices; - Hardware random number generator core; - Clock framework and drivers; - CPU frequency scaling framework; - Cryptographic API; - Device frequency scaling framework; - DMA engine subsystem; - ARM SCMI message protocol; - EFI core; - GPU drivers; - HID subsystem; - Hardware monitoring drivers; - I2C subsystem; - IIO ADC drivers; - IIO subsystem; - IIO Magnetometer sensors drivers; - InfiniBand drivers; - IOMMU subsystem; - Multiple devices driver; - Media drivers; - MMC subsystem; - Network drivers; - NTB driver; - NVME drivers; - PCI subsystem; - PCI driver for MicroSemi Switchtec; - PHY drivers; - MediaTek PM domains; - Power supply drivers; - SCSI drivers; - SPI subsystem; - Media staging drivers; - TCM subsystem; - USB subsystem; - DesignWare USB3 driver; - Framebuffer layer; - AFS file system; - File systems infrastructure; - BTRFS file system; - Ceph distributed file system; - EROFS file system; - Ext4 file system; - F2FS file system; - JFS file system; - Network file system client; - NILFS2 file system; - NTFS3 file system; - Pstore file system; - Diskquota system; - SMB network file system; - BPF subsystem; - Memory management; - Netfilter; - TLS protocol; - io_uring subsystem; - Bluetooth subsystem; - Ethernet bridge; - CAN network layer; - Networking core; - HSR network protocol; - IPv4 networking; - IPv6 networking; - L2TP protocol; - Logical Link layer; - MAC80211 subsystem; - Multipath TCP; - Netlink; - NET/ROM layer; - NFC subsystem; - Packet sockets; - RDS protocol; - SMC sockets; - Sun RPC protocol; - TIPC protocol; - Unix domain sockets; - Wireless networking; - Tomoyo security module; - Realtek audio codecs; - USB sound devices; (CVE-2024-26910, CVE-2024-27074, CVE-2023-52494, CVE-2023-52594, CVE-2024-26915, CVE-2024-26766, CVE-2023-52489, CVE-2024-35845, CVE-2024-26846, CVE-2024-26898, CVE-2024-26897, CVE-2024-26826, CVE-2024-26798, CVE-2023-52662, CVE-2024-26856, CVE-2023-52608, CVE-2024-26782, CVE-2024-27047, CVE-2024-27390, CVE-2024-26610, CVE-2024-26804, CVE-2023-52638, CVE-2024-26771, CVE-2024-26752, CVE-2024-26585, CVE-2024-26645, CVE-2024-26715, CVE-2024-27028, CVE-2024-26809, CVE-2024-26880, CVE-2024-27432, CVE-2024-27065, CVE-2024-26717, CVE-2023-52616, CVE-2024-26748, CVE-2024-26795, CVE-2024-26671, CVE-2024-26743, CVE-2024-27412, CVE-2024-26802, CVE-2024-26733, CVE-2024-26736, CVE-2023-52618, CVE-2024-27046, CVE-2024-26688, CVE-2024-26679, CVE-2024-26769, CVE-2024-27051, CVE-2024-26603, CVE-2024-26744, CVE-2023-52434, CVE-2024-26697, CVE-2024-27075, CVE-2023-52583, CVE-2024-26583, CVE-2024-27403, CVE-2024-26907, CVE-2024-26636, CVE-2024-27410, CVE-2023-52530, CVE-2024-26840, CVE-2024-26851, CVE-2024-26862, CVE-2023-52640, CVE-2024-35829, CVE-2024-26906, CVE-2024-26777, CVE-2024-27419, CVE-2024-26664, CVE-2024-26627, CVE-2024-26859, CVE-2023-52486, CVE-2023-52652, CVE-2024-26835, CVE-2024-35844, CVE-2024-26702, CVE-2024-26635, CVE-2024-26704, CVE-2023-52633, CVE-2024-26816, CVE-2024-26894, CVE-2024-26778, CVE-2023-52599, CVE-2024-35828, CVE-2024-26776, CVE-2023-52493, CVE-2024-26845, CVE-2024-26594, CVE-2024-26885, CVE-2024-26829, CVE-2023-52645, CVE-2024-26695, CVE-2023-52615, CVE-2024-26651, CVE-2024-26843, CVE-2023-52606, CVE-2024-26675, CVE-2024-26874, CVE-2024-26883, CVE-2024-26772, CVE-2024-26673, CVE-2024-26737, CVE-2023-52631, CVE-2024-26640, CVE-2023-52598, CVE-2024-26735, CVE-2024-26895, CVE-2024-26592, CVE-2023-52492, CVE-2024-26861, CVE-2023-52644, CVE-2024-26920, CVE-2024-26877, CVE-2024-26863, CVE-2024-26720, CVE-2024-26722, CVE-2024-27045, CVE-2024-27038, CVE-2024-26763, CVE-2024-26833, CVE-2024-27417, CVE-2024-26916, CVE-2024-26857, CVE-2024-26875, CVE-2024-26606, CVE-2024-27024, CVE-2024-26615, CVE-2023-52614, CVE-2023-52641, CVE-2024-26600, CVE-2024-27043, CVE-2023-52635, CVE-2024-26787, CVE-2024-26622, CVE-2024-27413, CVE-2024-26791, CVE-2023-52622, CVE-2023-52491, CVE-2023-52604, CVE-2024-27037, CVE-2024-26881, CVE-2024-26754, CVE-2024-26659, CVE-2024-26663, CVE-2024-26747, CVE-2023-52602, CVE-2024-26712, CVE-2024-26839, CVE-2024-26749, CVE-2024-26764, CVE-2024-26820, CVE-2024-26882, CVE-2024-27039, CVE-2024-27078, CVE-2024-26889, CVE-2024-26870, CVE-2024-26788, CVE-2024-26602, CVE-2024-26903, CVE-2024-27044, CVE-2024-27073, CVE-2023-52601, CVE-2023-52595, CVE-2024-26707, CVE-2024-27415, CVE-2023-52637, CVE-2024-26660, CVE-2024-27414, CVE-2024-27054, CVE-2023-52497, CVE-2024-26801, CVE-2023-52435, CVE-2023-52620, CVE-2023-52627, CVE-2024-26698, CVE-2023-52597, CVE-2024-27077, CVE-2023-52650, CVE-2024-26750, CVE-2024-26852, CVE-2024-27053, CVE-2023-52656, CVE-2024-26625, CVE-2024-26779, CVE-2024-27431, CVE-2024-26751, CVE-2024-26684, CVE-2024-26803, CVE-2024-26593, CVE-2023-52642, CVE-2023-52447, CVE-2024-26790, CVE-2024-26825, CVE-2024-26668, CVE-2023-52607, CVE-2024-26872, CVE-2024-27030, CVE-2023-52643, CVE-2024-26901, CVE-2024-35830, CVE-2024-26855, CVE-2023-52588, CVE-2023-52587, CVE-2024-26891, CVE-2024-26644, CVE-2024-26884, CVE-2024-26793, CVE-2024-26805, CVE-2024-26584, CVE-2024-27405, CVE-2023-52623, CVE-2024-26608, CVE-2024-26878, CVE-2024-27388, CVE-2024-27416, CVE-2024-26685, CVE-2024-27034, CVE-2024-26879, CVE-2024-26614, CVE-2024-26792, CVE-2023-52617, CVE-2024-26773, CVE-2024-26665, CVE-2024-26641, CVE-2023-52619, CVE-2024-35811, CVE-2024-27052, CVE-2024-27076, CVE-2024-26838, CVE-2024-26808, CVE-2024-26696, CVE-2024-26676, CVE-2024-26689, CVE-2024-26774, CVE-2024-26601, CVE-2023-52498, CVE-2024-27436) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 20.04 LTS linux-image-5.15.0-1058-intel-iotg 5.15.0-1058.64~20.04.1 linux-image-intel 5.15.0.1058.64~20.04.1 linux-image-intel-iotg 5.15.0.1058.64~20.04.1 After a standard system update you need to reboot your computer to make all the necessary changes. This update corrects flaws in the following subsystems: - Block layer subsystem; - Hardware random number generator core; - GPU drivers; - AFS file system; - Memory management; - Netfilter; (CVE-2024-26642, CVE-2024-26922, CVE-2024-26720, CVE-2024-26736, CVE-2024-26898, CVE-2021-47063, CVE-2023-52615) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 18.04 LTS linux-image-4.15.0-1132-oracle 4.15.0-1132.143 Available with Ubuntu Pro linux-image-4.15.0-1153-kvm 4.15.0-1153.158 Available with Ubuntu Pro linux-image-4.15.0-1163-gcp 4.15.0-1163.180 Available with Ubuntu Pro linux-image-4.15.0-1169-aws 4.15.0-1169.182 Available with Ubuntu Pro linux-image-4.15.0-226-generic 4.15.0-226.238 Available with Ubuntu Pro linux-image-4.15.0-226-lowlatency 4.15.0-226.238 Available with Ubuntu Pro linux-image-aws-lts-18.04 4.15.0.1169.167 Available with Ubuntu Pro linux-image-gcp-lts-18.04 4.15.0.1163.176 Available with Ubuntu Pro linux-image-generic 4.15.0.226.210 Available with Ubuntu Pro linux-image-kvm 4.15.0.1153.144 Available with Ubuntu Pro linux-image-lowlatency 4.15.0.226.210 Available with Ubuntu Pro linux-image-oracle-lts-18.04 4.15.0.1132.137 Available with Ubuntu Pro linux-image-virtual 4.15.0.226.210 Available with Ubuntu Pro Ubuntu 16.04 LTS linux-image-4.15.0-1132-oracle 4.15.0-1132.143~16.04.1 Available with Ubuntu Pro linux-image-4.15.0-1163-gcp 4.15.0-1163.180~16.04.1 Available with Ubuntu Pro linux-image-4.15.0-1169-aws 4.15.0-1169.182~16.04.1 Available with Ubuntu Pro linux-image-4.15.0-226-generic 4.15.0-226.238~16.04.1 Available with Ubuntu Pro linux-image-4.15.0-226-lowlatency 4.15.0-226.238~16.04.1 Available with Ubuntu Pro linux-image-aws-hwe 4.15.0.1169.182~16.04.1 Available with Ubuntu Pro linux-image-gcp 4.15.0.1163.180~16.04.1 Available with Ubuntu Pro linux-image-generic-hwe-16.04 4.15.0.226.238~16.04.1 Available with Ubuntu Pro linux-image-gke 4.15.0.1163.180~16.04.1 Available with Ubuntu Pro linux-image-lowlatency-hwe-16.04 4.15.0.226.238~16.04.1 Available with Ubuntu Pro linux-image-oem 4.15.0.226.238~16.04.1 Available with Ubuntu Pro linux-image-oracle 4.15.0.1132.143~16.04.1 Available with Ubuntu Pro linux-image-virtual-hwe-16.04 4.15.0.226.238~16.04.1 Available with Ubuntu Pro After a standard system update you need to reboot your computer to make all the necessary changes. It should be noted that other mechanisms for exploiting the underlying issues may be discovered. Also, this may cause issues for applications that rely on the unprivileged eBPF functionality. Please see the knowledge base article at https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/BHI for more details. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: Migration Toolkit for Containers (MTC) 1.7.2 security and bug fix update Advisory ID: RHSA-2022:5483-01 Product: Red Hat Migration Toolkit Advisory URL: https://access.redhat.com/errata/RHSA-2022:5483 Issue date: 2022-07-01 CVE Names: CVE-2018-25032 CVE-2020-0404 CVE-2020-4788 CVE-2020-13974 CVE-2020-19131 CVE-2020-27820 CVE-2020-35492 CVE-2021-0941 CVE-2021-3612 CVE-2021-3634 CVE-2021-3669 CVE-2021-3737 CVE-2021-3743 CVE-2021-3744 CVE-2021-3752 CVE-2021-3759 CVE-2021-3764 CVE-2021-3772 CVE-2021-3773 CVE-2021-3807 CVE-2021-4002 CVE-2021-4037 CVE-2021-4083 CVE-2021-4157 CVE-2021-4189 CVE-2021-4197 CVE-2021-4203 CVE-2021-20322 CVE-2021-21781 CVE-2021-26401 CVE-2021-29154 CVE-2021-37159 CVE-2021-41617 CVE-2021-41864 CVE-2021-42739 CVE-2021-43056 CVE-2021-43389 CVE-2021-43976 CVE-2021-44733 CVE-2021-45485 CVE-2021-45486 CVE-2022-0001 CVE-2022-0002 CVE-2022-0235 CVE-2022-0286 CVE-2022-0322 CVE-2022-0536 CVE-2022-1011 CVE-2022-1154 CVE-2022-1271 CVE-2022-23852 CVE-2022-26691 ==================================================================== 1. Summary: The Migration Toolkit for Containers (MTC) 1.7.2 is now available. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: The Migration Toolkit for Containers (MTC) enables you to migrate Kubernetes resources, persistent volume data, and internal container images between OpenShift Container Platform clusters, using the MTC web console or the Kubernetes API. Security Fix(es) from Bugzilla: * nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes (CVE-2021-3807) * node-fetch: exposure of sensitive information to an unauthorized actor (CVE-2022-0235) * follow-redirects: Exposure of Sensitive Information via Authorization Header leak (CVE-2022-0536) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. 3. Solution: For details on how to install and use MTC, refer to: https://docs.openshift.com/container-platform/latest/migration_toolkit_for_containers/installing-mtc.html 4. Bugs fixed (https://bugzilla.redhat.com/): 2007557 - CVE-2021-3807 nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes 2038898 - [UI] ?Update Repository? option not getting disabled after adding the Replication Repository details to the MTC web console 2040693 - ?Replication repository? wizard has no validation for name length 2040695 - [MTC UI] ?Add Cluster? wizard stucks when the cluster name length is more than 63 characters 2044591 - CVE-2022-0235 node-fetch: exposure of sensitive information to an unauthorized actor 2048537 - Exposed route host to image registry? connecting successfully to invalid registry ?xyz.com? 2053259 - CVE-2022-0536 follow-redirects: Exposure of Sensitive Information via Authorization Header leak 2055658 - [MTC UI] Cancel button on ?Migrations? page does not disappear when migration gets Failed/Succeeded with warnings 2056962 - [MTC UI] UI shows the wrong migration type info after changing the target namespace 2058172 - [MTC UI] Successful Rollback is not showing the green success icon in the ?Last State? field. 2058529 - [MTC UI] Migrations Plan is missing the type for the state migration performed before upgrade 2061335 - [MTC UI] ?Update cluster? button is not getting disabled 2062266 - MTC UI does not display logs properly [OADP-BL] 2062862 - [MTC UI] Clusters page behaving unexpectedly on deleting the remote cluster?s service account secret from backend 2074675 - HPAs of DeploymentConfigs are not being updated when migration from Openshift 3.x to Openshift 4.x 2076593 - Velero pod log missing from UI drop down 2076599 - Velero pod log missing from downloaded logs folder [OADP-BL] 2078459 - [MTC UI] Storageclass conversion plan is adding migstorage reference in migplan 2079252 - [MTC] Rsync options logs not visible in log-reader pod 2082221 - Don't allow Storage class conversion migration if source cluster has only one storage class defined [UI] 2082225 - non-numeric user when launching stage pods [OADP-BL] 2088022 - Default CPU requests on Velero/Restic are too demanding making scheduling fail in certain environments 2088026 - Cloud propagation phase in migration controller is not doing anything due to missing labels on Velero pods 2089126 - [MTC] Migration controller cannot find Velero Pod because of wrong labels 2089411 - [MTC] Log reader pod is missing velero and restic pod logs [OADP-BL] 2089859 - [Crane] DPA CR is missing the required flag - Migration is getting failed at the EnsureCloudSecretPropagated phase due to the missing secret VolumeMounts 2090317 - [MTC] mig-operator failed to create a DPA CR due to null values are passed instead of int [OADP-BL] 2096939 - Fix legacy operator.yml inconsistencies and errors 2100486 - [MTC UI] Target storage class field is not getting respected when clusters don't have replication repo configured. 5. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2022 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYr7qBNzjgjWX9erEAQgugw//ZP+OR2wysl+DmxNE9P5ri+kd/NBxdBKg C6vlBpczeXUvPLEFp03wuoBoagTRfib6xjrKdc8+joCQv6UFYcO1kjqZqgcZgBeu xJ6y7IzygYwK+nIoN3MP9YTYrejkwe7iaQnC3vLt3SIdg+u5s4N5kht4JPcnyRtY ERa6u3OBoJ9C62y+jeQct+lziaARoldGeRtXzA70PP7WJ9N0cEvlk3AkOHsxfhZS YXKPR+v94VlzU+egp97boMXZnvjvB/pGJLLtbPQtFsWIOMMzZ9iNHv2GsxQdsTyV 0GO1PlI7vRleqiYig1pHCjCuqJ4LUxWSis1AX3GYNRnqNC4RvYh8JBx82pKAR/eI jhFC/r0A0AGzmpjHgY2S+2nz+P/O93aKr+RFfW+T+LVwAt854a0KPzZyMNWx1NPV ccRq5kcphGCNMphRm0jqK2P1/urzIEVhCN4QgsJjqiEN+JGP4c2URdlcUXHOI6td cR7jZfNb4T/sPg64h9fzip/FRoZNV3kYE8jjUd/pmFv7iJvAwuPij0H/dZsix4Zr vboj+aDdTzuWU6pXLq0Z9xjlhh2Um172HsTimBxO6l5oXrzpVKvxFgi3dp56F2ql 6mkKuEr9gDWAxCkKBXsy5UQPNny7vxWc2cVGucevOYfF51zd/7cf1UDobG6scH2r wqRrUS7nR3w=nCFJ -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce

Various configuration pages of the device are vulnerable to reflected XSS (Cross-Site Scripting) attacks. An authorized attacker with user privileges may use this to gain access to confidential information on a PC that connects to the WBM after it has been compromised. 750-8100 firmware, 750-8101 firmware, 750-8102 Multiple Wago Japan Co., Ltd. products such as firmware contain a cross-site scripting vulnerability.Information may be obtained and information may be tampered with

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ecava IntegraXor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of WMF files within the Inkscape component. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current process.

A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause a disruption of communication between the Modicon controller and the engineering software, when an attacker is able to intercept and manipulate specific Modbus response data. Affected Product: EcoStruxure Process Expert (V2021 and prior), EcoStruxure Control Expert (V15.0 SP1 and prior)

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Ecava IntegraXor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of EMF files within the Inkscape component. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process.

A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause a disruption of communication between the Modicon controller and the engineering software when an attacker is able to intercept and manipulate specific Modbus response data. Affected Product: EcoStruxure Control Expert (V15.0 SP1 and prior)

Improper access control on the LocalMACConfig.asp interface allows an unauthenticated remote attacker to add (or remove) client MAC addresses to (or from) a list of banned hosts. Clients with those MAC addresses are then prevented from accessing either the WAN or the router itself. k2 firmware, k3 firmware, k3c firmware etc. PHICOMM The product contains an incorrect authentication vulnerability.Information may be tampered with

Use of a hard-coded cryptographic key pair by the telnetd_startup service allows an attacker on the local area network to obtain a root shell on the device over telnet. The builds of telnetd_startup included in the version 22.5.9.163 of the K2 firmware, and version 32.1.15.93 of the K3C firmware (possibly amongst many other releases) included both the private and public RSA keys. The remaining versions cited here redacted the private key, but left the public key unchanged. An attacker in possession of the leaked private key may, through a scripted exchange of UDP packets, instruct telnetd_startup to spawn an unauthenticated telnet shell as root, by means of which they can then obtain complete control of the device. A consequence of the limited availablility of firmware images for testing is that models and versions not listed here may share this vulnerability. PHICOMM of k2 firmware and k3c A vulnerability exists in the firmware regarding the use of hardcoded credentials.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Ecava IntegraXor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of PCX files within the Inkscape component. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process.

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Ecava IntegraXor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of EMF files within the Inkscape component. The issue results from the lack of proper initialization of a pointer prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process.

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Ecava IntegraXor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of EMF files within the Inkscape component. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process.

Improper access control on the LocalClientList.asp interface allows an unauthenticated remote attacker to obtain sensitive information concerning devices on the local area network, including IP and MAC addresses. Improper access control on the wirelesssetup.asp interface allows an unauthenticated remote attacker to obtain the WPA passphrases for the 2.4GHz and 5.0GHz wireless networks. This is particularly dangerous given that the K2G setup wizard presents the user with the option of using the same password for the 2.4Ghz network and the administrative interface, by clicking a checkbox. When Remote Managment is enabled, these endpoints are exposed to the WAN. k2 firmware, k3 firmware, k3c firmware etc. PHICOMM The product contains an incorrect authentication vulnerability.Information is obtained and service operation is interrupted (DoS) It may be in a state

The use of the RSA algorithm without OAEP, or any other padding scheme, in telnetd_startup, allows an unauthenticated attacker on the local area network to achieve a significant degree of control over the "plaintext" to which an arbitrary blob of ciphertext will be decrypted by OpenSSL's RSA_public_decrypt() function. This weakness allows the attacker to manipulate the various iterations of the telnetd startup state machine and eventually obtain a root shell on the device, by means of an exchange of crafted UDP packets. In all versions but K2 22.5.9.163 and K3C 32.1.15.93 a successful attack also requires the exploitation of a null-byte interaction error (CVE-2022-25219). k2 firmware, k3 firmware, k3c firmware etc. PHICOMM There are unspecified vulnerabilities in the product.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

A null byte interaction error has been discovered in the code that the telnetd_startup daemon uses to construct a pair of ephemeral passwords that allow a user to spawn a telnet service on the router, and to ensure that the telnet service persists upon reboot. By means of a crafted exchange of UDP packets, an unauthenticated attacker on the local network can leverage this null byte interaction error in such a way as to make those ephemeral passwords predictable (with 1-in-94 odds). Since the attacker must manipulate data processed by the OpenSSL function RSA_public_decrypt(), successful exploitation of this vulnerability depends on the use of an unpadded RSA cipher (CVE-2022-25218). k2 firmware, k3 firmware, k3c firmware etc. PHICOMM The product contains an interpretation conflict vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ecava IntegraXor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of EMF files within the Inkscape component. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current process.

Improper physical access control and use of hard-coded credentials in /etc/passwd permits an attacker with physical access to obtain a root shell via an unprotected UART port on the device. The same port exposes an unauthenticated Das U-Boot BIOS shell. k2 firmware, k3 firmware, k3c firmware etc. PHICOMM The product contains a vulnerability related to the use of hardcoded credentials.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

A CWE-294: Authentication Bypass by Capture-replay vulnerability exists that could cause an unauthenticated connection to the UPS when a malformed connection is sent. Affected Product: SmartConnect Family: SMT Series (SMT Series ID=1015: UPS 04.5 and prior), SMC Series (SMC Series ID=1018: UPS 04.2 and prior), SMTL Series (SMTL Series ID=1026: UPS 02.9 and prior), SCL Series (SCL Series ID=1029: UPS 02.5 and prior / SCL Series ID=1030: UPS 02.5 and prior / SCL Series ID=1036: UPS 02.5 and prior / SCL Series ID=1037: UPS 03.1 and prior), SMX Series (SMX Series ID=1031: UPS 03.1 and prior). Schneider Electric The product has Capture-replay An authentication bypass vulnerability exists.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Schneider Electric APC Smart-UPS SMC Series, etc. are all products of the French Schneider Electric (Schneider Electric). The Schneider Electric APC Smart-UPS SMC Series is an entry-level UPS for single server, low-power networking, and point-of-sale (POS) devices. Schneider Electric APC Smart-UPS SMT Series is a line interactive power protection for servers, point of sale, routers, switches, hubs and other network equipment. Schneider Electric APC Smart-UPS SMX Series is an intelligent and efficient network power protection

A CWE-287: Improper Authentication vulnerability exists that could cause an attacker to arbitrarily change the behavior of the UPS when a key is leaked and used to upload malicious firmware. Affected Product: APC Smart-UPS Family: SMT Series (SMT Series ID=18: UPS 09.8 and prior / SMT Series ID=1040: UPS 01.2 and prior / SMT Series ID=1031: UPS 03.1 and prior), SMC Series (SMC Series ID=1005: UPS 14.1 and prior / SMC Series ID=1007: UPS 11.0 and prior / SMC Series ID=1041: UPS 01.1 and prior), SCL Series (SCL Series ID=1030: UPS 02.5 and prior / SCL Series ID=1036: UPS 02.5 and prior), SMX Series (SMX Series ID=20: UPS 10.2 and prior / SMX Series ID=23: UPS 07.0 and prior), SRT Series (SRT Series ID=1010/1019/1025: UPS 08.3 and prior / SRT Series ID=1024: UPS 01.0 and prior / SRT Series ID=1020: UPS 10.4 and prior / SRT Series ID=1021: UPS 12.2 and prior / SRT Series ID=1001/1013: UPS 05.1 and prior / SRT Series ID=1002/1014: UPSa05.2 and prior), APC SmartConnect Family: SMT Series (SMT Series ID=1015: UPS 04.5 and prior), SMC Series (SMC Series ID=1018: UPS 04.2 and prior), SMTL Series (SMTL Series ID=1026: UPS 02.9 and prior), SCL Series (SCL Series ID=1029: UPS 02.5 and prior / SCL Series ID=1030: UPS 02.5 and prior / SCL Series ID=1036: UPS 02.5 and prior / SCL Series ID=1037: UPS 03.1 and prior), SMX Series (SMX Series ID=1031: UPS 03.1 and prior). Schneider Electric Made APC Smart-UPS Family and APC SmartConnect Family The product contains an authentication vulnerability.Information is tampered with and denial of service (DoS) It may be put into a state. Schneider Electric APC Smart-UPS SMC Series, etc. are all products of the French Schneider Electric (Schneider Electric). The Schneider Electric APC Smart-UPS SMC Series is an entry-level UPS for single server, low-power networking, and point-of-sale (POS) devices. Schneider Electric APC Smart-UPS SMT Series is a line interactive power protection for servers, point of sale, routers, switches, hubs and other network equipment. Schneider Electric APC Smart-UPS SRT Series is a high density, true double conversion online power protection

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Ecava IntegraXor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of EMF files within the Inkscape component. The issue results from the lack of proper initialization of a pointer prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process.

Hardware allows activation of test or debug logic at runtime for some Intel(R) Trace Hub instances which may allow an unauthenticated user to potentially enable escalation of privilege via physical access