| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to a stack-based buffer overflow. |
| A buffer overflow vulnerability exists in the Palo Alto Networks GlobalProtect™ app that enables a man-in-the-middle (MitM) attacker or a rogue gateway to disrupt system processes and potentially execute arbitrary code with elevated privileges (SYSTEM privileges on Windows, and root privileges on macOS and Linux). |
| AI_ONLY_REPORT
package: iscsi-initiator-utils-6.2.1.11-0.git4b3e853.el10
------
Summary: Out-of-Bounds Write and Information Disclosure via Unvalidated
IPv6 Payload Length: crafted ICMPv6 Echo Requests can cause `iscsiuio` to
trust an inflated `ipv6_plen` larger than the actual received payload,
leading to MTU-bounded out-of-bounds reads and a potential one-byte
out-of-bounds write that may disclose data beyond the valid packet boundary.
Requirements to exploit: Adjacent-network access on the same L2 segment as
a system running `iscsiuio` on an interface that processes IPv6/NDP
traffic, plus the ability to send a crafted ICMPv6 Echo Request with a
forged `IPv6.plen`. No authentication or user interaction is required.
Component affected: `iscsi-initiator-utils` (`iscsiuio`):
`iscsiuio/src/uip/ipv6.c` in `ipv6_icmp_handle_echo_request()` and
`ipv6_insert_protocol_chksum()`.
Version affected: `iscsi-initiator-utils-6.2.1.11-0.git4b3e853.el10` when
`iscsiuio` is processing IPv6/NDP traffic on a reachable interface.
Patch available: no released package fix established; proposed patch
included below
Version fixed: unknown
Upstream coordination: Not notified.
CVSS: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - 6.3 (MEDIUM)
AV:A - Reachability is limited to an attacker on the same L2 segment who
can send crafted IPv6/ICMPv6 traffic to the affected interface.
AC:L - The attack relies on forging `IPv6.plen`; no race or unusual
environment is needed beyond the vulnerable deployment.
PR:N - No privileges are required.
UI:N - No user interaction is required.
S:U - The impact remains within the `iscsiuio` process and its packet
buffer handling.
C:L - The reply/checksum path can read and potentially transmit data
beyond the valid packet boundary, but the demonstrated exposure is
MTU-bounded.
I:L - For odd forged lengths, the checksum path can write a single
padding byte past the valid protocol data, which may affect adjacent buffer
contents.
A:L - Invalid memory access may destabilize or crash the process, but
reliable high-impact denial of service is not established from the
available evidence.
Impact: Moderate. Under Red Hat's severity guidance, this is more
consistent with a flaw that can affect confidentiality, integrity, or
availability under constrained circumstances than with an Important issue.
The bug is unauthenticated and adjacent-network reachable, but the
currently supported outcome is MTU-bounded out-of-bounds access in a
deployment-dependent IPv6/NDP path, not easy remote system compromise or
clearly high-impact memory corruption.
Embargo: no
Reason: The currently supported impact is Moderate, exposure depends on
`iscsiuio` processing IPv6 traffic on a reachable L2 segment, and operators
can reduce exposure operationally by isolating or disabling the affected
path.
Acknowledgement: Aisle Research
Vulnerability Details: In the ICMPv6 echo-reply path, the code reuses the
inbound `ipv6_plen` field when sizing the reply instead of clamping it to
the bytes actually received:
```c
/* iscsiuio/src/uip/ipv6.c */
static void ipv6_icmp_handle_echo_request(struct ipv6_context *context)
{
...
ipv6_send(context, (u8_t *) icmp - (u8_t *) eth +
sizeof(struct ipv6_hdr) + HOST_TO_NET16(ipv6->ipv6_plen));
}
```
Later, checksum generation also trusts `ipv6_plen` for memory traversal,
and for odd lengths it writes a padding byte at `ptr + protocol_data_len`
before iterating over `protocol_data_len` bytes:
```c
/* iscsiuio/src/uip/ipv6.c */
protocol_data_len = HOST_TO_NET16(ipv6->ipv6_plen);
...
if (protocol_data_len & 1) {
*((u8_t *) ptr + protocol_data_len) = 0;
protocol_data_len++;
}
for (i = 0; i < protocol_data_len / 2; i++) {
sum += HOST_TO_NET16(*ptr);
ptr++;
}
```
The available receive-side logic does not establish a payload-length bound
strong enough to eliminate this condition. `uip_input()` compares the IPv6
payload length against `uip_len`, but `uip_len` is treated as full frame
length in the observed path rather than the actual IPv6 payload length, and
`ipv6_rx_packet()` receives a `len` argument without using it to bound
parsing. A forged `ipv6_plen` can therefore exceed the real IPv6 payload
stored in the buffer. The available evidence supports MTU-bounded
out-of-bounds access in normal receive paths rather than the earlier
arbitrary 64KB worst case. The affected logic appears to be present in the
available 6.2.1.11 code base, but this report is scoped to the scanned SRPM
package.
Steps to reproduce:
1. Build `iscsiuio` with ASAN enabled.
2. Run `iscsiuio` with IPv6/NDP active on a test interface.
3. From the same L2 segment, send an ICMPv6 Echo Request with `IPv6.plen`
set larger than the actual payload bytes in the frame buffer; one tested
shape is `plen=1491` with an Ethernet frame size near 1500 bytes.
4. Observe the reply path: ASAN reports invalid access in
`ipv6_insert_protocol_chksum()` as the checksum walk reads past valid
packet data, odd lengths may also trigger a one-byte write, and reply
sizing is derived from the forged `ipv6_plen` rather than the actual
received payload size.
Mitigation: Until a fix is available, keep `iscsiuio`-managed interfaces on
trusted L2 segments only. Where operationally acceptable, disable IPv6 on
those interfaces or filter ICMPv6 Echo Requests before they reach
`iscsiuio`. If `iscsiuio` is not processing IPv6/NDP traffic, this specific
path is not reachable.
Proposed Fix: Clamp the reply payload length to the actual received payload
derived from `context->ustack->uip_len`, reject packets too short to
contain a complete ICMPv6 header, and rewrite `ipv6->ipv6_plen` before
calling `ipv6_send()`.
```diff
diff --git a/iscsiuio/src/uip/ipv6.c b/iscsiuio/src/uip/ipv6.c
@@ -1100,6 +1100,8 @@ static void ipv6_icmp_handle_echo_request(struct
ipv6_context *context)
{
struct eth_hdr *eth =
(struct eth_hdr *)context->ustack->data_link_layer;
+u16_t rx_total, rx_payload, hdr_plen, safe_plen;
+u16_t l2_l3_len = sizeof(struct eth_hdr) + sizeof(struct ipv6_hdr);
struct ipv6_hdr *ipv6 =
(struct ipv6_hdr *)context->ustack->network_layer;
struct icmpv6_hdr *icmp = (struct icmpv6_hdr *)((u8_t *)ipv6 +
@@ -1126,8 +1128,20 @@ static void ipv6_icmp_handle_echo_request(struct
ipv6_context *context)
icmp->icmpv6_code = 0;
icmp->icmpv6_cksum = 0;
ILOG_DEBUG("IPv6: Send echo reply");
-ipv6_send(context, (u8_t *) icmp - (u8_t *) eth +
sizeof(struct ipv6_hdr) + HOST_TO_NET16(ipv6>ipv6_plen));
+
+rx_total = context->ustack->uip_len;
+if (rx_total <= l2_l3_len)
+return;
+
+rx_payload = rx_total - l2_l3_len;
+hdr_plen = HOST_TO_NET16(ipv6->ipv6_plen);
+safe_plen = (hdr_plen <= rx_payload) ? hdr_plen : rx_payload;
+if (safe_plen < sizeof(struct icmpv6_hdr))
+return;
+
+ipv6->ipv6_plen = HOST_TO_NET16(safe_plen);
+ipv6_send(context, l2_l3_len + safe_plen);
+
return;
}
```
------
This report was generated using AI technology. Always review AI-generated
content prior to use |
| A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded. |
| Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally. |
| Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted .traineddata LSTM model component loaded through Tesseract's deserializer can cause an unchecked signed integer multiplication in Convolve::DeSerialize in src/lstm/convolve.cpp to wrap the convolution output-channel count, undersizing the forward-pass output buffer while writes use the unwrapped element count and causing a heap out-of-bounds write during OCR recognition. This issue is fixed in version 5.5.3. |
| Out-of-bounds write for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may allow a denial of service. Network adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via adjacent access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (low) impacts. |
| Out-of-bounds write for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may allow a denial of service. Network adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via adjacent access when attack requirements are not present without special internal knowledge and requires passive user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (low) impacts. |
| CivetWeb (commit 4a4f0c95) contains a heap and stack buffer overflow vulnerability in the read_websocket() function that allows unauthenticated remote attackers to corrupt memory by sending compressed WebSocket frames when both USE_ZLIB and MG_EXPERIMENTAL_INTERFACES are defined. Attackers can negotiate permessage-deflate during the WebSocket handshake and send a crafted frame with the RSV1 bit set, causing the server to write a 4-byte zlib sync trailer out-of-bounds past the allocated buffer, leading to heap metadata corruption, denial of service, or potential code execution. |
| In the Linux kernel, the following vulnerability has been resolved:
iommu/amd: Bound the early ACPI HID map
The ivrs_acpihid command-line parser appends entries to a fixed
four-element early_acpihid_map array. Unlike the sibling IOAPIC and HPET
parsers, it does not reject a fifth entry before incrementing the map size.
Check the capacity at the common found label before parsing the HID and
UID or writing the entry. |
| Missing bounds check in the annotator function of Zoom Clients allows buffer over-write, which may allow a meeting participant to achieve remote code execution of another participant via network access. |
| In the Linux kernel, the following vulnerability has been resolved:
USB: serial: io_edgeport: cap received transmit credits
The interrupt-status packet reports transmit credits returned by the
device. edge_interrupt_callback() adds the 16-bit value to txCredits
without checking maxTxCredits.
edge_write() uses txCredits minus the software FIFO count as the amount
of data that fits. Since the FIFO is allocated with maxTxCredits bytes,
txCredits exceeding maxTxCredits can cause OOB write in ring buffer.
Cap accumulated credits at maxTxCredits. Conforming devices should never
hit the cap. |
| In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu/gfx: fix cleaner shader IB buffer overflow
The cleaner shader sysfs path allocates a 16-dword (64 byte) IB but
incorrectly fills (align_mask + 1) dwords. On GFX rings align_mask is
0xff, so the loop wrote 256 dwords into a 64-byte buffer, causing a
kernel page fault.
The IB only needs to be a minimal NOP shell to schedule the job; the
cleaner shader itself is emitted on the ring via emit_cleaner_shader().
Fill 16 dwords to match the allocation.
v2: Use ib_size_dw variable (Lijo)
(cherry picked from commit bf21af331ebf72d0935fd70c73192414a422c03a) |
| Out-of-bounds write in the firmware for the Intel(R) Slim Bootloader may allow a denial of service. System software adversary with a privileged user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. |
