| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Exposure of sensitive system information to an unauthorized control sphere in Windows Print Spooler Components allows an authorized attacker to disclose information over a network. |
| Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally. |
| Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally. |
| Stored XSS via avatar upload chained with an authentication bypass in /Attachments leads to ATO
in Cervantes version v1.3-beta could allow an attacker to execute arbitrary code in another user's browser with elevated privileges |
| Use after free in Windows SMB Client allows an authorized attacker to elevate privileges locally. |
| Improper access control in Microsoft Account allows an authorized attacker to perform tampering locally. |
| Buffer over-read in Windows USB Video Driver allows an authorized attacker to elevate privileges locally. |
| Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Fast FAT Driver allows an authorized attacker to elevate privileges locally. |
| Use after free in Windows Filter Manager allows an authorized attacker to elevate privileges locally. |
| Out-of-bounds read in Desktop Window Manager allows an authorized attacker to elevate privileges locally. |
| Improper neutralization of special elements used in a command ('command injection') in Windows Active Directory allows an authorized attacker to elevate privileges over a network. |
| Missing authentication for critical function in Azure OpenAI allows an unauthorized attacker to elevate privileges over a network. |
| Execution with unnecessary privileges in Windows PowerShell allows an authorized attacker to bypass a security feature locally. |
| Heap-based buffer overflow in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally. |
| Untrusted search path in Microsoft Windows App Store allows an authorized attacker to elevate privileges locally. |
| Use after free in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally. |
| In the Linux kernel, the following vulnerability has been resolved:
inet: reject unhashed sockets during established lookups
TCP established ehash lookups are lockless. The socket caches involved
use SLAB_TYPESAFE_BY_RCU, so memory can be reused before an RCU reader
that retained its old address has finished.
After a tuple match, __inet_lookup_established() and
__inet6_lookup_established() acquire a reference and repeat the tuple
check. They do not check whether the new object is hashed. If the
address is reused for a socket with the same tuple, the lookup can
acquire a reference to the new object and return it while its nulls node
is unhashed.
A PoC that drives reuse with a SYN cookie request socket reproduced the
crash. The new request socket is unhashed and has a NULL rsk_listener.
A lookup that had loaded the address of the old request socket acquired
the reference published by tcp_get_cookie_sock() and returned the new
object. tcp_v4_rcv() then read sk_state through the NULL listener.
The resulting crash was:
BUG: kernel NULL pointer dereference, address: 0000000000000012
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
...
Oops: Oops: 0000 [#1] SMP NOPTI
CPU: 4 UID: 0 PID: 0 Comm: swapper/4 Not tainted 7.3.0-00591-g0e135910deec #1 PREEMPT(lazy)
...
RIP: 0010:tcp_v4_rcv+0x44e/0x1280
...
R10: 0000000000000001 R11: 00000000024ca8c0 R12: 0000000000000000
...
CR2: 0000000000000012 CR3: 0000000103d50004 CR4: 0000000000770ef0
...
Call Trace:
<IRQ>
? raw_local_deliver+0xae/0x240
ip_protocol_deliver_rcu+0x2d/0x180
ip_local_deliver_finish+0x84/0x100
ip_sublist_rcv_finish+0x5f/0x70
ip_sublist_rcv+0x12a/0x1d0
ip_list_rcv+0xfd/0x130
__netif_receive_skb_list_core+0x223/0x250
netif_receive_skb_list_internal+0x1d2/0x2c0
? try_fill_recv+0x39/0x7b0
napi_complete_done+0x74/0x170
virtnet_poll+0x445/0x600
__napi_poll+0x27/0x1e0
net_rx_action+0x2fe/0x3b0
handle_softirqs+0xc2/0x2c0
__irq_exit_rcu+0x74/0xd0
common_interrupt+0x7f/0x90
</IRQ>
...
Kernel panic - not syncing: Fatal exception in interrupt
After taking a reference, check whether the nulls node is unhashed in
both IPv4 and IPv6 established lookups. If it is unhashed or the tuple
no longer matches, drop the reference and restart the lookup.
Lookups racing with the TIME_WAIT hashdance, or with a request being
replaced by its child, now restart and find the new socket instead of
returning the old one.
Request sockets that were never inserted into ehash can have a nonzero
refcount, and a stale lookup can hold a transient reference. Therefore,
when SYN cookie, Fast Open, and request migration paths fail after
setting a nonzero refcount, release the references held by those paths
with reqsk_put() instead of freeing the request directly. |
| Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally. |
| Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. |
| Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. |
