CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2021-44828
https://notcve.org/view.php?id=CVE-2021-44828
Arm Mali GPU Kernel Driver (Midgard r26p0 through r30p0, Bifrost r0p0 through r34p0, and Valhall r19p0 through r34p0) allows a non-privileged user to achieve write access to read-only memory, and possibly obtain root privileges, corrupt memory, and modify the memory of other processes. El controlador del kernel de la GPU Arm Mali (Midgard versiones r26p0 hasta r30p0, Bifrost r0p0 a r34p0, y Valhall versiones r19p0 hasta r34p0) permite a un usuario no privilegiado conseguir acceso de escritura a la memoria de sólo lectura, y posiblemente alcanzar privilegios de root, corromper la memoria y modificar la memoria de otros procesos • https://developer.arm.com/support/arm-security-updates/mali-gpu-kernel-driver • CWE-787: Out-of-bounds Write •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2021-45450
https://notcve.org/view.php?id=CVE-2021-45450
In Mbed TLS before 2.28.0 and 3.x before 3.1.0, psa_cipher_generate_iv and psa_cipher_encrypt allow policy bypass or oracle-based decryption when the output buffer is at memory locations accessible to an untrusted application. En Mbed TLS versiones anteriores a 2.28.0 y 3.x versiones anteriores a 3.1.0, las funciones psa_cipher_generate_iv y psa_cipher_encrypt permiten omitir la política o el descifrado basado en oráculos cuando el búfer de salida es encontrado en ubicaciones de memoria accesibles para una aplicación no confiable • https://github.com/ARMmbed/mbedtls/releases/tag/v2.28.0 https://github.com/ARMmbed/mbedtls/releases/tag/v3.1.0 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IL66WKJGXY5AXMTFE7QDMGL3RIBD6PX5 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TALJHOYAYSUJTLN6BYGLO4YJGNZUY74W https://security.gentoo.org/glsa/202301-08 • CWE-327: Use of a Broken or Risky Cryptographic Algorithm •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2021-45451
https://notcve.org/view.php?id=CVE-2021-45451
In Mbed TLS before 3.1.0, psa_aead_generate_nonce allows policy bypass or oracle-based decryption when the output buffer is at memory locations accessible to an untrusted application. En Mbed TLS versiones anteriores a 3.1.0, la función psa_aead_generate_nonce permite omitir la política o el descifrado basado en oráculos cuando el búfer de salida es encontrada en ubicaciones de memoria accesibles para una aplicación no confiable • https://github.com/ARMmbed/mbedtls/releases/tag/v3.1.0 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IL66WKJGXY5AXMTFE7QDMGL3RIBD6PX5 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TALJHOYAYSUJTLN6BYGLO4YJGNZUY74W • CWE-327: Use of a Broken or Risky Cryptographic Algorithm •
CVSS: 9.8EPSS: 0%CPEs: 5EXPL: 1CVE-2021-44732
https://notcve.org/view.php?id=CVE-2021-44732
Mbed TLS before 3.0.1 has a double free in certain out-of-memory conditions, as demonstrated by an mbedtls_ssl_set_session() failure. Mbed TLS versiones anteriores a 3.0.1,presenta una doble liberación en determinadas condiciones de salida de memoria, como es demostrado por un fallo de la función mbedtls_ssl_set_session() • https://bugs.gentoo.org/829660 https://github.com/ARMmbed/mbedtls/releases https://github.com/ARMmbed/mbedtls/releases/tag/v2.16.12 https://github.com/ARMmbed/mbedtls/releases/tag/v2.28.0 https://github.com/ARMmbed/mbedtls/releases/tag/v3.1.0 https://lists.debian.org/debian-lts-announce/2022/12/msg00036.html https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2021-12 • CWE-415: Double Free •
CVSS: 3.6EPSS: 0%CPEs: 8EXPL: 0CVE-2021-35465
https://notcve.org/view.php?id=CVE-2021-35465
Certain Arm products before 2021-08-23 do not properly consider the effect of exceptions on a VLLDM instruction. A Non-secure handler may have read or write access to part of a Secure context. This affects Arm Cortex-M33 r0p0 through r1p0, Arm Cortex-M35P r0, Arm Cortex-M55 r0p0 through r1p0, and Arm China STAR-MC1 (in the STAR SE configuration). Determinados productos de Arm antes del 23-08-2021 no consideran apropiadamente el efecto de las excepciones en una instrucción VLLDM. Un manejador no seguro puede tener acceso de lectura o escritura a parte de un contexto seguro. • https://developer.arm.com/support/arm-security-updates https://developer.arm.com/support/arm-security-updates/vlldm-instruction-security-vulnerability •