Page 2 of 17 results (0.005 seconds)

CVSS: 6.7EPSS: 0%CPEs: 546EXPL: 0

Improper input validation in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access. Una comprobación de entrada inapropiada en el firmware para algunos Intel® Processors puede habilitar a un usuario privilegiado para permitir potencialmente una escalada de privilegios por medio de un acceso local • https://security.netapp.com/advisory/ntap-20210702-0002 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00463.html • CWE-20: Improper Input Validation •

CVSS: 6.4EPSS: 0%CPEs: 567EXPL: 0

Race condition in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access. Una condición de carrera en el firmware de algunos Intel® Processors puede habilitar a un usuario privilegiado para permitir potencialmente una escalada de privilegios por medio de un acceso local • https://cert-portal.siemens.com/productcert/pdf/ssa-309571.pdf https://security.netapp.com/advisory/ntap-20210702-0002 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00463.html • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •

CVSS: 6.7EPSS: 0%CPEs: 568EXPL: 0

Improper initialization in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access. Una inicialización inapropiada en el firmware de algunos Intel® Processors puede habilitar a un usuario privilegiado para permitir potencialmente una escalada de privilegios por medio de un acceso local • https://cert-portal.siemens.com/productcert/pdf/ssa-309571.pdf https://security.netapp.com/advisory/ntap-20210702-0002 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00463.html • CWE-665: Improper Initialization •

CVSS: 8.8EPSS: 0%CPEs: 15EXPL: 0

An issue was discovered in the Linux kernel through 5.10.1, as used with Xen through 4.14.x. The Linux kernel PV block backend expects the kernel thread handler to reset ring->xenblkd to NULL when stopped. However, the handler may not have time to run if the frontend quickly toggles between the states connect and disconnect. As a consequence, the block backend may re-use a pointer after it was freed. A misbehaving guest can trigger a dom0 crash by continuously connecting / disconnecting a block frontend. • https://lists.debian.org/debian-lts-announce/2021/02/msg00018.html https://lists.debian.org/debian-lts-announce/2021/03/msg00010.html https://security.gentoo.org/glsa/202107-30 https://security.netapp.com/advisory/ntap-20210205-0001 https://www.debian.org/security/2021/dsa-4843 https://xenbits.xenproject.org/xsa/advisory-350.html • CWE-416: Use After Free •

CVSS: 3.6EPSS: 0%CPEs: 12EXPL: 2

An issue was discovered in the Linux kernel before 5.7.3, related to mm/gup.c and mm/huge_memory.c. The get_user_pages (aka gup) implementation, when used for a copy-on-write page, does not properly consider the semantics of read operations and therefore can grant unintended write access, aka CID-17839856fd58. Se detectó un problema en el kernel de Linux versiones anteriores a 5.7.3, relacionado con los archivos mm/gup.c y mm/huge_memory.c. La implementación de la función get_user_pages (también se conoce como gup), cuando se usa para una página copy-on-write, no considera apropiadamente la semántica de las operaciones de lectura y, por lo tanto, puede otorgar acceso de escritura involuntario, también se conoce como CID-17839856fd58 • http://packetstormsecurity.com/files/162117/Kernel-Live-Patch-Security-Notice-LSN-0075-1.html https://bugs.chromium.org/p/project-zero/issues/detail?id=2045 https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.7.3 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=17839856fd588f4ab6b789f482ed3ffd7c403e1f https://lists.debian.org/debian-lts-announce/2021/06/msg00019.html https://lists.debian.org/debian-lts-announce/2021/06/msg00020.html https://lists.debi • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-863: Incorrect Authorization •