CVSS: 6.7EPSS: 0%CPEs: 126EXPL: 0CVE-2023-20568
https://notcve.org/view.php?id=CVE-2023-20568
Improper signature verification of RadeonTM RX Vega M Graphics driver for Windows may allow an attacker with admin privileges to launch RadeonInstaller.exe without validating the file signature potentially leading to arbitrary code execution. La verificación inadecuada de la firma del controlador RadeonTM RX Vega M Graphics para Windows puede permitir que un atacante con privilegios de administrador inicie RadeonInstaller.exe sin validar la firma del archivo, lo que podría provocar la ejecución de código arbitrario. • https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-6003 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00971.html • CWE-347: Improper Verification of Cryptographic Signature •
CVSS: 6.7EPSS: 0%CPEs: 126EXPL: 0CVE-2023-20567
https://notcve.org/view.php?id=CVE-2023-20567
Improper signature verification of RadeonTM RX Vega M Graphics driver for Windows may allow an attacker with admin privileges to launch AMDSoftwareInstaller.exe without validating the file signature potentially leading to arbitrary code execution. La verificación inadecuada de la firma del controlador RadeonTM RX Vega M Graphics para Windows puede permitir que un atacante con privilegios de administrador inicie AMDSoftwareInstaller.exe sin validar la firma del archivo, lo que podría provocar la ejecución de código arbitrario. • https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-6003 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00971.html • CWE-347: Improper Verification of Cryptographic Signature •
CVSS: 5.5EPSS: 0%CPEs: 126EXPL: 0CVE-2021-46748
https://notcve.org/view.php?id=CVE-2021-46748
Insufficient bounds checking in the ASP (AMD Secure Processor) may allow an attacker to access memory outside the bounds of what is permissible to a TA (Trusted Application) resulting in a potential denial of service. Una verificación de límites insuficiente en el ASP (AMD Secure Processor) puede permitir que un atacante acceda a la memoria fuera de los límites de lo permitido para una TA (Trusted Application), lo que resulta en una posible denegación de servicio. • https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-6003 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00971.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.5EPSS: 0%CPEs: 288EXPL: 0CVE-2022-29901 – Arbitrary Memory Disclosure through CPU Side-Channel Attacks (Retbleed)
https://notcve.org/view.php?id=CVE-2022-29901
Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can hijack return instructions to achieve arbitrary speculative code execution under certain microarchitecture-dependent conditions. Las generaciones de microprocesadores Intel 6 a 8 están afectadas por una nueva variante de Spectre que es capaz de omitir su mitigación de retpoline en el kernel para filtrar datos arbitrarios. Un atacante con acceso de usuario no privilegiado puede secuestrar las instrucciones de retorno para lograr una ejecución arbitraria de código especulativo bajo determinadas condiciones dependientes de la microarquitectura A flaw was found in hw. Non-transparent sharing of branch predictor targets between contexts in some Intel(R) processors may potentially allow an authorized user to enable information disclosure via local access. • http://www.openwall.com/lists/oss-security/2022/07/12/2 http://www.openwall.com/lists/oss-security/2022/07/12/4 http://www.openwall.com/lists/oss-security/2022/07/12/5 http://www.openwall.com/lists/oss-security/2022/07/13/1 https://comsec.ethz.ch/retbleed https://lists.debian.org/debian-lts-announce/2022/09/msg00011.html https://lists.debian.org/debian-lts-announce/2022/12/msg00034.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fed • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-668: Exposure of Resource to Wrong Sphere •
CVSS: 5.5EPSS: 0%CPEs: 814EXPL: 0CVE-2022-21180
https://notcve.org/view.php?id=CVE-2022-21180
Improper input validation for some Intel(R) Processors may allow an authenticated user to potentially cause a denial of service via local access. Una comprobación inapropiada de entradas en algunos procesadores Intel(R) puede permitir que un usuario autenticado cause potencialmente una denegación de servicio por medio de acceso local • http://www.openwall.com/lists/oss-security/2022/06/16/1 https://security.netapp.com/advisory/ntap-20220624-0006 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00645.html • CWE-20: Improper Input Validation •