Ismael Ripoll

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions through 4.5.2 **Description** The issue concerns the arch pick mmap layout function in the Linux kernel, which fails to properly randomize the legacy base address. This makes it easier for local users to bypass the ASLR protection mechanism for a setuid or setgid program by disabling stack-consumption resource limits, thus defeating the intended restrictions on the ADDR NO RANDOMIZE flag. **Recommendations** For Linux kernel versions through 4.5.2, update to a version that includes a fix for this issue to ensure proper randomization of the legacy base address and maintain the effectiveness of the ASLR protection mechanism.

**Name of the Vulnerable Software and Affected Versions** Grub2 versions 1.98 through 2.02 **Description** The issue is caused by multiple integer underflows that allow physically proximate attackers to bypass authentication, obtain sensitive information, or cause a denial of service (disk corruption). This can be achieved via backspace characters in the `grub username get` function in grub-core/normal/auth.c or the `grub password get` function in lib/crypto.c, triggering an "Off-by-two" or "Out of bounds overwrite" memory error. **Recommendations** For Grub2 versions 1.98 through 2.02, as a temporary workaround, consider disabling the `grub username get` and `grub password get` functions until a patch is available. Restrict access to the grub-core/normal/auth.c and lib/crypto.c modules to minimize the risk of exploitation. Avoid using backspace characters in the affected functions until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.