Andy Nguyen

**Name of the Vulnerable Software and Affected Versions** Intel Processors (affected versions not specified) **Description** A sequence of processor instructions can lead to unexpected behavior in some Intel processors, potentially allowing an authenticated user to enable escalation of privilege, information disclosure, or denial of service via local access. This issue is related to the interpretation of redundant prefixes and can cause the system to crash or become unresponsive. The vulnerability, termed Reptar, primarily affects multi-tenant virtualized environments where multiple virtual machines are run on the same host. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Oracle VM VirtualBox versions prior to 7.0.12 **Description** The issue is related to insufficient input validation in the Core component of Oracle VM VirtualBox, allowing a high-privileged attacker with logon access to the infrastructure to compromise Oracle VM VirtualBox. Successful attacks can result in the takeover of Oracle VM VirtualBox and may significantly impact additional products due to scope change. **Recommendations** To resolve the issue, update Oracle VM VirtualBox to version 7.0.12 or later. As a temporary workaround, consider restricting access to the Core component of Oracle VM VirtualBox until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Oracle VM VirtualBox versions prior to 7.0.12 **Description** The issue is related to insufficient input validation in the Core component of Oracle VM VirtualBox, allowing a high-privileged attacker with logon to the infrastructure to compromise Oracle VM VirtualBox. Successful attacks can result in the takeover of Oracle VM VirtualBox and may significantly impact additional products. The vulnerability is easily exploitable and can lead to confidentiality, integrity, and availability impacts. **Recommendations** Update to version 7.0.12 or later to resolve the issue. As a temporary workaround, consider restricting access to the Core component of Oracle VM VirtualBox until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Oracle VM VirtualBox versions prior to 7.0.12 **Description** The issue is related to insufficient input validation in the Core component of Oracle VM VirtualBox, allowing a high-privileged attacker with logon to the infrastructure to compromise Oracle VM VirtualBox. Successful attacks can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data and the ability to cause a hang or frequently repeatable crash of Oracle VM VirtualBox. This may significantly impact additional products due to scope change. **Recommendations** For Oracle VM VirtualBox versions prior to 7.0.12, update to version 7.0.12 or later to resolve the issue. As a temporary workaround, consider restricting access to the Core component of Oracle VM VirtualBox to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Sony PS4 and PS5 (affected versions not specified) **Description** A critical issue affects the `exFAT Handler` component, specifically the `UVFAT readupcasetable` function. The manipulation of the `dataLength` argument leads to a heap-based buffer overflow. This issue can be exploited by launching an attack on the physical device. **Recommendations** Upgrade the affected `exFAT Handler` component to a newer version. As a temporary workaround, consider restricting access to the `UVFAT readupcasetable` function until a patch is available. Avoid manipulating the `dataLength` argument in the affected component until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** FFMPEG versions 5.1 and later **Description** A heap out-of-bounds memory write exists in the `build open gop key points()` function due to an integer overflow. This occurs when the size calculation adds `sc->ctts data[i].count` to `sc->sample offsets count`, potentially resulting in a small allocation with `av calloc()`. An attacker can cause remote code execution via a malicious mp4 file. **Recommendations** For FFMPEG versions 5.1 and later, upgrade past commit c953baa084607dd1d84c3bfcce3cf6a87c3e6e05 to resolve the issue. As a temporary workaround, consider restricting access to malicious mp4 files to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A kernel data leak issue has been identified in the Linux kernel, specifically in the KVM: SVM component. The issue arises when using certain sev ioctl interfaces, where the length parameter passed may be less than or equal to SEV FW BLOB MAX SIZE but larger than the data returned by PSP firmware. As a result, kmalloc allocates memory based on the input size rather than the data size, and since PSP firmware does not fully overwrite the allocated buffer, these sev ioctl interfaces may return uninitialized kernel slab memory. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux versions prior to 2.6.19-rc1 are not specified, but versions since v2.6.19-rc1 are affected. **Description** The issue is related to a heap out-of-bounds write in the netfilter subsystem of the Linux kernel, specifically in the net/netfilter/x tables.c file. This allows an attacker to gain privileges or cause a denial of service through user name space by exploiting the vulnerability in the xt compat target from user() function. The vulnerability can be exploited by calling compat setsockopt() with IPT SO SET REPLACE or IP6T SO SET REPLACE values set. A proof of concept exploit has been developed, which can bypass security mechanisms such as KASLR, SMAP, and SMEP, and achieve kernel code execution. The researcher who discovered the vulnerability received a $20,000 reward from Google for identifying a method to bypass container isolation in a Kubernetes cluster. **Recommendations** As a temporary workaround, consider disabling the xt compat target from user() function until a patch is available. Restrict access to the netfilter subsystem to minimize the risk of exploitation. Avoid using the compat setsockopt() function with IPT SO SET REPLACE or IP6T SO SET REPLACE values set until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Apple iOS versions prior to 13.6 Apple iPadOS versions prior to 13.6 Apple macOS Catalina versions prior to 10.15.6 Apple tvOS versions prior to 13.4.8 Apple watchOS versions prior to 6.2.8 **Description** The issue involves multiple memory corruption problems that have been resolved through improved state management. A malicious application may be able to execute arbitrary code with system privileges. **Recommendations** For Apple iOS versions prior to 13.6, update to iOS 13.6 or later. For Apple iPadOS versions prior to 13.6, update to iPadOS 13.6 or later. For Apple macOS Catalina versions prior to 10.15.6, update to macOS Catalina 10.15.6 or later. For Apple tvOS versions prior to 13.4.8, update to tvOS 13.4.8 or later. For Apple watchOS versions prior to 6.2.8, update to watchOS 6.2.8 or later.

Name of the Vulnerable Software and Affected Versions: BlueZ (affected versions not specified) Linux kernel (affected versions not specified) Description: The issue is related to improper access control in BlueZ and a vulnerability in the Linux kernel's net/bluetooth/a2mp.c component, which lacks protection of service data. This could allow an unauthenticated user or a remote attacker to potentially enable information disclosure via adjacent access or by using specially crafted AMP packets. Recommendations: For BlueZ, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Linux kernel, consider restricting access to the net/bluetooth/a2mp.c component to minimize the risk of exploitation until a patch is available.

Name of the Vulnerable Software and Affected Versions: BlueZ (affected versions not specified) Description: The issue is related to improper input validation in BlueZ, which may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access. This vulnerability can be exploited by sending specially crafted Bluetooth packets, potentially allowing a remote attacker to execute arbitrary code with Linux kernel privileges. The vulnerability is also known as BleedingTooth. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GNOME Evince versions prior to 3.32.0 **Description** The issue is related to the use of uninitialized memory in the TIFFReadRGBAImageOriented function of the Evince document viewer. This can be exploited by a remote attacker to gain unauthorized access to information. The tiff document render() and tiff document get thumbnail() functions in the TIFF document backend did not handle errors from TIFFReadRGBAImageOriented(), leading to uninitialized memory use when processing certain TIFF image files. **Recommendations** For versions prior to 3.32.0, update to version 3.32.0 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the TIFFReadRGBAImageOriented function until a patch is available. Restrict access to TIFF image files to minimize the risk of exploitation.