Qiuhao Li

**Name of the Vulnerable Software and Affected Versions** Sofia-SIP versions 1.12.4 and later, up to the version before the fix was introduced **Description** The issue is related to the lack of message length and attributes length checks when handling STUN packets, leading to a controllable heap-over-flow. This can be exploited by attackers to achieve remote code execution through heap grooming or other methods. The bug was introduced 16 years ago and users are advised to upgrade. There are no known workarounds for this vulnerability. **Recommendations** For Sofia-SIP versions 1.12.4 and later, up to the version before the fix was introduced: Upgrade to a newer version to resolve the issue. As a temporary workaround, consider restricting access to the `stun parse attribute()` function until a patch is available. Avoid using the `length` variable in the affected STUN packet handling code until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Wireshark versions 3.6.0 through 3.6.8 **Description** The issue is related to a crash in the OPUS protocol dissector, which allows for denial of service via packet injection or crafted capture file. This can be exploited by injecting packets or using a specially crafted capture file. **Recommendations** For Wireshark versions 3.6.0 through 3.6.8, consider disabling the OPUS protocol dissector as a temporary workaround until a patch is available. Restrict access to the OPUS protocol dissector to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to a NULL pointer dereference flaw in the Linux kernel's KVM module. This flaw can lead to a denial of service in the `x86 emulate insn` function in `arch/x86/kvm/emulate.c`. The flaw occurs when an illegal instruction is executed in a guest on an Intel CPU. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux Kernel versions prior to the fixed version **Description** The issue is related to a NULL pointer dereference in the KVM subsystem of the Linux kernel, specifically in the `kvm dirty ring push` function. This flaw can be exploited by an unprivileged local attacker on the host to cause a denial of service by issuing specific ioctl calls, resulting in a kernel oops condition. **Recommendations** For Linux Kernel versions prior to the fixed version, consider disabling the dirty ring support as a temporary workaround until a patch is available. Restrict access to the vulnerable `kvm dirty ring push` function to minimize the risk of exploitation. Avoid using specific ioctl calls that can cause a kernel oops condition until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Linux Kernel versions prior to the fixed version **Description** A flaw was found in the Kernel-based Virtual Machine (KVM) subsystem of the Linux kernel. The issue is related to the `get user pages fast()` function and involves writing data outside the buffer in memory. This flaw allows unprivileged local users on the host to write outside the userspace region and potentially corrupt the kernel, resulting in a denial of service condition. The `vaddr` and `vm pgoff` variables are controllable by user-mode processes, which can be exploited to cause the issue. **Recommendations** For Linux Kernel versions prior to the fixed version, consider updating to a newer version that contains a fix for this issue. As a temporary workaround, restrict access to the KVM subsystem to minimize the risk of exploitation. Avoid using the `get user pages fast()` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Oracle VM VirtualBox versions prior to 6.1.28 **Description** The issue is related to a buffer overflow in the Core component of Oracle VM VirtualBox, which can be exploited by a high-privileged attacker with logon access to the infrastructure where Oracle VM VirtualBox executes. Successful attacks can result in unauthorized ability to cause a hang or frequently repeatable crash of Oracle VM VirtualBox, leading to a denial of service. **Recommendations** For versions prior to 6.1.28, update to version 6.1.28 or later to resolve the issue. As a temporary workaround, consider restricting access to the Core component to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** QEMU (affected versions not specified) **Description** A DMA reentrancy issue was found in the NVM Express Controller (NVME) emulation. This issue can lead to a use-after-free problem when a malicious guest triggers the reset function `nvme ctrl reset()`, causing data structs to be freed. As a result, a malicious guest could crash the QEMU process on the host, leading to a denial of service condition, or potentially execute arbitrary code within the context of the QEMU process on the host. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** libslirp versions 4.3.1 and earlier **Description** The issue is related to a buffer over-read in the ncsi.c component of the libslirp TCP-IP emulator. This occurs because the component attempts to read a certain amount of header data even if it exceeds the total packet length. Exploitation of this issue may allow a remote attacker to access confidential data. **Recommendations** For libslirp versions 4.3.1 and earlier, consider applying a patch or updating to a version where this issue is fixed, if available. As a temporary workaround, consider restricting access to the ncsi.c component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** libslirp versions 4.3.1 and earlier **Description** The issue is related to a buffer over-read in the slirp.c component of the libslirp TCP-IP emulator. This occurs because the component attempts to read a certain amount of header data, even if it exceeds the total packet length. Exploitation of this issue could allow a remote attacker to access confidential data. **Recommendations** For libslirp versions 4.3.1 and earlier, consider applying a patch or updating to a version where this issue is fixed, if available. As a temporary workaround, consider restricting access to the slirp.c component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to pointer dereference errors in the Linux kernel. It allows an attacker to access confidential data, compromise its integrity, and cause a denial of service. Specifically, with shadow paging enabled, the INVPCID instruction results in a call to `kvm mmu invpcid gva`. If INVPCID is executed with CR0.PG=0, the `invlpg` callback is not set, leading to a NULL pointer dereference. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.