Valentina Palmiotti

**Name of the Vulnerable Software and Affected Versions** NVIDIA Display Driver for Linux (affected versions not specified) **Description** The NVIDIA Display Driver for Linux contains a race condition that may allow a local attacker to escalate privileges. Exploitation of this issue could lead to code execution, privilege escalation, data tampering, denial of service, and information disclosure. A race condition occurs when multiple processes or threads access shared resources simultaneously, resulting in unpredictable behavior and potential security breaches. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Streaming Service (affected versions not specified) Windows (affected versions not specified) **Description** The issue is related to a use-after-free vulnerability in the Microsoft Streaming Service of Windows operating systems, which can allow an attacker to elevate their privileges. This vulnerability can be exploited locally. **Recommendations** For Microsoft Streaming Service, consider restricting access to the service until a patch is available. For Windows, apply the recommended security updates as soon as they are available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Streaming Service Proxy versions prior to the fixed version **Description** The issue is related to an elevation-of-privilege vulnerability in the Microsoft Streaming Service Proxy, which allows attackers to gain system-level rights. This vulnerability is associated with a buffer overflow in memory. The estimated number of potentially affected devices is not specified. There have been reports of real-world incidents where this issue was exploited, including limited exploitation in the wild. Technical details about exploitation include the involvement of the MSKSSRV.SYS driver. **Recommendations** For versions prior to the fixed version, apply the patch issued on September 12, 2023, to resolve the issue. As a temporary workaround, consider restricting access to the MSKSSRV.SYS driver until a patch is applied. Avoid using the vulnerable Microsoft Streaming Service Proxy until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows (affected versions not specified) **Description** The issue is related to the SPNEGO Extended Negotiation (NEGOEX) security mechanism in Microsoft Windows, which can lead to information disclosure. It allows remote attackers to execute arbitrary code and affect the system. The vulnerability can be exploited through various Windows application protocols that authenticate, such as RDP and SMB. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions 5.10 through 5.14.6 **Description** The issue is related to a buffer overflow in the loop rw iter function in the Linux kernel's io uring subsystem, allowing local users to gain privileges. This is due to an error in the implementation of the io uring interface, leading to access to already freed memory blocks. The vulnerability can be exploited to create a working exploit, allowing for privilege escalation. **Recommendations** For Linux kernel versions 5.10 through 5.14.6, update to a version that includes the patch for this issue. As a temporary workaround, consider restricting access to the io uring subsystem to minimize the risk of exploitation. Avoid using the `loop rw iter()` function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.