| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. |
| Untrusted pointer dereference in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network. |
| In the Linux kernel, the following vulnerability has been resolved:
net: atm: fix crash due to unvalidated vcc pointer in sigd_send()
Reproducer available at [1].
The ATM send path (sendmsg -> vcc_sendmsg -> sigd_send) reads the vcc
pointer from msg->vcc and uses it directly without any validation. This
pointer comes from userspace via sendmsg() and can be arbitrarily forged:
int fd = socket(AF_ATMSVC, SOCK_DGRAM, 0);
ioctl(fd, ATMSIGD_CTRL); // become ATM signaling daemon
struct msghdr msg = { .msg_iov = &iov, ... };
*(unsigned long *)(buf + 4) = 0xdeadbeef; // fake vcc pointer
sendmsg(fd, &msg, 0); // kernel dereferences 0xdeadbeef
In normal operation, the kernel sends the vcc pointer to the signaling
daemon via sigd_enq() when processing operations like connect(), bind(),
or listen(). The daemon is expected to return the same pointer when
responding. However, a malicious daemon can send arbitrary pointer values.
Fix this by introducing find_get_vcc() which validates the pointer by
searching through vcc_hash (similar to how sigd_close() iterates over
all VCCs), and acquires a reference via sock_hold() if found.
Since struct atm_vcc embeds struct sock as its first member, they share
the same lifetime. Therefore using sock_hold/sock_put is sufficient to
keep the vcc alive while it is being used.
Note that there may be a race with sigd_close() which could mark the vcc
with various flags (e.g., ATM_VF_RELEASED) after find_get_vcc() returns.
However, sock_hold() guarantees the memory remains valid, so this race
only affects the logical state, not memory safety.
[1]: https://gist.github.com/mrpre/1ba5949c45529c511152e2f4c755b0f3 |
| Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code over a network. |
| Untrusted pointer dereference in Windows Kernel allows an unauthorized attacker to elevate privileges with a physical attack. |
| Access of resource using incompatible type ('type confusion') in DNS Server allows an authorized attacker to execute code over a network. |
| Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending data. |
| Untrusted pointer dereference in Windows Distributed File System (DFS) allows an unauthorized attacker to elevate privileges over a network. |
| Untrusted pointer dereference in SysInternals allows an authorized attacker to elevate privileges locally. |
| Untrusted pointer dereference in Windows Storage Port Driver allows an unauthorized attacker to elevate privileges with a physical attack. |
| Untrusted pointer dereference in Windows Network File System allows an authorized attacker to disclose information locally. |
| Untrusted pointer dereference in RPC Runtime allows an unauthorized attacker to execute code over a network. |
| Untrusted pointer dereference in SysInternals allows an authorized attacker to elevate privileges locally. |
| Untrusted pointer dereference in Windows NTFS allows an authorized attacker to elevate privileges locally. |
| Untrusted pointer dereference in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally. |
| Untrusted pointer dereference in Windows OLE allows an unauthorized attacker to execute code over a network. |
| Untrusted pointer dereference in Microsoft Windows Search Component allows an authorized attacker to disclose information locally. |
| Untrusted pointer dereference in WebDAV allows an authorized attacker to elevate privileges locally. |
| Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network. |
| Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network. |
