VULNERA Pulse

Arm — Mali Graphics Processing Unit (GPU)

CVE-2021-29256 / Added: July 7, 2023

HIGH CVSS 8.80 EPSS Score 0.08 EPSS Percentile 32.54

Arm Mali GPU Kernel Driver contains a use-after-free vulnerability that may allow a non-privileged user to gain root privilege and/or disclose information.

Headlines

• July 7, 2023 - CISA warns govt agencies to patch actively exploited Android driver
• July 7, 2023 - Google Releases Android Patch Update for 3 Actively Exploited Vulnerabilities
• July 6, 2023 - Android Security Updates Patch 3 Exploited Vulnerabilities
• July 6, 2023 - Android July security updates fix three actively exploited bugs
• July 6, 2023 - Multiple Vulnerabilities in Google Android OS Could Allow for Remote Code Execution
• July 6, 2023 - Android’s July 2023 Security Update Patches 3 Exploited Vulnerabilities

Back to top ↑

CVE-2023-27997

CRITICAL CVSS 9.80 EPSS Score 5.75 EPSS Percentile 92.26

CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available

Published: June 13, 2023

A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 all versions, version 1.1 all versions SSL-VPN may allow a remote attacker to execute arbitrary code or commands via specifically crafted requests.

Vendor Impacted: Fortinet

Products Impacted: Fortios-6k7k, Fortios And Fortiproxy Ssl-Vpn, Fortiproxy, Fortios

Quotes

• Our exploit smashes the heap, connects back to an attacker-controlled server, downloads a BusyBox binary, and opens an interactive shell
• Exploited in a limited number of cases
• A heap-based buffer overflow vulnerability [CWE-122] in FortiOS and FortiProxy SSL-VPN may allow a remote attacker to execute arbitrary code or commands via specifically crafted requests
• You should patch yours now
• There are 490,000 affected [FortiGate] SSL VPN interfaces exposed on the internet, and roughly 69% of them are currently unpatched
• Smashes the heap, connects back to an attacker-controlled server, downloads a BusyBox binary, and opens an interactive shell

Headlines

• July 4, 2023 - Over Two-Thirds of FortiGate Firewalls Still at Risk
• July 4, 2023 - Alert: 330,000 FortiGate Firewalls Still Unpatched to CVE-2023-27997 RCE Flaw
• July 4, 2023 - 335,923 out of 489,337 Fortinet firewalls vulnerable to CVE-2023-27997
• July 3, 2023 - 340,000+ Fortinet firewalls wide open to flaw – report
• July 3, 2023 - Researchers Develop Exploit Code for Critical Fortinet VPN Bug
• July 3, 2023 - 300,000+ Fortinet firewalls vulnerable to critical FortiOS RCE bug

CVE-2022-31199

CRITICAL CVSS 9.80 EPSS Score 0.26 EPSS Percentile 62.22

Actively Exploited Remote Code Execution

Published: Nov. 8, 2022

Remote code execution vulnerabilities exist in the Netwrix Auditor User Activity Video Recording component affecting both the Netwrix Auditor server and agents installed on monitored systems. The remote code execution vulnerabilities exist within the underlying protocol used by the component, and potentially allow an unauthenticated remote attacker to execute arbitrary code as the NT AUTHORITY\SYSTEM user on affected systems, including on systems Netwrix Auditor monitors.

Quotes

• Any organization identifying indicators of compromise (IOCs) within their environment should urgently apply the incident responses and mitigation measures detailed in this CSA and report the intrusion to CISA or the FBI
• Based on confirmation from open-source reporting and analytical findings of Truebot variants, the authoring organizations assess cyber threat actors are leveraging both phishing campaigns with malicious redirect hyperlinks and CVE-2022-31199 to deliver new Truebot malware variants
• During FlawedGrace's execution phase, the RAT stores encrypted payloads within the registry. The tool can create scheduled tasks and inject payloads into msiexec[.]exe and svchost[.]exe, which are command processes that enable FlawedGrace to establish a command and control (C2) connection to 92.118.36[.]199, for example, as well as load dynamic link libraries (DLLs) to accomplish privilege escalation
• Since this service is typically executed with extensive privileges in an Active Directory environment, the attacker would likely be able to compromise the Active Directory domain
• Previous Truebot malware variants were primarily delivered by cyber threat actors via malicious phishing email attachments; however, newer versions allow cyber threat actors to also gain initial access through exploiting CVE-2022-31199

Headlines

• July 7, 2023 - US and Canadian Authorities Warn of Increased Truebot Activity
• July 7, 2023 - CISA and FBI warn of Truebot infecting US and Canada based organizations
• July 7, 2023 - Cybersecurity Agencies Sound Alarm on Rising TrueBot Malware Attacks
• July 6, 2023 - Truebot Hackers Exploiting Netwrix Auditor Flaw: CISA, FBI Alert
• July 6, 2023 - CISA: Netwrix Auditor RCE bug exploited in Truebot malware attacks
• July 6, 2023 - CISA and Partners Release Joint Cybersecurity Advisory on Newly Identified Truebot Malware Variants | CISA

CVE-2023-2136

CRITICAL CVSS 9.60 EPSS Score 0.55 EPSS Percentile 74.35

CISA Known Exploited Actively Exploited Remote Code Execution

Published: April 19, 2023

Integer overflow in Skia in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Vendors Impacted: Fedoraproject, Debian, Google

Products Impacted: Debian Linux, Chrome, Fedora

Quotes

• A non-privileged User can make improper operations on GPU memory to gain access to already freed memory and may be able to gain root privilege, and/or disclose information
• May be under limited, targeted exploitation
• There are indications that the following [vulnerabilities] may be under limited, targeted exploitation
• The most severe vulnerability in this section could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation

Headlines

• July 7, 2023 - CISA warns govt agencies to patch actively exploited Android driver
• July 7, 2023 - Google Releases Android Patch Update for 3 Actively Exploited Vulnerabilities
• July 6, 2023 - Android Security Updates Patch 3 Exploited Vulnerabilities
• July 6, 2023 - Android July security updates fix three actively exploited bugs
• July 6, 2023 - Multiple Vulnerabilities in Google Android OS Could Allow for Remote Code Execution
• July 6, 2023 - Android’s July 2023 Security Update Patches 3 Exploited Vulnerabilities

CVE-2021-29256

HIGH CVSS 8.80 EPSS Score 0.08 EPSS Percentile 32.54

CISA Known Exploited

Published: May 24, 2021

. The Arm Mali GPU kernel driver allows an unprivileged user to achieve access to freed memory, leading to information disclosure or root privilege escalation. This affects Bifrost r16p0 through r29p0 before r30p0, Valhall r19p0 through r29p0 before r30p0, and Midgard r28p0 through r30p0.

Vendor Impacted: Arm

Products Impacted: Mali Graphics Processing Unit (Gpu), Valhall, Midgard, Bifrost

Quotes

• A non-privileged User can make improper operations on GPU memory to gain access to already freed memory and may be able to gain root privilege, and/or disclose information
• May be under limited, targeted exploitation
• There are indications that the following [vulnerabilities] may be under limited, targeted exploitation
• The most severe vulnerability in this section could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation

Headlines

• July 7, 2023 - CISA warns govt agencies to patch actively exploited Android driver
• July 7, 2023 - Google Releases Android Patch Update for 3 Actively Exploited Vulnerabilities
• July 6, 2023 - Android Security Updates Patch 3 Exploited Vulnerabilities
• July 6, 2023 - Android July security updates fix three actively exploited bugs
• July 6, 2023 - Multiple Vulnerabilities in Google Android OS Could Allow for Remote Code Execution
• July 6, 2023 - Android’s July 2023 Security Update Patches 3 Exploited Vulnerabilities

CVE-2023-26083

LOW CVSS 3.30 EPSS Score 6.15 EPSS Percentile 92.50

CISA Known Exploited Actively Exploited Used In Ransomware

Published: April 6, 2023

Memory leak vulnerability in Mali GPU Kernel Driver in Midgard GPU Kernel Driver all versions from r6p0 - r32p0, Bifrost GPU Kernel Driver all versions from r0p0 - r42p0, Valhall GPU Kernel Driver all versions from r19p0 - r42p0, and Avalon GPU Kernel Driver all versions from r41p0 - r42p0 allows a non-privileged user to make valid GPU processing operations that expose sensitive kernel metadata.

Vendor Impacted: Arm

Products Impacted: Bifrost Gpu Kernel Driver, Valhall Gpu Kernel Driver, Mali Graphics Processing Unit (Gpu), Midgard, Avalon Gpu Kernel Driver

Quotes

• A non-privileged User can make improper operations on GPU memory to gain access to already freed memory and may be able to gain root privilege, and/or disclose information
• May be under limited, targeted exploitation
• There are indications that the following [vulnerabilities] may be under limited, targeted exploitation
• The most severe vulnerability in this section could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation

Headlines

• July 7, 2023 - CISA warns govt agencies to patch actively exploited Android driver
• July 7, 2023 - Google Releases Android Patch Update for 3 Actively Exploited Vulnerabilities
• July 6, 2023 - Android Security Updates Patch 3 Exploited Vulnerabilities
• July 6, 2023 - Android July security updates fix three actively exploited bugs
• July 6, 2023 - Multiple Vulnerabilities in Google Android OS Could Allow for Remote Code Execution
• July 6, 2023 - Android’s July 2023 Security Update Patches 3 Exploited Vulnerabilities

CVE-2023-36934

CVSS Not Assigned EPSS Score 0.05 EPSS Percentile 14.41

Risk Context N/A

Published: July 5, 2023

In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), a SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to the MOVEit Transfer database. An attacker could submit a crafted payload to a MOVEit Transfer application endpoint that could result in modification and disclosure of MOVEit database content.

Quotes

• An attacker could submit a crafted payload to a MOVEit Transfer application endpoint which could result in modification and disclosure of MOVEit database content
• A SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to the MOVEit Transfer database
• Predictable, simple and transparent process for product and security fixes
• An SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to the MOVEit Transfer database

Headlines

• July 7, 2023 - MOVEit Transfer Faces Another Critical Data-Theft Bug
• July 7, 2023 - Progress warns customers of a new critical flaw in MOVEit Transfer software
• July 7, 2023 - After Zero-Day Attacks, MOVEit Turns to Security Service Packs
• July 7, 2023 - Another Critical Unauthenticated SQLi Flaw Discovered in MOVEit Transfer Software
• July 7, 2023 - MOVEit Transfer customers warned to patch new critical flaw
• July 7, 2023 - Progress Software Releases Service Pack for MOVEit Transfer Vulnerabilities | CISA
• July 6, 2023 - CVE-2023-36934: Critical SQL injection vulnerability in MOVEit Transfer

CVE-2023-36933

CVSS Not Assigned EPSS Score 0.04 EPSS Percentile 7.02

Risk Context N/A

Published: July 5, 2023

In Progress MOVEit Transfer before 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), it is possible for an attacker to invoke a method that results in an unhandled exception. Triggering this workflow can cause the MOVEit Transfer application to terminate unexpectedly.

Quotes

• An attacker could submit a crafted payload to a MOVEit Transfer application endpoint which could result in modification and disclosure of MOVEit database content
• A SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to the MOVEit Transfer database
• Predictable, simple and transparent process for product and security fixes
• An SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to the MOVEit Transfer database

Headlines

• July 7, 2023 - MOVEit Transfer Faces Another Critical Data-Theft Bug
• July 7, 2023 - Progress warns customers of a new critical flaw in MOVEit Transfer software
• July 7, 2023 - After Zero-Day Attacks, MOVEit Turns to Security Service Packs
• July 7, 2023 - Another Critical Unauthenticated SQLi Flaw Discovered in MOVEit Transfer Software
• July 7, 2023 - MOVEit Transfer customers warned to patch new critical flaw
• July 7, 2023 - Progress Software Releases Service Pack for MOVEit Transfer Vulnerabilities | CISA
• July 6, 2023 - CVE-2023-36934: Critical SQL injection vulnerability in MOVEit Transfer

CVE-2023-36932

CVSS Not Assigned EPSS Score 0.04 EPSS Percentile 7.02

Risk Context N/A

Published: July 5, 2023

In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), multiple SQL injection vulnerabilities have been identified in the MOVEit Transfer web application that could allow an authenticated attacker to gain unauthorized access to the MOVEit Transfer database. An attacker could submit a crafted payload to a MOVEit Transfer application endpoint that could result in modification and disclosure of MOVEit database content.

Quotes

• An attacker could submit a crafted payload to a MOVEit Transfer application endpoint which could result in modification and disclosure of MOVEit database content
• A SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to the MOVEit Transfer database
• Predictable, simple and transparent process for product and security fixes
• An SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to the MOVEit Transfer database

Headlines

• July 7, 2023 - MOVEit Transfer Faces Another Critical Data-Theft Bug
• July 7, 2023 - Progress warns customers of a new critical flaw in MOVEit Transfer software
• July 7, 2023 - After Zero-Day Attacks, MOVEit Turns to Security Service Packs
• July 7, 2023 - Another Critical Unauthenticated SQLi Flaw Discovered in MOVEit Transfer Software
• July 7, 2023 - MOVEit Transfer customers warned to patch new critical flaw
• July 7, 2023 - Progress Software Releases Service Pack for MOVEit Transfer Vulnerabilities | CISA
• July 6, 2023 - CVE-2023-36934: Critical SQL injection vulnerability in MOVEit Transfer