ZeroDay Findings
Sign inSign up

Every 24 hours

Tech

Original briefings on what changed in security. Each story has a small illustration matched to what it covers, a short structure, and links to the catalog records and public identifiers it discusses.

Filter by vulnerability, fix, incident, intel, or research.

  1. Research · Jan 31, 2024

    Critical Use-After-Free Vulnerability Discovered in Linux Kernel's Netfilter Component

    A serious use-after-free vulnerability in the Linux kernel's netfilter component has been identified, allowing for potential local privilege escalation.

    What changed

    A use-after-free vulnerability has been discovered in the Linux kernel, specifically within the netfilter: nf_tables component. This flaw can be exploited to achieve local privilege escalation, posing a significant security risk.

    • The vulnerability is linked to the nft_verdict_init() function allowing erroneous drop values.
    • The nf_hook_slow() function can trigger a double free condition when specific drop errors are issued.
    • The issue can be mitigated by upgrading to a version beyond commit f342de4e2f33e0e39165d8639387aa6c19dff660.

    Who is affected

    The vulnerability primarily affects users of the Linux kernel, especially those utilizing the netfilter component. Various products and systems relying on this kernel version are at risk.

    • NetApp products, particularly the h300s firmware, are directly impacted.
    • Any enterprise relying on Linux kernel versions that include the vulnerable netfilter component may be affected.
    • Organizations using custom kernel builds may also be at risk if they include the vulnerable functions.

    What to do

    To safeguard systems against this vulnerability, it is crucial for affected users to take immediate action. Upgrading to the recommended kernel version is essential to mitigate the risk.

    • Upgrade to a version of the Linux kernel that exceeds commit f342de4e2f33e0e39165d8639387aa6c19dff660.
    • Conduct a thorough assessment of systems to identify any that may be using the vulnerable kernel version.
    • Implement additional monitoring and security measures to detect any potential exploitation attempts.

  2. Research · Jan 31, 2024

    Critical SSRF Vulnerability Discovered in Ivanti Products

    A significant server-side request forgery (SSRF) vulnerability has been identified in Ivanti Connect Secure, Policy Secure, and Neurons, potentially exposing sensitive resources to unauthorized access.

    What changed

    A newly discovered server-side request forgery (SSRF) vulnerability affects several Ivanti products, including Ivanti Connect Secure, Policy Secure, and Neurons. This flaw is present in the SAML component, allowing attackers to access restricted resources without proper authentication.

    Who is affected

    The vulnerability impacts various Ivanti products, which are widely used in enterprise environments. Organizations utilizing these products should be aware of the potential risks associated with this SSRF vulnerability.

    • Ivanti Connect Secure (ICS), formerly known as Pulse Connect Secure
    • Ivanti Policy Secure
    • Ivanti Neurons

    What to do

    Organizations using the affected Ivanti products should prioritize assessing their systems for this vulnerability. It is crucial to implement necessary security measures to mitigate potential risks.

    • Review and update Ivanti products to the latest versions.
    • Conduct a security audit to identify any unauthorized access.
    • Implement additional access controls to protect sensitive resources.