CVE-2021-1337
As you know some Corsair drivers create the device name based on the service name which is user controlled so if you set the service name `vgk_PLZNOHACK` this will cause it to pass all checks, Egg will not be resolved so it will end up calling into `nullptr` after which if you can couple this with a nullptr-allocation and a SMAP SMEP bypass you can easily get code execution at target machine. Please address immediately.
Posted by can1357 on Apr 1, 2021, 6:04 PM
Tags
Related issues
- struct's lifetime requirements can be bypassed via covariant field assignment
- Proposal to Reorganize the Moderation Team and Review Moderation Policies
- Progressive FPS degradation appears to be related to dota2.com — blocking the domain prevents the performance loss
- proposal: container/...: generic collection types
- Better Custom Endpoint BYOK
- A concrete policy for backward compatibility until Godot 5.0
Raise real-world problems, find people facing the same issue, and discuss solutions.3,000 issues0 comments
github (Other)
struct's lifetime requirements can be bypassed via covariant field assignment
Proposal to Reorganize the Moderation Team and Review Moderation Policies
Progressive FPS degradation appears to be related to dota2.com — blocking the domain prevents the performance loss
proposal: container/...: generic collection types
Better Custom Endpoint BYOK
A concrete policy for backward compatibility until Godot 5.0
New MTP models not supported
Tracking: 429 / Capacity Issues
CVE-2021-1337
As you know some Corsair drivers create the device name based on the service name which is user controlled so if you set the service name `vgk_PLZNOHACK` this will cause it to pass all checks, Egg will not be resolved so it will end up calling into `nullptr` after which if you can couple this with a nullptr-allocation and a SMAP SMEP bypass you can easily get code execution at target machine. Please address immediately.
Comments (0)
No comments yet. Start the discussion.