Skip to content
Loading...

Talence Research

Vulnerabilities discovered by Talence Security through original research and responsible disclosure.

Severity:
Category:

Summary

The SharedClipboard HGCM service extracts list entry names from guest parameters using HGCMSvcGetPv() (raw pointer, no validation) instead of HGCMSvcGetStr() (validates null-termination). A non-null-terminated guest buffer causes strlen() to overread the host heap via RTStrDup(), disclosing host memory contents to the guest. No user interaction required. Can be used as an ASLR bypass in conjunction with other SharedClipboard vulnerabilities.

References

Summary

ShClSvcTransferIfaceGHRootListRead() reads a root list header from the guest with an unbounded cEntries field (uint64_t) and loops that many times allocating host memory with guest-controlled size and content via RTStrDup(). Beyond DoS, this is a precision heap spray primitive enabling reclamation of freed structures with exploit payloads in any glibc tcache bin.

References

Summary

shClTransferHttpGetTransferFromUrl() traverses lstTransfers without the server lock, storing the result in pReq->pvUser. A concurrent ShClTransferHttpServerUnregisterTransfer() (which holds the lock) can free the transfer between lookup and use, causing later callbacks to access a freed struct. Provides a natural trigger for sprayed data in the VM escape chain.

References

Summary

The DHCPv4 option parser in iscsiuio miscalculates option data length and lacks per-option bounds checks when iterating DHCP options. An adjacent-network attacker can send a crafted DHCPv4 response to trigger a heap out-of-bounds read, potentially crashing the iscsiuio daemon or corrupting its network configuration from heap data. iscsiuio runs as root on enterprise iSCSI boot-from-SAN deployments.

References

Summary

The DHCPv6 option parser in iscsiuio lacks a remaining-bytes check before reading option headers and uses strlen() on raw network data without ensuring NUL termination. An adjacent-network attacker can send a crafted DHCPv6 Advertise packet to trigger heap out-of-bounds reads of unbounded length, a 1-byte heap overwrite, and corruption of the iSCSI initiator name. This can crash the daemon or leak heap memory contents. iscsiuio runs as root on iSCSI boot-from-SAN deployments.

References

Summary

The IPv6 Neighbor Discovery handlers in iscsiuio read link-layer address options at a fixed offset without checking that the packet payload covers the accessed data, and update the ARP table unconditionally from the parsed addresses. An adjacent-network attacker can send a crafted Neighbor Advertisement to cause out-of-bounds reads of heap data and poison the ARP table with heap contents, enabling traffic redirection. iscsiuio runs as root on iSCSI boot-from-SAN deployments.

References

Summary

The Teredo tunnel decoder in Snort 3 fails to track remaining bytes after consuming the authentication indicator header. After advancing the raw packet pointer by 13 bytes, subsequent reads validate against the total packet length instead of remaining length. A single 13-byte UDP packet to port 3544 causes the detection engine to read up to 10 bytes past the heap buffer, crashing the IDS/IPS sensor and creating a monitoring blind spot on the protected network.

References

Summary

The fanx_fingerprint() function in ssl/sslxprint.c allocates a heap buffer 3 bytes too small for the formatted FAN/1 fingerprint string. The format string 'fan1:x509:server:passive:%s:sha256:%s' contains 34 literal characters plus a NUL terminator, but only 31 bytes are reserved for the constant portion. When sprintf writes the full string, a 3-byte heap overflow occurs past the allocated buffer. Triggered by processing crafted TLS traffic containing an X.509 certificate with FAN/1 fingerprinting enabled. No authentication required.

References

Summary

Multiple migration data handlers in the SPICE server use client-supplied uint32_t offsets (write_data_ptr, read_data_ptr, msg_header_ptr, surfaces_at_client_ptr) from migration structs as unchecked pointers into the migration message buffer. A malicious SPICE client connecting to a destination server during VM live migration can send crafted SPICE_MSGC_MIGRATE_DATA messages with out-of-bounds offsets, causing memcpy to read from or write to arbitrary heap locations relative to the message buffer. Four independent vulnerable code paths in char-device.cpp, smartcard.cpp, reds.cpp, and dcc.cpp share the same root cause.

References

Summary

The GLZ encoder dictionary restoration path truncates a size_t allocation size to int when calling the GlzEncoderUsrContext::malloc callback. A client-controlled max_encoders value from GlzEncDictRestoreData in the migration data message controls the multiplication sizeof(uint32_t) * max_encoders. On 64-bit systems, this product is silently truncated to a 32-bit signed int, causing an undersized allocation. The subsequent reset loop writes max_encoders entries to the undersized buffer, causing a massive heap buffer overflow with attacker-controlled iteration count.

References

272 Advisories Published