Weakness (CWE)
CWE-822: Untrusted Pointer Dereference
The product obtains a value from an untrusted source, converts this value to a pointer, and dereferences the resulting pointer.
Source: MITRE CWE-822
309 results · Feed
-
High 8.2
Gdb: gdbserver: heap disclosure and wild pointer in gdb_parse_agent_expr via untrusted agent-expression length
A length validation flaw in gdbserver's agent-expression parser allows an unauthenticated remote attacker to read uninitialized heap memory from the gdbserver process and cause a denial of service. Disclosed heap content includes addresses suitable for defeat…
-
Critical 9.3
ESF-IDF: Unvalidated Stack Pointer at the ESP-TEE Privilege-Switch Boundary
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. From 5.5.5 until 5.5.6, 6.0.4, and 6.1.1, the esp_tee trap entry in esp_tee_vectors_plic.S and esp_tee_vectors_clic.S saves a caller-controlled register frame through the REE-supplied st…
-
High 7.8
Inverted memory-permission check in the RTIO syscall verifier allows a user-mode thread to read and write arbitrary kernel memory
The RTIO submission-queue verifier rtio_vrfy_sqe() in subsys/rtio/rtio_syscalls.c (subsys/rtio/rtio_handlers.c before v4.3.0) accumulated the results of K_SYSCALL_MEMORY() into its valid_sqe flag with &=. That macro returns nonzero on failure (it is built on …
-
High 8.8
Unvalidated user pointers in RTIO syscall verifiers allow a user-mode thread to write kernel memory
Two RTIO syscall verifiers, in subsys/rtio/rtio_syscalls.c (subsys/rtio/rtio_handlers.c before v4.3.0), did not validate user-supplied pointers before the kernel wrote through them. z_vrfy_rtio_sqe_cancel() performed no validation at all. It passed the caller…
-
High 7.0
Cortex-M module ports save a preempted user-mode module thread's registers through its unchecked stack pointer in privileged mode
In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the PendSV handler of the Cortex-M module ports saves a preempted user-mode module thread's registers in privileged mode at addresses taken from the thread's stack pointer, without checking that pointer …
-
Medium 6.8
Untrusted Pointer Dereference in ASUS certain motherboards firmware allows a kernel-level privileges user can supply an…
-
High 7.8
PECI transfer syscall verifier does not validate embedded user buffer pointers, allowing arbitrary kernel memory read/write from user mode
The user-mode verifier for the peci_transfer() system call, z_vrfy_peci_transfer() in drivers/peci/peci_handlers.c, checked only the device object permission and copied the caller-supplied struct peci_msg with k_usermode_from_copy(). That copy validates the o…
-
Medium 5.5
HMS Networks PEAK-System PCAN Windows drivers Untrusted Pointer Dereference
The PEAK-System PCAN type 0x4030 processing path fails to validate a selected/returned object pointer before dereferencing fixed fields during post-processing.
-
Medium 6.1
Zephyr RTIO syscall verifier validates output parameters for read instead of write access
The user-mode syscall verifier z_vrfy_rtio_cqe_get_mempool_buffer() in subsys/rtio/rtio_syscalls.c validated its two output parameters, buff and buff_len, with K_SYSCALL_MEMORY_READ() rather than K_SYSCALL_MEMORY_WRITE(). Both are pure out-parameters: z_impl_…
-
Medium 6.5
Microsoft Office Word Information Disclosure Vulnerability
Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
-
Medium 6.8
Windows Kernel Elevation of Privilege Vulnerability
Untrusted pointer dereference in Windows Kernel allows an unauthorized attacker to elevate privileges with a physical attack.
-
Medium 4.7
Windows Network File System Information Disclosure Vulnerability
Untrusted pointer dereference in Windows Network File System allows an authorized attacker to disclose information locally.
-
Medium 6.8
Windows Storage Port Driver Elevation of Privilege Vulnerability
Untrusted pointer dereference in Windows Storage Port Driver allows an unauthorized attacker to elevate privileges with a physical attack.
-
High 8.8
RPC Runtime Library Remote Code Execution Vulnerability
Untrusted pointer dereference in RPC Runtime allows an unauthorized attacker to execute code over a network.
-
High 7.1
SysInternals Elevation of Privilege Vulnerability
Untrusted pointer dereference in SysInternals allows an authorized attacker to elevate privileges locally.
-
High 7.1
SysInternals Elevation of Privilege Vulnerability
Untrusted pointer dereference in SysInternals allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows NTFS Elevation of Privilege Vulnerability
Untrusted pointer dereference in Windows NTFS allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows COM+ Event System Service Elevation of Privilege Vulnerability
Untrusted pointer dereference in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally.
-
Critical 9.8
Windows OLE Remote Code Execution Vulnerability
Untrusted pointer dereference in Windows OLE allows an unauthorized attacker to execute code over a network.
-
Medium 5.5
Microsoft Windows Search Component Information Disclosure Vulnerability
Untrusted pointer dereference in Microsoft Windows Search Component allows an authorized attacker to disclose information locally.
-
High 7.8
WebDAV Elevation of Privilege Vulnerability
Untrusted pointer dereference in WebDAV allows an authorized attacker to elevate privileges locally.
-
Medium 6.5
Microsoft Office PowerPoint Information Disclosure Vulnerability
Untrusted pointer dereference in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
-
High 8.8
Windows Domain Name Service Remote Code Execution Vulnerability
Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network.
-
High 8.8
Windows Domain Name Service Remote Code Execution Vulnerability
Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network.
-
High 8.8
Windows Domain Name Service Remote Code Execution Vulnerability
Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network.
-
High 8.1
Windows Kernel Elevation of Privilege Vulnerability
Untrusted pointer dereference in Windows Kernel allows an unauthorized attacker to elevate privileges over a network.
-
Medium 6.7
Windows NTFS Remote Code Execution Vulnerability
Untrusted pointer dereference in Windows NTFS allows an authorized attacker to execute code locally.
-
High 7.8
WebDAV Elevation of Privilege Vulnerability
Untrusted pointer dereference in WebDAV allows an authorized attacker to elevate privileges locally.
-
Medium 5.5
Windows Universal Disk Format File System Driver (UDFS) Information Disclosure Vulnerability
Out-of-bounds read in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to disclose information locally.
-
High 8.8
Windows Domain Name Service Remote Code Execution Vulnerability
Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network.
-
High 7.8
Windows Core Messaging Elevation of Privilege Vulnerability
Untrusted pointer dereference in Windows Core Messaging allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Kernel Elevation of Privilege Vulnerability
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
-
Critical 9.8
Microsoft Office Word Remote Code Execution Vulnerability
Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
-
High 8.8
Windows Client-Side Caching (CSC) Service Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Client-Side Caching (CSC) Service allows an unauthorized attacker to elevate privileges over a network.
-
High 7.0
Windows Security Support Provider Interface Elevation of Privilege Vulnerability
Untrusted pointer dereference in Windows Security Support Provider Interface allows an authorized attacker to elevate privileges locally.
-
Medium 5.5
Windows Container Isolation FS Filter Driver Elevation of Privilege Vulnerability
Untrusted pointer dereference in Windows Container Isolation FS Filter Driver allows an authorized attacker to elevate privileges locally.
-
High 8.8
Windows Domain Name Service Remote Code Execution Vulnerability
Access of resource using incompatible type ('type confusion') in DNS Server allows an authorized attacker to execute code over a network.
-
High 7.8
Windows NTFS Elevation of Privilege Vulnerability
Untrusted pointer dereference in Windows NTFS allows an authorized attacker to elevate privileges locally.
-
Medium 6.5
Windows Kernel Denial of Service Vulnerability
Untrusted pointer dereference in Windows Kernel allows an authorized attacker to deny service over a network.
-
High 8.8
Windows CD-ROM File System Driver Remote Code Execution Vulnerability
Untrusted pointer dereference in Windows CD-ROM Driver allows an unauthorized attacker to execute code over a network.