Several high profile security vulnerabilities were released in the last few days. Here's a quick rundown of the most relevant to our members.
Cisco Secure Boot Bug
This bug involves an attacker with elevated privileges and access to the underlying operating system running on affected devices writing a modified firmware image to the FPGA. The attacker must be local and already authenticated with elevated privileges to exploit this vulnerability. This existing access means they would already be able to attack the system in other ways regardless of this bug.
Cisco is in the process of releasing patches for affected devices though the roll-out is potentially months away for some affected equipment. Once patches are available, applying them should be a high priority because this type of attack can leave the equipment non-functional. In the meantime it's best to verify your configuration, audit the users who have access, and ensure your password policies are sufficiently complex to ensure legitimate users' passwords are easily cracked.
Read the full advisory (and verify whether you have affected devices in your network).
Linux Kernel Bug
This Linux kernel module bug goes back to about 2015 and could be pretty scary given it's generally-loose underlying conditions: no authentication required, network-based, and use-after-free. Use-after-free refers to an attempt to access memory after it has been freed which can crash programs and/or allow attack code to be executed. For more information see the official CWE definition.
This bug will garner a lot of attention because these conditions make it easy to exploit but luckily the bug is limited to a kernel module that is disabled by default.
Read the full CVE description detail here.
WhatsApp remote code execution
Details are scarce on how this exploit works but it appears that a crafted attack will crash the target app and allow you to run code on their device. More importantly this attack has already been used to install spyware on people’s devices. The exploit targets WhatsApp's VoIP stack and allows attackers to compromise a device just by calling it.
Updates resolving this issue for iOS and Android devices were released in the last few days so install the update if you don't have automatic app updates enabled. No word on whether installing the update addresses already compromised devices.
Read the full (albeit brief) description from Facebook.