USN-7166-2: Linux kernel (AWS) vulnerabilities

Read Time:3 Minute, 46 Second

Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
– ARM32 architecture;
– RISC-V architecture;
– S390 architecture;
– x86 architecture;
– Block layer subsystem;
– ACPI drivers;
– Drivers core;
– ATA over ethernet (AOE) driver;
– TPM device driver;
– Clock framework and drivers;
– Buffer Sharing and Synchronization framework;
– EFI core;
– GPIO subsystem;
– GPU drivers;
– HID subsystem;
– I2C subsystem;
– InfiniBand drivers;
– Input Device core drivers;
– Mailbox framework;
– Media drivers;
– Ethernet bonding driver;
– Network drivers;
– Mellanox network drivers;
– Microsoft Azure Network Adapter (MANA) driver;
– STMicroelectronics network drivers;
– NTB driver;
– Virtio pmem driver;
– PCI subsystem;
– x86 platform drivers;
– S/390 drivers;
– SCSI subsystem;
– SPI subsystem;
– Thermal drivers;
– USB Device Class drivers;
– USB Type-C Port Controller Manager driver;
– VFIO drivers;
– Virtio Host (VHOST) subsystem;
– Framebuffer layer;
– 9P distributed file system;
– BTRFS file system;
– Ceph distributed file system;
– File systems infrastructure;
– Ext4 file system;
– F2FS file system;
– GFS2 file system;
– JFS file system;
– Network file system (NFS) client;
– Network file system (NFS) server daemon;
– NILFS2 file system;
– Network file system (NFS) superblock;
– Bluetooth subsystem;
– Network traffic control;
– Network sockets;
– TCP network protocol;
– BPF subsystem;
– Perf events;
– Kernel thread helper (kthread);
– Padata parallel execution mechanism;
– Arbitrary resource management;
– Static call mechanism;
– Tracing infrastructure;
– Memory management;
– Ethernet bridge;
– CAN network layer;
– Networking core;
– IPv4 networking;
– IPv6 networking;
– MAC80211 subsystem;
– Multipath TCP;
– Netfilter;
– Netlink;
– SCTP protocol;
– TIPC protocol;
– SELinux security module;
– Simplified Mandatory Access Control Kernel framework;
– AudioScience HPI driver;
– Amlogic Meson SoC drivers;
– USB sound devices;
(CVE-2024-49944, CVE-2024-49907, CVE-2024-50062, CVE-2024-36893,
CVE-2024-49985, CVE-2024-49903, CVE-2024-49886, CVE-2024-50180,
CVE-2024-47757, CVE-2024-49938, CVE-2024-49902, CVE-2024-47709,
CVE-2024-49884, CVE-2024-49967, CVE-2024-49977, CVE-2024-47734,
CVE-2024-49954, CVE-2024-49963, CVE-2024-47747, CVE-2024-50008,
CVE-2024-47696, CVE-2024-50038, CVE-2024-46695, CVE-2024-47705,
CVE-2024-49957, CVE-2024-38538, CVE-2024-50019, CVE-2024-38544,
CVE-2024-50003, CVE-2024-50095, CVE-2024-50000, CVE-2024-49981,
CVE-2024-49863, CVE-2024-47710, CVE-2024-49983, CVE-2024-26947,
CVE-2024-46852, CVE-2024-49871, CVE-2024-49936, CVE-2024-47720,
CVE-2024-49881, CVE-2024-47672, CVE-2024-50040, CVE-2024-49997,
CVE-2024-50044, CVE-2023-52532, CVE-2024-47740, CVE-2024-44942,
CVE-2024-49948, CVE-2023-52621, CVE-2024-49959, CVE-2024-47718,
CVE-2024-50188, CVE-2024-47699, CVE-2024-47756, CVE-2024-47723,
CVE-2024-46849, CVE-2024-50035, CVE-2024-50189, CVE-2024-47684,
CVE-2024-49900, CVE-2024-50024, CVE-2024-49851, CVE-2024-49860,
CVE-2024-49924, CVE-2024-49946, CVE-2024-44940, CVE-2023-52904,
CVE-2024-47679, CVE-2024-47748, CVE-2023-52917, CVE-2024-47735,
CVE-2024-46858, CVE-2024-35904, CVE-2024-47673, CVE-2024-49878,
CVE-2024-47739, CVE-2024-49973, CVE-2024-49935, CVE-2024-49875,
CVE-2024-49896, CVE-2024-47690, CVE-2024-50007, CVE-2024-49933,
CVE-2024-49958, CVE-2024-49913, CVE-2024-49883, CVE-2024-47742,
CVE-2024-41016, CVE-2024-50002, CVE-2024-49969, CVE-2024-46853,
CVE-2024-50031, CVE-2024-47698, CVE-2024-47749, CVE-2024-50059,
CVE-2024-49966, CVE-2024-50093, CVE-2024-27072, CVE-2024-50186,
CVE-2024-49895, CVE-2024-38632, CVE-2024-49995, CVE-2024-38545,
CVE-2024-38667, CVE-2024-36968, CVE-2024-49952, CVE-2024-50001,
CVE-2024-47697, CVE-2024-50045, CVE-2024-49856, CVE-2024-49852,
CVE-2024-47712, CVE-2023-52639, CVE-2024-49975, CVE-2024-42158,
CVE-2024-49962, CVE-2024-50181, CVE-2024-42156, CVE-2024-46855,
CVE-2024-47693, CVE-2024-47670, CVE-2024-47706, CVE-2024-50184,
CVE-2024-49965, CVE-2024-39463, CVE-2024-50191, CVE-2024-49866,
CVE-2024-49890, CVE-2024-49877, CVE-2024-49879, CVE-2024-49927,
CVE-2024-50039, CVE-2024-46859, CVE-2024-47674, CVE-2024-50096,
CVE-2024-50013, CVE-2024-46854, CVE-2024-49868, CVE-2024-49882,
CVE-2024-47671, CVE-2024-50179, CVE-2024-44931, CVE-2024-50046,
CVE-2024-50006, CVE-2024-49892, CVE-2024-49949, CVE-2024-42079,
CVE-2024-46865, CVE-2024-47692, CVE-2024-47713, CVE-2024-47701,
CVE-2024-49889, CVE-2024-49894, CVE-2024-50015, CVE-2024-49858,
CVE-2024-49955, CVE-2024-49867, CVE-2024-35951, CVE-2024-50033,
CVE-2024-49982, CVE-2024-47695, CVE-2024-50049, CVE-2024-49930,
CVE-2024-50041, CVE-2024-47737, CVE-2024-47685)

Read More

Celebrating Our Success in 2024

Read Time:4 Minute, 13 Second

The past year has been transformative for LevelBlue, marked by the launch of our joint business venture with WillJam and AT&T Cybersecurity. Amid the transition, LevelBlue was recognized as a leading provider of managed network security services, managed detection and response, strategic consulting, and threat intelligence by key cybersecurity publications worldwide.

From industry-specific honors for our advanced services to broader accolades highlighting our leadership, LevelBlue was celebrated throughout 2024, even ranking 4th on MSSP Alert’s Top 250 MSSP company list. These achievements highlight our continued commitment to simplified cybersecurity.

Here’s an overview of our most notable recognitions:

SC Media Women in IT Security

Each year, SC Media celebrates the women who have risen above challenges and made their mark in an industry where still only one out of four cybersecurity jobs are held by women. On its 11th anniversary, SC Media recognized a variety of professionals from influential figures to budding talents, across four categories: cybersecurity veterans, power players, advocates and women to watch.

Bindu Sundaresan, director of cybersecurity solutions at LevelBlue, was named a winner in the advocate category of these awards, which highlight women who have advanced cybersecurity awareness and served as beacons for expansion and diversity in the field. With a passion for teaching and mentorship, Bindu has made significant strides to drive inclusivity within the cybersecurity industry.

Read more about Bindu’s recognition here.

Global Infosec Awards

The Global Infosec Awards recognize organizations and security innovators across the globe who demonstrate a forward-thinking approach to cyber-risk management and protection. Presented annually by Cyber Defense Magazine, the industry’s leading electronic information security publication, these awards highlight achievements across ​​various aspects of cybersecurity, including network security, endpoint protection, cloud security, identity and access management, threat intelligence, and more.

LevelBlue was named a winner in five categories of the Global Infosec Awards including Publisher’s Choice Cybersecurity, Editor’s Choice Cybersecurity, Most Innovative Managed Security Service Provider and Next-Gen Security Consulting. Most notably, LevelBlue’s USM Anywhere open XDR platform was recognized under the Best Solution Threat Detection Incident Response, Hunting and Triage Platform category for its ability to swiftly respond to cyber threats, minimize damage, and enhance operational resilience. Read more about the winners here.

Computing Security Awards

The Computing Security Awards showcase solutions advancing the technology industry – from AI to quantum computing. Hosted by the London-based trade outlet, Computing Security, these awards have become fiercely competitive since their inception 15 years ago.

LevelBlue was recognized as Incident Response & Investigation Security Service Provider of the Year for our ability to deliver rapid, expert-led incident response services and proactive threat management strategies that minimize business disruption and bolster organizational resilience. Additionally, our team took home the Threat Intelligence Award for LevelBlue Labs’ Open Threat Exchange (OTX™), which empowers cybersecurity professionals worldwide to share and validate real-time threat data, enhancing detection and response capabilities across organizations.

Cybersecurity Excellence Awards

Held annually since 2016, the Cybersecurity Excellence Awards honor individuals and companies that demonstrate excellence, innovation, and leadership in information security. From ‘Best Endpoint Security’ to ‘Cybersecurity Team of the Year,’ its categories encompass the full spectrum of cybersecurity.

LevelBlue was named a winner in the Cybersecurity as a Service category, as well as the Threat Detection and Response and Managed Detection and Response categories, which honored our powerful USM platform and Open Threat Exchange (OTX™).

Top InfoSec Innovator Awards

The Top InfoSec Innovator Awards, presented annually by Cyber Defense Magazine, celebrate the most innovative cybersecurity companies shaping the industry’s future. Now in its 12th year, the awards highlight companies who demonstrate exceptional innovation in defending against cyber threats. The program acknowledges companies of all sizes—startups or established enterprises—worldwide, focusing on their unique value propositions rather than financial metrics.

LevelBlue won Publisher’s Choice: Security Consulting for our ability to help organizations navigate complex threat landscapes with expert guidance and strategic solutions. Additionally, our USM Anywhere platform was recognized as the Best Solution under the Managed Detection and Response Provider category and LevelBlue Labs’ Open Threat Exchange (OTX™) was named Publisher’s Choice Threat Intelligence. Read more about the winners here.

Cybersecurity Top Innovations Awards

The Cybersecurity Top Innovation awards by Enterprise Security Tech recognize cybersecurity solutions that enhance security impact, business relevance, innovation, market differentiation, usability, and scalability. Winners address the most pressing challenges of today’s evolving cyber landscape with fresh perspectives and impactful solutions.

LevelBlue’s Managed Threat Detection and Response (MTDR) for Government service was recognized as a winner in the Threat Detection/Innovation category for its innovative, open-source architecture that ensures transparency and adaptability for small government agencies and large-scale enterprises alike. Read more about this accomplishment here.

Looking Ahead

These awards reflect on success in delivering industry-leading cybersecurity solutions and strategic consulting services that simply and effectively manage risk, enhance cyber resilience and protect businesses of all sizes. As we look ahead to 2025, we’re excited to build on this momentum by continuing to set the standard for cybersecurity.

Read More

The AI Fix #29: AI on OnlyFans, and the bot that wants to be a billionaire

Read Time:32 Second

In episode 29 of The AI Fix, an AI company makes the bold step of urging us to “stop hiring humans”, Graham is wrong about GB AI, parents prepare their kids for the imminent Moxie-mageddon, Google releases Gemini 2.0, and a robot is found dead at work and nobody knows why.

Graham inspects the AI Miss World competition for research purposes and wonders if our hosts should start an OnlyFans, and Mark meets an “evolving” AI that wants to be a billionaire.

All this and much more is discussed in the latest edition of “The AI Fix” podcast by Graham Cluley and Mark Stockley.

Read More

USN-7173-1: Linux kernel vulnerabilities

Read Time:42 Second

Ziming Zhang discovered that the DRM driver for VMware Virtual GPU did not
properly handle certain error conditions, leading to a NULL pointer
dereference. A local attacker could possibly trigger this vulnerability to
cause a denial of service. (CVE-2022-38096)

Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
– GPU drivers;
– Network drivers;
– SCSI subsystem;
– Ext4 file system;
– Bluetooth subsystem;
– Memory management;
– Amateur Radio drivers;
– Network traffic control;
– Sun RPC protocol;
– VMware vSockets driver;
(CVE-2023-52821, CVE-2024-40910, CVE-2024-43892, CVE-2024-49967,
CVE-2024-50264, CVE-2024-36952, CVE-2024-38553, CVE-2021-47101,
CVE-2021-47001, CVE-2024-35965, CVE-2024-35963, CVE-2024-35966,
CVE-2024-35967, CVE-2024-53057, CVE-2024-38597)

Read More

USN-7170-1: Linux kernel (OEM) vulnerabilities

Read Time:38 Second

Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
– GPU drivers;
– Ext4 file system;
– Network traffic control;
– VMware vSockets driver;
(CVE-2024-49914, CVE-2024-49912, CVE-2024-49919, CVE-2024-49905,
CVE-2024-49909, CVE-2024-47704, CVE-2024-49916, CVE-2024-49908,
CVE-2024-49899, CVE-2024-49923, CVE-2024-49921, CVE-2024-50264,
CVE-2024-49911, CVE-2024-49893, CVE-2024-53057, CVE-2024-49904,
CVE-2024-49898, CVE-2024-49907, CVE-2024-49897, CVE-2024-49913,
CVE-2024-49967, CVE-2024-49922, CVE-2024-49920, CVE-2024-49896,
CVE-2024-49906, CVE-2024-49917, CVE-2024-49910, CVE-2024-49915,
CVE-2024-49918)

Read More

USN-7169-1: Linux kernel vulnerabilities

Read Time:14 Second

Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
– Ext4 file system;
– Network traffic control;
– VMware vSockets driver;
(CVE-2024-49967, CVE-2024-53057, CVE-2024-50264)

Read More

Hacking Digital License Plates

Read Time:57 Second

Not everything needs to be digital and “smart.” License plates, for example:

Josep Rodriguez, a researcher at security firm IOActive, has revealed a technique to “jailbreak” digital license plates sold by Reviver, the leading vendor of those plates in the US with 65,000 plates already sold. By removing a sticker on the back of the plate and attaching a cable to its internal connectors, he’s able to rewrite a Reviver plate’s firmware in a matter of minutes. Then, with that custom firmware installed, the jailbroken license plate can receive commands via Bluetooth from a smartphone app to instantly change its display to show any characters or image.

[…]

Because the vulnerability that allowed him to rewrite the plates’ firmware exists at the hardware level­—in Reviver’s chips themselves—Rodriguez says there’s no way for Reviver to patch the issue with a mere software update. Instead, it would have to replace those chips in each display.

The whole point of a license plate is that it can’t be modified. Why in the world would anyone thing that a digital version is a good idea?

Read More