HPC Pack 9.8 deserialization RCE, KVM guest-to-host escape, and Teams XSS

A bug in KVM's SVM (AMD) nested virtualization lets a guest VM read host APIC state, send arbitrary interrupts, and DoS the host. This happens when AVIC is inhibited while a nested guest (L2) is running: x2APIC MSR intercepts stay disabled for L1, giving it access it should never have. You need to be running KVM on AMD with nested virtualization enabled for this to bite you.

Affected estate

Linux KVM hosts on AMD processors using nested virtualization (kvm_amd module)

How to check

Run 'cat /sys/module/kvm_amd/parameters/nested' to check if nested virt is enabled, then check your running kernel version against your distro's security advisory.

Included because

guest-to-host escape vector; DoS risk; CVSS 8.2; affects common virtualization stack

Action

Update the kernel package to the fixed version and reboot, or live-patch if your distro supports it.

Why it matters

A malicious or compromised guest can read host APIC state and send arbitrary interrupts, causing host instability or denial of service.

Source

Linux kernel mailing list / NVD

A cross-site scripting (XSS) bug in Microsoft Teams for Android lets an authenticated attacker inject malicious content that can spoof UI elements over the network. The attacker needs to be authorized (think: someone already in your tenant or a guest with Teams access), but from there they can craft messages or content that renders malicious scripts in the victim's Teams client.

Affected estate

Anyone with users running Microsoft Teams on Android devices

How to check

Check the installed Teams version on managed Android devices via your MDM console, or have users open Teams > Settings > About to confirm the version.

Included because

CVSS 8.8; XSS in widely deployed mobile app; spoofing risk

Action

Deploy the latest Teams for Android update through your MDM or direct users to update via Google Play.

Why it matters

An attacker inside your tenant can spoof content and potentially steal credentials or trick users through injected scripts in the Teams interface.

Source

Microsoft Security Response Center

An XSS vulnerability in Azure Storage Explorer lets an unauthenticated attacker escalate privileges over the network. If someone opens crafted content in Storage Explorer, the attacker can potentially run actions with the victim's Azure permissions. No prior authentication is required on the attacker's side, which makes this worse than a typical XSS.

Affected estate

Anyone using Azure Storage Explorer to manage Azure storage accounts

How to check

Open Azure Storage Explorer and go to Help > About to check the version, or query your software inventory for 'Microsoft Azure Storage Explorer'.

Included because

unauthenticated; CVSS 8.8; privilege escalation; common cloud management tool

Action

Update Azure Storage Explorer to the patched version immediately.

Why it matters

An unauthenticated attacker can escalate privileges through the app, potentially gaining access to your Azure storage resources with the victim's permissions.

Source

Microsoft Security Response Center

A command injection bug in Microsoft PowerShell lets an authorized local attacker execute arbitrary code. The attacker needs local access and some level of authorization first, so this isn't a remote drive-by. But if someone already has a foothold on a box, they can use this to escalate or pivot through crafted PowerShell input.

Affected estate

Anyone running Microsoft PowerShell on systems where multiple users have local access

How to check

Run '$PSVersionTable.PSVersion' in a PowerShell session to check the installed version, then compare against the Microsoft advisory.

Included because

local code execution; CVSS 7.8; PowerShell is ubiquitous; post-compromise escalation risk

Action

Update PowerShell to the patched version using your preferred deployment method (Microsoft Update, winget, apt/yum, or brew).

Why it matters

An attacker with local access can inject commands through PowerShell to execute arbitrary code, making this a useful link in a post-compromise escalation chain.

Source

Microsoft Security Response Center