CVSS: 5.5EPSS: 0%CPEs: 7EXPL: 0CVE-2024-0641 – Kernel: deadlock leading to denial of service in tipc_crypto_key_revoke
https://notcve.org/view.php?id=CVE-2024-0641
A denial of service vulnerability was found in tipc_crypto_key_revoke in net/tipc/crypto.c in the Linux kernel’s TIPC subsystem. This flaw allows guests with local user privileges to trigger a deadlock and potentially crash the system. Se encontró una vulnerabilidad de denegación de servicio en tipc_crypto_key_revoke en net/tipc/crypto.c en el subsistema TIPC del kernel de Linux. Este fallo permite a los invitados con privilegios de usuario local desencadenar un punto muerto y potencialmente bloquear el sistema. • https://access.redhat.com/security/cve/CVE-2024-0641 https://bugzilla.redhat.com/show_bug.cgi?id=2258757 https://github.com/torvalds/linux/commit/08e50cf071847323414df0835109b6f3560d44f5 • CWE-667: Improper Locking CWE-833: Deadlock •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2024-0639 – Kernel: potential deadlock on &net->sctp.addr_wq_lock leading to dos
https://notcve.org/view.php?id=CVE-2024-0639
A denial of service vulnerability due to a deadlock was found in sctp_auto_asconf_init in net/sctp/socket.c in the Linux kernel’s SCTP subsystem. This flaw allows guests with local user privileges to trigger a deadlock and potentially crash the system. Se encontró una vulnerabilidad de denegación de servicio debido a un punto muerto en sctp_auto_asconf_init en net/sctp/socket.c en el subsistema SCTP del kernel de Linux. Esta falla permite a los invitados con privilegios de usuario local desencadenar un punto muerto y potencialmente bloquear el sistema. • https://access.redhat.com/security/cve/CVE-2024-0639 https://bugzilla.redhat.com/show_bug.cgi?id=2258754 https://github.com/torvalds/linux/commit/6feb37b3b06e9049e20dcf7e23998f92c9c5be9a • CWE-667: Improper Locking CWE-833: Deadlock •
CVSS: 8.3EPSS: 0%CPEs: 7EXPL: 0CVE-2024-0565 – Kernel: cifs filesystem decryption improper input validation remote code execution vulnerability in function receive_encrypted_standard of client
https://notcve.org/view.php?id=CVE-2024-0565
An out-of-bounds memory read flaw was found in receive_encrypted_standard in fs/smb/client/smb2ops.c in the SMB Client sub-component in the Linux Kernel. This issue occurs due to integer underflow on the memcpy length, leading to a denial of service. Se encontró un fallo de lectura de memoria fuera de los límites en receive_encrypted_standard en fs/smb/client/smb2ops.c en el subcomponente SMB Client en el kernel de Linux. Este problema se produce debido a un desbordamiento insuficiente de enteros en la longitud de memcpy, lo que provoca una denegación de servicio. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Linux Kernel. • https://access.redhat.com/errata/RHSA-2024:1188 https://access.redhat.com/errata/RHSA-2024:1404 https://access.redhat.com/errata/RHSA-2024:1532 https://access.redhat.com/errata/RHSA-2024:1533 https://access.redhat.com/errata/RHSA-2024:1607 https://access.redhat.com/errata/RHSA-2024:1614 https://access.redhat.com/errata/RHSA-2024:2093 https://access.redhat.com/errata/RHSA-2024:2394 https://access.redhat.com/security/cve/CVE-2024-0565 https://bugzilla.redhat.com/show • CWE-191: Integer Underflow (Wrap or Wraparound) •
CVSS: 6.2EPSS: 0%CPEs: 5EXPL: 0CVE-2023-6915 – Kernel: null pointer dereference vulnerability in ida_free in lib/idr.c
https://notcve.org/view.php?id=CVE-2023-6915
A Null pointer dereference problem was found in ida_free in lib/idr.c in the Linux Kernel. This issue may allow an attacker using this library to cause a denial of service problem due to a missing check at a function return. Se encontró un problema de desreferencia de puntero null en ida_free en lib/idr.c en el kernel de Linux. Este problema puede permitir que un atacante que utilice esta librería cause un problema de denegación de servicio debido a una verificación faltante en el retorno de una función. • https://access.redhat.com/errata/RHSA-2024:2394 https://access.redhat.com/errata/RHSA-2024:2950 https://access.redhat.com/errata/RHSA-2024:3138 https://access.redhat.com/security/cve/CVE-2023-6915 https://bugzilla.redhat.com/show_bug.cgi?id=2254982 https://github.com/torvalds/linux/commit/af73483f4e8b6f5c68c9aa63257bdd929a9c194a https://lists.debian.org/debian-lts-announce/2024/06/msg00016.html • CWE-476: NULL Pointer Dereference •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2024-0340 – Kernel: information disclosure in vhost/vhost.c:vhost_new_msg()
https://notcve.org/view.php?id=CVE-2024-0340
A vulnerability was found in vhost_new_msg in drivers/vhost/vhost.c in the Linux kernel, which does not properly initialize memory in messages passed between virtual guests and the host operating system in the vhost/vhost.c:vhost_new_msg() function. This issue can allow local privileged users to read some kernel memory contents when reading from the /dev/vhost-net device file. Se encontró una vulnerabilidad en vhost_new_msg en drivers/vhost/vhost.c en el kernel de Linux, que no inicializa correctamente la memoria en los mensajes pasados entre los invitados virtuales y el sistema operativo host en la función vhost/vhost.c:vhost_new_msg(). Este problema puede permitir a los usuarios locales privilegiados leer algunos contenidos de la memoria del kernel cuando leen desde el archivo del dispositivo /dev/vhost-net. • https://access.redhat.com/errata/RHSA-2024:3618 https://access.redhat.com/errata/RHSA-2024:3627 https://access.redhat.com/security/cve/CVE-2024-0340 https://bugzilla.redhat.com/show_bug.cgi?id=2257406 https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html https://lore.kernel.org/lkml/5kn47peabxjrptkqa6dwtyus35ahf4pcj4qm4pumse33kxqpjw@mec4se5relrc/T • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •