huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2024-32487: less: OS command injection
Component: less
Severity: Important
CWE: CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'))
CVSS v3: 8.6 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
Public date: 2024-04-13T00:00:00+00:00

An OS command injection flaw was found in Less. Since quoting is mishandled in filename.c, opening files with attacker-controlled file names can lead to OS command execution. Exploitation requires the LESSOPEN environment variable, which is set by default in many common cases.

Statement: The described vulnerability in less poses an Important security risk due to its potential for arbitrary OS command execution. Exploitation of this vulnerability allows an attacker to inject malicious commands through specially crafted filenames containing newline characters. This could lead to unauthorized access, data exfiltration, or even full system compromise, depending on the privileges of the user executing the less command. Furthermore, the mishandling of the LESSOPEN environment variable exacerbates the issue, as it can be set by default in many installations, providing an additional vector for exploitation.

Affected upstream versions: n/a
Fixed upstream versions: v654
Upstream repository: https://github.com/gwsw/less
Upstream fix commit: 007521ac3c95bc76e3d59c6dbfe75d06c8075c33
CVE-2024-32658: FreeRDP: ExtractRunLengthRegular* out of bound read
Component: FreeRDP
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-04-23T00:00:00+00:00

FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to out-of-bounds read. Version 3.5.1 contains a patch for the issue. No known workarounds are available.


Affected upstream versions: < 3.5.1
Fixed upstream versions: 3.5.1
Upstream repository: https://github.com/FreeRDP/FreeRDP
Upstream fix commit: 1a755d898ddc028cc818d0dd9d49d5acff4c44bf
CVE-2024-32659: freerdp: freerdp_image_copy out of bound read
Component: freerdp
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2024-04-23T00:00:00+00:00

FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to out-of-bounds read if `((nWidth == 0) and (nHeight == 0))`. Version 3.5.1 contains a patch for the issue. No known workarounds are available.


Affected upstream versions: < 3.5.1
Fixed upstream versions: 3.5.1
Upstream repository: https://github.com/FreeRDP/FreeRDP
Upstream fix commit: 6430945ce003a5e24d454d8566f54aae1b6b617b
CVE-2024-32660: freerdp: zgfx_decompress out of memory
Component: freerdp
Severity: Low
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-04-23T00:00:00+00:00

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.5.1, a malicious server can crash the FreeRDP client by sending invalid huge allocation size. Version 3.5.1 contains a patch for the issue. No known workarounds are available.


Affected upstream versions: < 3.5.1
Fixed upstream versions: 3.5.1
Upstream repository: https://github.com/FreeRDP/FreeRDP
Upstream fix commit: 5e5d27cf310e4c10b854be7667bfb7a5d774eb47
CVE-2024-32661: freerdp: rdp_write_logon_info_v1 NULL access
Component: freerdp
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2024-04-23T00:00:00+00:00

FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to a possible `NULL` access and crash. Version 3.5.1 contains a patch for the issue. No known workarounds are available.


Affected upstream versions: < 3.5.1
Fixed upstream versions: 3.5.1
Upstream repository: https://github.com/FreeRDP/FreeRDP
Upstream fix commit: 71e463e31b4d69f4022d36bfc814592f56600793
CVE-2024-32662: freerdp: out-of-bounds read
Component: freerdp
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Public date: 2024-04-23T00:00:00+00:00

A flaw was found in FreeRDP-based clients. Affected versions of FreeRDP are vulnerable to an out-of-bounds read. This issue occurs when the `WCHAR` string is read with twice the size it has and converted to `UTF-8`, `base64` decoded. The string is only used to compare against the redirection server certificate.


Affected upstream versions: < 3.5.1
Fixed upstream versions: 3.5.1
Upstream repository: https://github.com/FreeRDP/FreeRDP
Upstream fix commit: 626d10a94a88565d957ddc30768ed08b320049a7
CVE-2024-32879: python-social-auth: Improper Handling of Case Sensitivity in social-auth-app-django
Component: python-social-auth
Severity: Moderate
CWE: CWE-178 (Improper Handling of Case Sensitivity)
CVSS v3: 4.9 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N)
Public date: 2024-04-24T06:57:00+00:00

A flaw was found in social-auth-app-django. In affected versions of this package, due to default case-insensitive collation in MySQL or MariaDB databases, third-party authentication user IDs are not case-sensitive and could cause different IDs to match.


Affected upstream versions: < 5.4.1
Fixed upstream versions: 5.4.1
Upstream repository: https://github.com/python-social-auth/social-app-django
Upstream fix commit: 31c3e0c7edb187004d8abbde7e9c4f7ef9098138
CVE-2024-33655: unbound: DNSBomb vulnerability
Component: unbound
Severity: Low
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2024-05-09T00:00:00+00:00

A DNSBomb flaw was found in the unbound package. The DNSBomb attack works by sending low-rate spoofed queries for a malicious zone to Unbound. By controlling the delay of the malicious authoritative answers, Unbound slowly accumulates pending answers for the spoofed addresses. When the authoritative answers become available to Unbound at the same time, Unbound starts serving all the accumulated queries. This results in large-sized, concentrated response bursts to the spoofed addresses.


Affected upstream versions: n/a
Fixed upstream versions: release-1.20.0
Upstream repository: https://github.com/NLnetLabs/unbound
Upstream fix commit: c3206f4568f60c486be6d165b1f2b5b254fea3de
CVE-2024-33871: ghostscript: OPVP device arbitrary code execution via custom Driver library
Component: ghostscript
Severity: Important
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2024-05-02T00:00:00+00:00

A flaw was found in Ghostscript. The "Driver" parameter for the "opvp"/"oprp" device specifies the name of a dynamic library and allows any library to be loaded. This flaw allows a malicious user to send a specially crafted document that, when processed by Ghostscript, could potentially lead to arbitrary code execution with the privileges of the Ghostscript process on the system.


Affected upstream versions: n/a
Fixed upstream versions: ghostpdl-10.03.1
Upstream repository: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git
Upstream fix commit: 7145885041bb52cc23964f0aa2aec1b1c82b5908
CVE-2024-34055: cyrus-imapd: unbounded memory allocation by sending many LITERALs in a single command
Component: cyrus-imapd
Severity: Moderate
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-06-05T00:00:00+00:00

A flaw was found in Cyrus IMAP before versions 3.8.3 and 3.10.x , and before 3.10.0-rc1. This flaw allows authenticated attackers to cause unbounded memory allocation by sending multiple LITERALs in a single command.


Affected upstream versions: n/a
Fixed upstream versions: cyrus-imapd-3.12.0
Upstream repository: https://github.com/cyrusimap/cyrus-imapd
Upstream fix commit: ef9e4e8314d6a06f2269af0ccf606894cc3fe489
CVE-2024-34064: jinja2: accepts keys containing non-attribute characters
Component: jinja2
Severity: Moderate
CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
CVSS v3: 5.4 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)
Public date: 2024-05-06T00:00:00+00:00

A flaw was found in jinja2. The `xmlattr` filter accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, `/`, `>`, or `=`, as each would then be interpreted as starting a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could inject other attributes and perform cross-site scripting (XSS).

Statement: The fix for CVE-2024-22195 only addressed spaces, not other characters. Accepting keys as user input is now explicitly considered an unintended use case of the `xmlattr` filter, and code that does so without otherwise validating the input should be flagged as insecure, regardless of Jinja version. Accepting _values_ as user input continues to be safe.

Fence agents on RHEL 8 has been fixed as a part of https://access.redhat.com/errata/RHBA-2024:4238

Affected upstream versions: < 3.1.4
Fixed upstream versions: 3.1.4
Upstream repository: https://github.com/pallets/jinja
Upstream fix commit: 0668239dc6b44ef38e7a6c9f91f312fd4ca581cb
CVE-2024-34069: python-werkzeug: user may execute code on a developer's machine
Component: python-werkzeug
Severity: Important
CWE: CWE-352 (Cross-Site Request Forgery (CSRF))
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2024-05-06T00:00:00+00:00

A flaw was found in Werkzeug, where an attacker may be able to execute code on a developer's machine under some circumstances. This issue requires the attacker to get the developer to interact with a domain and subdomain they control and enter the debugger PIN; if they are successful, it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger.

Statement: Werkzeug's debugger allows an attacker to potentially execute code on a developer's machine. This can occur if the attacker tricks the developer into interacting with a controlled domain and subdomain and entering the debugger PIN. Although the debugger is meant to run locally, successful exploitation can give the attacker access to it by guessing a specific URL that triggers the debugger. The severity is rate as IMPORTANT because this flaw can potentially impacts confidentiality, integrity, and availability if the attacker can gain control.

Ceph uses an affected Werkzeug version but this vulnerability does not impact OpenShift Data Foundation (ODF) because the debugger is not set up or used on development machines, so there is no debugger to have information taken from.

Affected upstream versions: < 3.0.3
Fixed upstream versions: 3.0.x
Upstream repository: https://github.com/pallets/werkzeug
Upstream fix commit: 3386395b24c7371db11a5b8eaac0c91da5362692
CVE-2024-34351: next: Next.js Server-Side Request Forgery in Server Actions
Component: next
Severity: Important
CWE: CWE-918 (Server-Side Request Forgery (SSRF))
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2024-05-09T16:14:16.236000+00:00

A Server-Side Request Forgery (SSRF) vulnerability was identified in Next.js Server Actions. If the `Host` header is modified, and the below conditions are also met, an attacker may be able to make requests that appear to be originating from the Next.js application server itself. The required conditions are 1) Next.js is running in a self-hosted manner; 2) the Next.js application makes use of Server Actions; and 3) the Server Action performs a redirect to a relative path which starts with a `/`.


Affected upstream versions: >= 13.4.0, < 14.1.1
Fixed upstream versions: v14.1.1-canary.75
Upstream repository: https://github.com/vercel/next.js
Upstream fix commit: 8f7a6ca7d21a97bc9f7a1bbe10427b5ad74b9085
CVE-2024-35176: REXML: DoS parsing an XML with many `<`s in an attribute value
Component: REXML
Severity: Low
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2024-05-16T00:00:00+00:00

 REXML is an XML toolkit for Ruby. The REXML gem before 3.2.6 has a denial of service vulnerability when it parses an XML that has many `<`s in an attribute value. Those who need to parse untrusted XMLs may be impacted to this vulnerability. The REXML gem 3.2.7 or later include the patch to fix this vulnerability. As a workaround, don't parse untrusted XMLs.


Affected upstream versions: < 3.2.7
Fixed upstream versions: v3.2.7
Upstream repository: https://github.com/ruby/rexml
Upstream fix commit: 4325835f92f3f142ebd91a3fdba4e1f1ab7f1cfb
CVE-2024-35195: requests: subsequent requests to the same host ignore cert verification
Component: requests
Severity: Moderate
CWE: CWE-670 (Always-Incorrect Control Flow Implementation)
CVSS v3: 5.6 (CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N)
Public date: 2024-05-20T00:00:00+00:00

An incorrect control flow implementation vulnerability was found in Requests. If the first request in a session is made with verify=False, all subsequent requests to the same host will continue to ignore cert verification.


Affected upstream versions: < 2.32.0
Fixed upstream versions: v2.32.0
Upstream repository: https://github.com/psf/requests
Upstream fix commit: a58d7f2ffb4d00b46dca2d70a3932a0b37e22fac
CVE-2024-35235: cups: Cupsd Listen arbitrary chmod 0140777
Component: cups
Severity: Moderate
CWE: CWE-277 (Insecure Inherited Permissions)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
Public date: 2024-06-11T14:00:00+00:00

A flaw was found in the cupsd server. When starting the cupsd server with a Listen configuration item pointing to a symbolic link, the cupsd process can perform an arbitrary chmod of the provided argument, providing world-writable access to the target. Since cupsd is often running as root, this issue can result in the change of permission of any user or system files to be world writable.

Statement: The CVE-2024-35235 vulnerability is classified as moderate severity rather than important primarily due to its requirement for elevated privileges and specific preconditions for exploitation. The vulnerability necessitates the ability to edit the cupsd.conf file, which typically requires administrative access. Furthermore, successful exploitation hinges on creating a symbolic link in a writable directory and manipulating the Listen directive within cupsd.conf. While this can lead to arbitrary chmod operations and potentially compromise system files, the precondition of administrative access significantly reduces the likelihood of exploitation by unauthorized users, thereby mitigating the overall impact and severity of the issue.

Affected upstream versions: <= 2.4.8
Upstream repository: https://github.com/OpenPrinting/cups
Upstream fix commit: ff1f8a623e090dee8a8aadf12a6a4b25efac143d
CVE-2024-35255: azure-identity: Azure Identity Libraries Elevation of Privilege Vulnerability in github.com/Azure/azure-sdk-for-go/sdk/azidentity
Component: azure-identity
Severity: Moderate
CWE: CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'))
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Public date: 2024-07-01T00:00:00+00:00

A flaw was found in Microsoft's Azure Identity Libraries and the Microsoft Authentication Library (MSAL). The flaw arises from a race condition—a scenario where the timing of events leads to unexpected behavior—during concurrent operations on shared resources. This can result in privilege escalation, allowing attackers to gain unauthorized access to sensitive information. The vulnerability affects multiple versions of these libraries across various programming languages, including Java, .NET, Node.js, Python, JavaScript, C++, and Go. Microsoft has addressed this issue by releasing updated versions of the affected libraries. Users are strongly advised to upgrade to these patched versions to mitigate potential security risks.

Statement: Red Hat build of Apache Camel for Spring boot is not affected as 4.4.1 was released containing a fixed version of the Azure Identity Library.

Affected upstream versions: 1.0.0 < 1.6.0, 1.0.0 < 1.11.4, 1.0.0 < 1.8.0, 1.0.0 < 1.12.2, 1.0.0 < 4.2.1, 1.0.0 < 1.16.1, 1.0.0 < 1.15.1
Fixed upstream versions: 1.11.4, 1.12.2, 1.15.1, 1.16.1, 1.6.0, 1.8.0, 4.2.1
Upstream repository: https://github.com/Azure/azure-sdk-for-go
Upstream fix commit: 50774cd9709905523136fb05e8c85a50e8984499
CVE-2024-35787: kernel: md/md-bitmap: fix incorrect usage for sb_index
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-17T00:00:00+00:00

A security vulnerability was identified in the Linux kernel's MD (Multiple Device) subsystem, specifically within the bitmap handling code for clustered environments. The issue arises from incorrect usage of the sb_index field, leading to potential system crashes in clustered configurations.


Affected upstream versions: 6.6
Fixed upstream versions: 0, 6.6.24, 6.7.12, 6.8.3, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 736ad6c577a367834118f57417038d45bb5e0a31
CVE-2024-35789: kernel: wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-17T00:00:00+00:00

CVE-2024-35789 is a vulnerability in the Linux kernel’s Wi-Fi subsystem (mac80211). It occurs when a station is moved out of a VLAN, and the VLAN is subsequently deleted. A reference to the deleted VLAN’s network device may remain, leading to a use-after-free condition. This can result in system instability or crashes. The issue has been resolved by ensuring that outdated references are cleared when a station changes VLANs.


Affected upstream versions: 4.19.189 < 4.19.312, 5.4.114 < 5.4.274, 5.10.32 < 5.10.215, 4.14.232 < 4.15, 5.11.16 < 5.12, 5.12
Fixed upstream versions: 0, 4.15, 4.19.312, 5.10.215, 5.12, 5.15.154, 5.4.274, 6.1.84, 6.6.24, 6.7.12, 6.8.3, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: ea9a0cfc07a7d3601cc680718d9cff0d6927a921
CVE-2024-35790: kernel: usb: typec: altmodes/displayport: create sysfs nodes as driver&#39;s default device attribute group
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-17T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group

The DisplayPort driver's sysfs nodes may be present to the userspace before
typec_altmode_set_drvdata() completes in dp_altmode_probe. This means that
a sysfs read can trigger a NULL pointer error by deferencing dp->hpd in
hpd_show or dp->lock in pin_assignment_show, as dev_get_drvdata() returns
NULL in those cases.

Remove manual sysfs node creation in favor of adding attribute group as
default for devices bound to the driver. The ATTRIBUTE_GROUPS() macro is
not used here otherwise the path to the sysfs nodes is no longer compliant
with the ABI.


Affected upstream versions: 4.19
Fixed upstream versions: 0, 5.10.238, 5.15.184, 6.1.140, 6.6.24, 6.7.12, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 6b989ea1c479533ab8dbfbeb1704c94b1d3320da
CVE-2024-35791: kernel: KVM: SVM: Flush pages under kvm-&gt;lock to fix UAF in svm_register_enc_region()
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-17T00:00:00+00:00

A security vulnerability was identified in the Linux kernel's Kernel-based Virtual Machine subsystem (KVM), specifically affecting the Secure Virtual Machine (SVM) feature used on AMD processors. The issue arises from a use-after-free condition in the svm_register_enc_region() function, which can lead to system instability or potential exploitation.


Affected upstream versions: 5.10.15 < 5.10.215, 4.19.176 < 4.20, 5.4.98 < 5.5, 5.11
Fixed upstream versions: 0, 4.20, 5.10.215, 5.15.154, 5.5, 6.1.84, 6.6.24, 6.7.12, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 2d13b79640b147bd77c34a5998533b2021a4122d
CVE-2024-35794: kernel: dm-raid: really frozen sync_thread during suspend
Component: kernel
Severity: Low
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-17T00:00:00+00:00

A hang flaw was found in the Linux kernel’s Raid (MD) subsystem. This flaw allows a local user to crash the system.


Affected upstream versions: 4.8
Fixed upstream versions: 0, 6.7.12, 6.8.3, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: af916cb66a80597f3523bc85812e790bcdcfd62b
CVE-2024-35795: kernel: drm/amdgpu: fix deadlock while reading mqd from debugfs
Component: kernel
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-17T00:00:00+00:00

A flaw was found in the `drm/amdgpu` subsystem in the Linux kernel, involving a deadlock occurring when reading the Memory Queue Descriptor (MQD) from `debugfs`. This issue could cause the system to hang during debug operations.

Statement: Red Hat Enterprise Linux 6, 7 & 8 is not vulnerable to this CVE, as it does not affect the versions or configurations of the Linux kernel used in its distributions.

Affected upstream versions: 6.5
Fixed upstream versions: 0, 6.6.24, 6.7.12, 6.8.3, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 197f6d6987c55860f6eea1c93e4f800c59078874
CVE-2024-35797: kernel: mm: cachestat: fix two shmem bugs
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-17T00:00:00+00:00

CVE-2024-35797 is a vulnerability in the Linux kernel’s memory management, specifically affecting the cachestat feature when handling shared memory. The flaw stems from race conditions during operations like swapping or invalidation, which can lead to out-of-bounds memory access or invalid pointer dereferencing. These issues can result in crashes or system instability. The kernel has been patched to improve checks and handling of swap entries to ensure stable and safe operation.


Affected upstream versions: 6.5
Fixed upstream versions: 0, 6.6.24, 6.7.12, 6.8.3, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: b79f9e1ff27c994a4c452235ba09e672ec698e23
CVE-2024-35800: kernel: efi: fix panic in kdump kernel
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-05-17T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

efi: fix panic in kdump kernel

The Linux kernel CVE team has assigned CVE-2024-35800 to this issue.

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024051738-CVE-2024-35800-219a@gregkh/T


Affected upstream versions: 6.1.81 < 6.1.84, 6.3
Fixed upstream versions: 0, 6.1.84, 6.6.24, 6.7.12, 6.8.3, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: b9d103aca85f082a343b222493f3cab1219aaaf4