Lucene search

K
osvGoogleOSV:USN-6921-1
HistoryJul 29, 2024 - 12:51 p.m.

linux, linux-aws, linux-gcp, linux-gke, linux-ibm, linux-nvidia, linux-oem-6.8, linux-raspi vulnerabilities

2024-07-2912:51:56
Google
osv.dev
11
amd sev-snp
hypervisor
linux kernel
dma
hid
i2c
phy
tty
ipv4

CVSS3

7.7

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

AI Score

9.1

Confidence

High

Benedict Schlüter, Supraja Sridhara, Andrin Bertschi, and Shweta Shinde
discovered that an untrusted hypervisor could inject malicious #VC
interrupts and compromise the security guarantees of AMD SEV-SNP. This flaw
is known as WeSee. A local attacker in control of the hypervisor could use
this to expose sensitive information or possibly execute arbitrary code in
the trusted execution environment. (CVE-2024-25742)

Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:

  • DMA engine subsystem;
  • HID subsystem;
  • I2C subsystem;
  • PHY drivers;
  • TTY drivers;
  • IPv4 networking;
    (CVE-2024-35990, CVE-2024-35997, CVE-2024-35992, CVE-2024-35984,
    CVE-2024-36008, CVE-2024-36016)

CVSS3

7.7

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

AI Score

9.1

Confidence

High