Lucene search

K
osvGoogleOSV:USN-6923-2
HistoryJul 30, 2024 - 10:59 a.m.

linux-aws-5.15, linux-ibm, linux-ibm-5.15, linux-raspi vulnerabilities

2024-07-3010:59:46
Google
osv.dev
9
linux
kernel
vulnerabilities
hypervisor
amd sev-snp
wesee
cve-2024-25742
tty drivers
smb
netfilter
bluetooth
cve-2024-26886
cve-2023-52752
cve-2024-36016
cve-2024-26952
cve-2024-27017
software

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.4

Confidence

High

Benedict Schlüter, Supraja Sridhara, Andrin Bertschi, and Shweta Shinde
discovered that an untrusted hypervisor could inject malicious #VC
interrupts and compromise the security guarantees of AMD SEV-SNP. This flaw
is known as WeSee. A local attacker in control of the hypervisor could use
this to expose sensitive information or possibly execute arbitrary code in
the trusted execution environment. (CVE-2024-25742)

Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:

  • TTY drivers;
  • SMB network file system;
  • Netfilter;
  • Bluetooth subsystem;
    (CVE-2024-26886, CVE-2023-52752, CVE-2024-36016, CVE-2024-26952,
    CVE-2024-27017)

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.4

Confidence

High