CVE-2024-36911 hv_netvsc: Don't free decrypted memory

In the Linux kernel, the following vulnerability has been resolved: hvnetvsc: Don't free decrypted memory In CoCo VMs it is possible for the untrusted host to cause setmemoryencrypted or setmemorydecrypted to fail such that an error is returned and the resulting memory is shared. Callers need to...

CVE-2024-36911 hv_netvsc: Don't free decrypted memory

In the Linux kernel, the following vulnerability has been resolved: hvnetvsc: Don't free decrypted memory In CoCo VMs it is possible for the untrusted host to cause setmemoryencrypted or setmemorydecrypted to fail such that an error is returned and the resulting memory is shared. Callers need to...

CVE-2024-36911

CVE-2024-36911 affects the Linux kernel hv_netvsc (Hyper-V host/guest networking). The root cause is that in CoCo VMs, a failure of set_memory_encrypted() or set_memory_decrypted() could cause memory to be shared and not properly freed. The netvsc driver could frees decrypted/shared pages if set_...

CVE-2024-36909

CVE-2024-36909 : In the Linux kernel, Drivers: hv: vmbus: Don’t free ring buffers that couldn’t be re-encrypted. In CoCo VMs, an untrusted host can cause set_memory_encrypted()/set_memory_decrypted() to fail, leading to decrypted/shared memory being returned to the page allocator. The VMBus ring ...

CVE-2024-36910 uio_hv_generic: Don't free decrypted memory

In the Linux kernel, the following vulnerability has been resolved: uiohvgeneric: Don't free decrypted memory In CoCo VMs it is possible for the untrusted host to cause setmemoryencrypted or setmemorydecrypted to fail such that an error is returned and the resulting memory is shared. Callers need...

CVE-2024-36909 Drivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted

In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted In CoCo VMs it is possible for the untrusted host to cause setmemoryencrypted or setmemorydecrypted to fail such that an error is returned and the resultin...

CVE-2024-36909 Drivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted

In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted In CoCo VMs it is possible for the untrusted host to cause setmemoryencrypted or setmemorydecrypted to fail such that an error is returned and the resultin...

CVE-2024-36910 uio_hv_generic: Don't free decrypted memory

In the Linux kernel, the following vulnerability has been resolved: uiohvgeneric: Don't free decrypted memory In CoCo VMs it is possible for the untrusted host to cause setmemoryencrypted or setmemorydecrypted to fail such that an error is returned and the resulting memory is shared. Callers need...

CVE-2024-36910 uio_hv_generic: Don't free decrypted memory

In the Linux kernel, the following vulnerability has been resolved: uiohvgeneric: Don't free decrypted memory In CoCo VMs it is possible for the untrusted host to cause setmemoryencrypted or setmemorydecrypted to fail such that an error is returned and the resulting memory is shared. Callers need...

CVE-2024-36909 Drivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted

In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted In CoCo VMs it is possible for the untrusted host to cause setmemoryencrypted or setmemorydecrypted to fail such that an error is returned and the resultin...

CVE-2021-47508

In the Linux kernel, the following vulnerability has been resolved: btrfs: free exchange changeset on failures Fstests runs on my VMs have show several kmemleak reports like the following. unreferenced object 0xffff88811ae59080 size 64: comm "xfsio", pid 12124, jiffies 4294987392 age 6.368s hex...

Hackers Created Rogue VMs to Evade Detection in Recent MITRE Cyber Attack

The MITRE Corporation has revealed that the cyber attack targeting the not-for-profit company towards late December 2023 by exploiting zero-day flaws in Ivanti Connect Secure ICS involved the threat actor creating rogue virtual machines VMs within its VMware environment. "The adversary created...

CVE-2024-34226

The CVE-2024-34226 issue affects SourceCodester Visitor Management System 1.0, specifically the /php-sqlite-vms/?page=manage_visitor&id=1 endpoint. A SQL injection in the id parameter enables attackers to execute arbitrary SQL commands, with potential data leakage or manipulation. Exploitation is...

CVE-2024-26992

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/pmu: Disable support for adaptive PEBS Drop support for virtualizing adaptive PEBS, as KVM's implementation is architecturally broken without an obvious/easy path forward, and because exposing adaptive PEBS can leak host...

CVE-2024-26740

CVE-2024-26740: In the Linux kernel, the net/sched act_mirred fix uses the Rx backlog for egress→ingress reversals to prevent socket lock deadlocks on certain redirect scenarios. The upstream patch ca22da2fbd69 implements this backlog-based handling; Nessus advisory AXSA references this CVE with ...

Virtuozzo Hybrid Infrastructure 6.0 Update 1 Hotfix 4 (6.0.1-91)

This update provides stability improvements. Vulnerability id: VSTOR-70238 A stability fix for iSCSI targets. Vulnerability id: VSTOR-83102 ISCSI volumes may become unavailable due to a race between switching to standby mode and revoking volumes. Vulnerability id: VSTOR-83744 Failed to migrate...

Microsoft Patch Tuesday March 2024 includes critical Hyper-V flaws

The March 2024 Patch Tuesday update includes patches for 61 Microsoft vulnerabilities. Only two of the vulnerabilities are rated critical and both of these are found in Windows Hyper-V. Hyper-V is a hardware virtualization product that allows you to run multiple operating systems as virtual...

RLSA-2024:1063 Important: edk2 security update

EDK Embedded Development Kit is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. Security Fixes: edk2: Buffer overflow in the DHCPv6 client via a long Server ID option CVE-2023-45230 edk2: Buffer overflow when processing...

PT-2024-27201

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In CoCo VMs, an untrusted host can cause set memory encrypted or set memory decrypted to fail, resulting in shared memory. Callers must handle these errors to avoid returning decrypted...

Virtuozzo Hybrid Infrastructure 6.0 Update 1 Hotfix 3 (6.0.1-89)

This update provides stability improvements. Vulnerability id: VSTOR-82695 Deploying a Kubernetes cluster may take longer than expected. Vulnerability id: VSTOR-82730 Restarting libvirtd causes EFI VMs to reboot...