RHEL 7 : kernel (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - kernel: out of bounds read in drivers/media/usb/dvb-usb/technisat-usb2.c CVE-2019-15505 - kernel:...

SUSE CVE-2024-36917

In the Linux kernel, the following vulnerability has been resolved: block: fix overflow in blkioctldiscard There is no check for overflow of 'start + len' in blkioctldiscard. Hung task occurs if submit an discard ioctl with the following param: start = 0x80000000000ff000, len = 0x8000000000fff000...

DEBIAN-CVE-2024-36953

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgicv2parseattr vgicv2parseattr is responsible for finding the vCPU that matches the user-provided CPUID, which of course may not be valid. If the ID is invalid, kvmgetvcpubyid...

CVE-2024-36953

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgicv2parseattr vgicv2parseattr is responsible for finding the vCPU that matches the user-provided CPUID, which of course may not be valid. If the ID is invalid, kvmgetvcpubyid...

UBUNTU-CVE-2024-36953

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgicv2parseattr vgicv2parseattr is responsible for finding the vCPU that matches the user-provided CPUID, which of course may not be valid. If the ID is invalid, kvmgetvcpubyid...

CVE-2024-36953

CVE-2024-36953 affects the Linux kernel KVM for arm64 with vgic-v2. The issue: vgic_v2_parse_attr() searches for a vCPU matching the CPUID and may receive a NULL from kvm_get_vcpu_by_id() if the ID is invalid. Unlike the safe GICv3 flow, the code did not verify the returned vCPU object. Affected ...

CVE-2024-36917 block: fix overflow in blk_ioctl_discard()

In the Linux kernel, the following vulnerability has been resolved: block: fix overflow in blkioctldiscard There is no check for overflow of 'start + len' in blkioctldiscard. Hung task occurs if submit an discard ioctl with the following param: start = 0x80000000000ff000, len = 0x8000000000fff000...

CVE-2024-36881 mm/userfaultfd: reset ptes when close() for wr-protected ones

In the Linux kernel, the following vulnerability has been resolved: mm/userfaultfd: reset ptes when close for wr-protected ones Userfaultfd unregister includes a step to remove wr-protect bits from all the relevant pgtable entries, but that only covered an explicit UFFDIOUNREGISTER ioctl, not a...

SUSE CVE-2021-47556

In the Linux kernel, the following vulnerability has been resolved: ethtool: ioctl: fix potential NULL deref in ethtoolsetcoalesce ethtoolsetcoalesce now uses both the .getcoalesce and .setcoalesce callbacks. But the check for their availability is buggy, so changing the coalesce settings on a...

CVE-2021-47556

In the Linux kernel, the following vulnerability has been resolved: ethtool: ioctl: fix potential NULL deref in ethtoolsetcoalesce ethtoolsetcoalesce now uses both the .getcoalesce and .setcoalesce callbacks. But the check for their availability is buggy, so changing the coalesce settings on a...

CVE-2024-36054

Hw64.sys in Marvin Test HW.exe before 5.0.5.0 allows unprivileged user-mode processes to arbitrarily read kernel memory and consequently gain all privileges via IOCTL 0x9c4064b8 via MmMapIoSpace and IOCTL 0x9c406490 via ZwMapViewOfSection...

CVE-2024-36055

Hw64.sys in Marvin Test HW.exe before 5.0.5.0 allows unprivileged user-mode processes to arbitrarily map physical memory with read/write access via the MmMapIoSpace API IOCTL 0x9c40a4f8, 0x9c40a4e8, 0x9c40a4c0, 0x9c40a4c4, 0x9c40a4ec, and seven others, leading to a denial of service BSOD...

CVE-2024-36054

CVE-2024-36054 affects Marvin Test HW.exe (Hw64.sys) prior to 5.0.5.0. The vulnerability arises from the driver exposing IOCTL 0x9c4064b8 (MmMapIoSpace) and IOCTL 0x9c406490 (ZwMapViewOfSection), allowing unprivileged user-mode processes to arbitrarily read kernel memory and thereby gain all priv...

CVE-2024-36054

Hw64.sys in Marvin Test HW.exe before 5.0.5.0 allows unprivileged user-mode processes to arbitrarily read kernel memory and consequently gain all privileges via IOCTL 0x9c4064b8 via MmMapIoSpace and IOCTL 0x9c406490 via ZwMapViewOfSection...

CVE-2024-36054

Hw64.sys in Marvin Test HW.exe before 5.0.5.0 allows unprivileged user-mode processes to arbitrarily read kernel memory and consequently gain all privileges via IOCTL 0x9c4064b8 via MmMapIoSpace and IOCTL 0x9c406490 via ZwMapViewOfSection...

PT-2024-26869 · Unknown +1 · Marvin Test Hw.Exe +1

Name of the Vulnerable Software and Affected Versions: Marvin Test HW.exe versions prior to 5.0.5.0 Description: The issue allows unprivileged user-mode processes to arbitrarily map physical memory, leading to NT AUTHORITYSYSTEM privilege escalation. This is achieved via IOCTL 0x9c406490, which...

PT-2024-26867 · Unknown · Marvin Test Hw.Exe

Name of the Vulnerable Software and Affected Versions: Marvin Test HW.exe versions prior to 5.0.5.0 Description: The issue allows unprivileged user-mode processes to arbitrarily read kernel memory, and consequently gain all privileges, via specific IOCTL commands. The affected IOCTL commands are...

DEBIAN-CVE-2021-47556

In the Linux kernel, the following vulnerability has been resolved: ethtool: ioctl: fix potential NULL deref in ethtoolsetcoalesce ethtoolsetcoalesce now uses both the .getcoalesce and .setcoalesce callbacks. But the check for their availability is buggy, so changing the coalesce settings on a...

CVE-2021-47556

In the Linux kernel, the following vulnerability has been resolved: ethtool: ioctl: fix potential NULL deref in ethtoolsetcoalesce ethtoolsetcoalesce now uses both the .getcoalesce and .setcoalesce callbacks. But the check for their availability is buggy, so changing the coalesce settings on a...

CVE-2021-47527

In the Linux kernel, the following vulnerability has been resolved: serial: core: fix transmit-buffer reset and memleak Commit 761ed4a94582 "tty: serialcore: convert uartclose to use ttyportclose" converted serial core to use ttyportclose but failed to notice that the transmit buffer still needs ...