CVE-2024-36913 Drivers: hv: vmbus: Leak pages if set_memory_encrypted() fails

In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Leak pages if setmemoryencrypted fails In CoCo VMs it is possible for the untrusted host to cause setmemoryencrypted or setmemorydecrypted to fail such that an error is returned and the resulting memory is...

CVE-2024-36912 Drivers: hv: vmbus: Track decrypted status in vmbus_gpadl

In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Track decrypted status in vmbusgpadl In CoCo VMs it is possible for the untrusted host to cause setmemoryencrypted or setmemorydecrypted to fail such that an error is returned and the resulting memory is share...

CVE-2024-36911 hv_netvsc: Don't free decrypted memory

In the Linux kernel, the following vulnerability has been resolved: hvnetvsc: Don't free decrypted memory In CoCo VMs it is possible for the untrusted host to cause setmemoryencrypted or setmemorydecrypted to fail such that an error is returned and the resulting memory is shared. Callers need to...

CVE-2024-36911 hv_netvsc: Don't free decrypted memory

In the Linux kernel, the following vulnerability has been resolved: hvnetvsc: Don't free decrypted memory In CoCo VMs it is possible for the untrusted host to cause setmemoryencrypted or setmemorydecrypted to fail such that an error is returned and the resulting memory is shared. Callers need to...

CVE-2024-36911

CVE-2024-36911 affects the Linux kernel hv_netvsc driver used in CoCo VMs. The vulnerability stems from the netvsc path freeing decrypted memory when set_memory_decrypted() fails, potentially causing decrypted/shared pages to be returned to the page allocator. The underlying issue is that the cal...

CVE-2024-36910 uio_hv_generic: Don't free decrypted memory

In the Linux kernel, the following vulnerability has been resolved: uiohvgeneric: Don't free decrypted memory In CoCo VMs it is possible for the untrusted host to cause setmemoryencrypted or setmemorydecrypted to fail such that an error is returned and the resulting memory is shared. Callers need...

CVE-2024-36909 Drivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted

In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted In CoCo VMs it is possible for the untrusted host to cause setmemoryencrypted or setmemorydecrypted to fail such that an error is returned and the resultin...

CVE-2024-36910 uio_hv_generic: Don't free decrypted memory

In the Linux kernel, the following vulnerability has been resolved: uiohvgeneric: Don't free decrypted memory In CoCo VMs it is possible for the untrusted host to cause setmemoryencrypted or setmemorydecrypted to fail such that an error is returned and the resulting memory is shared. Callers need...

CVE-2024-36909 Drivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted

In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted In CoCo VMs it is possible for the untrusted host to cause setmemoryencrypted or setmemorydecrypted to fail such that an error is returned and the resultin...

CVE-2024-36910 uio_hv_generic: Don't free decrypted memory

In the Linux kernel, the following vulnerability has been resolved: uiohvgeneric: Don't free decrypted memory In CoCo VMs it is possible for the untrusted host to cause setmemoryencrypted or setmemorydecrypted to fail such that an error is returned and the resulting memory is shared. Callers need...

CVE-2024-36909

CVE-2024-36909 affects the Linux kernel hv (Hyper-V) vmbus ring buffers. The vulnerability arises when set_memory_decrypted() fails in CoCo VMs, causing memory to be shared instead of properly encrypted. The VMBus ring buffer code could free decrypted/shared pages if set_memory_decrypted() fails....

CVE-2024-36909 Drivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted

In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted In CoCo VMs it is possible for the untrusted host to cause setmemoryencrypted or setmemorydecrypted to fail such that an error is returned and the resultin...

CVE-2021-47508

In the Linux kernel, the following vulnerability has been resolved: btrfs: free exchange changeset on failures Fstests runs on my VMs have show several kmemleak reports like the following. unreferenced object 0xffff88811ae59080 size 64: comm "xfsio", pid 12124, jiffies 4294987392 age 6.368s hex...

Hackers Created Rogue VMs to Evade Detection in Recent MITRE Cyber Attack

The MITRE Corporation has revealed that the cyber attack targeting the not-for-profit company towards late December 2023 by exploiting zero-day flaws in Ivanti Connect Secure ICS involved the threat actor creating rogue virtual machines VMs within its VMware environment. "The adversary created...

CVE-2024-34226

The CVE-2024-34226 issue affects SourceCodester Visitor Management System 1.0, specifically the /php-sqlite-vms/?page=manage_visitor&id=1 endpoint. A SQL injection in the id parameter enables attackers to execute arbitrary SQL commands, with potential data leakage or manipulation. Exploitation is...

CVE-2024-26992

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/pmu: Disable support for adaptive PEBS Drop support for virtualizing adaptive PEBS, as KVM's implementation is architecturally broken without an obvious/easy path forward, and because exposing adaptive PEBS can leak host...

CVE-2024-26740

CVE-2024-26740: In the Linux kernel, the net/sched act_mirred fix uses the Rx backlog for egress→ingress reversals to prevent socket lock deadlocks on certain redirect scenarios. The upstream patch ca22da2fbd69 implements this backlog-based handling; Nessus advisory AXSA references this CVE with ...

Virtuozzo Hybrid Infrastructure 6.0 Update 1 Hotfix 4 (6.0.1-91)

This update provides stability improvements. Vulnerability id: VSTOR-70238 A stability fix for iSCSI targets. Vulnerability id: VSTOR-83102 ISCSI volumes may become unavailable due to a race between switching to standby mode and revoking volumes. Vulnerability id: VSTOR-83744 Failed to migrate...

Microsoft Patch Tuesday March 2024 includes critical Hyper-V flaws

The March 2024 Patch Tuesday update includes patches for 61 Microsoft vulnerabilities. Only two of the vulnerabilities are rated critical and both of these are found in Windows Hyper-V. Hyper-V is a hardware virtualization product that allows you to run multiple operating systems as virtual...

RLSA-2024:1063 Important: edk2 security update

EDK Embedded Development Kit is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. Security Fixes: edk2: Buffer overflow in the DHCPv6 client via a long Server ID option CVE-2023-45230 edk2: Buffer overflow when processing...