CVE-2024-36953

EPSS 0.23%
Veröffentlicht 30.05.2024 16:15:18
Zuletzt bearbeitet 23.12.2025 19:16:51
Quelle 416baaa9-dc9f-4396-8d5f-8c081f
CVE-Watchlists
Login
Unerledigt
Login

KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr()

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr()

vgic_v2_parse_attr() is responsible for finding the vCPU that matches
the user-provided CPUID, which (of course) may not be valid. If the ID
is invalid, kvm_get_vcpu_by_id() returns NULL, which isn't handled
gracefully.

Similar to the GICv3 uaccess flow, check that kvm_get_vcpu_by_id()
actually returns something and fail the ioctl if not.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 10

NVD 12 VulnDex Vulnerability Enrichment 10

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Linux ≫ Linux Kernel Version >= 4.7 < 5.10.217

Linux ≫ Linux Kernel Version >= 5.11 < 5.15.159

Linux ≫ Linux Kernel Version >= 5.16 < 6.1.91

Linux ≫ Linux Kernel Version >= 6.2 < 6.6.31

Linux ≫ Linux Kernel Version >= 6.7 < 6.8.10

Linux ≫ Linux Kernel Version6.9 Updaterc1

Linux ≫ Linux Kernel Version6.9 Updaterc2

Linux ≫ Linux Kernel Version6.9 Updaterc3

Linux ≫ Linux Kernel Version6.9 Updaterc4

Linux ≫ Linux Kernel Version6.9 Updaterc5

Linux ≫ Linux Kernel Version6.9 Updaterc6

Debian ≫ Debian Linux Version10.0

VulnDex Vulnerability Enrichment

Diese Information steht angemeldeten Benutzern zur Verfügung.

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.23%	0.136

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	5.5	1.8	3.6	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
134c704f-9b21-4f2e-91b3-4a467353bcc0	4.4	0.8	3.6	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H