Lucene search

RedhatCVE-2024-0340

HistoryJan 09, 2024 - 6:15 p.m.

CVE-2024-0340

2024-01-0918:15:47

CWE-200

redhat

web.nvd.nist.gov

163

cve-2024-0340

linux kernel

vhost_new_msg

vulnerability

memory initialization

local privileged users

/dev/vhost-net device file

nvd

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

4.8

Confidence

High

EPSS

Percentile

5.1%

JSON

A vulnerability was found in vhost_new_msg in drivers/vhost/vhost.c in the Linux kernel, which does not properly initialize memory in messages passed between virtual guests and the host operating system in the vhost/vhost.c:vhost_new_msg() function. This issue can allow local privileged users to read some kernel memory contents when reading from the /dev/vhost-net device file.

Affected configurations

Nvd

Node

linuxlinux_kernelRange<6.4

linuxlinux_kernelMatch6.4rc1

linuxlinux_kernelMatch6.4rc2

linuxlinux_kernelMatch6.4rc3

linuxlinux_kernelMatch6.4rc4

linuxlinux_kernelMatch6.4rc5

VendorProductVersionCPE
linuxlinux_kernel*cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
linuxlinux_kernel6.4cpe:2.3:o:linux:linux_kernel:6.4:rc1:*:*:*:*:*:*
linuxlinux_kernel6.4cpe:2.3:o:linux:linux_kernel:6.4:rc2:*:*:*:*:*:*
linuxlinux_kernel6.4cpe:2.3:o:linux:linux_kernel:6.4:rc3:*:*:*:*:*:*
linuxlinux_kernel6.4cpe:2.3:o:linux:linux_kernel:6.4:rc4:*:*:*:*:*:*
linuxlinux_kernel6.4cpe:2.3:o:linux:linux_kernel:6.4:rc5:*:*:*:*:*:*

Vendor	Product	Version	CPE
linux	linux_kernel	*	cpe:2.3:o:linux:linux_kernel::::::::
linux	linux_kernel	6.4	cpe:2.3:o:linux:linux_kernel:6.4:rc1::::::
linux	linux_kernel	6.4	cpe:2.3:o:linux:linux_kernel:6.4:rc2::::::
linux	linux_kernel	6.4	cpe:2.3:o:linux:linux_kernel:6.4:rc3::::::
linux	linux_kernel	6.4	cpe:2.3:o:linux:linux_kernel:6.4:rc4::::::
linux	linux_kernel	6.4	cpe:2.3:o:linux:linux_kernel:6.4:rc5::::::

CNA Affected

[
  {
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "6.4-rc6",
        "versionType": "semver"
      }
    ],
    "packageName": "kernel",
    "collectionURL": "https://git.kernel.org/pub/scm/linux/kernel",
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 8",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "kernel-rt",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "0:4.18.0-553.5.1.rt7.346.el8_10",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:enterprise_linux:8::realtime",
      "cpe:/a:redhat:enterprise_linux:8::nfv"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 8",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "kernel",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "0:4.18.0-553.5.1.el8_10",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:enterprise_linux:8::crb",
      "cpe:/o:redhat:enterprise_linux:8::baseos"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 6",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "kernel",
    "defaultStatus": "affected",
    "cpes": [
      "cpe:/o:redhat:enterprise_linux:6"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 7",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "kernel",
    "defaultStatus": "affected",
    "cpes": [
      "cpe:/o:redhat:enterprise_linux:7"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 7",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "kernel-rt",
    "defaultStatus": "affected",
    "cpes": [
      "cpe:/o:redhat:enterprise_linux:7"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 9",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "kernel",
    "defaultStatus": "affected",
    "cpes": [
      "cpe:/o:redhat:enterprise_linux:9"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 9",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "kernel-rt",
    "defaultStatus": "affected",
    "cpes": [
      "cpe:/o:redhat:enterprise_linux:9"
    ]
  }
]