Lucene search

K
osvGoogleOSV:USN-6921-2
HistoryJul 30, 2024 - 10:33 a.m.

linux-lowlatency vulnerabilities

2024-07-3010:33:56
Google
osv.dev
7
linux
lowlatency
vulnerabilities
amd sev-snp
hypervisor
malicious interrupts
compromise
security
flaws
dma subsystem
hid subsystem
i2c subsystem
phy drivers
tty drivers
ipv4 networking
cve-2024-25742
cve-2024-35997
cve-2024-36016
cve-2024-35990
cve-2024-35984
cve-2024-35992
cve-2024-36008
software

CVSS3

7.7

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

AI Score

9.2

Confidence

High

Benedict Schlüter, Supraja Sridhara, Andrin Bertschi, and Shweta Shinde
discovered that an untrusted hypervisor could inject malicious #VC
interrupts and compromise the security guarantees of AMD SEV-SNP. This flaw
is known as WeSee. A local attacker in control of the hypervisor could use
this to expose sensitive information or possibly execute arbitrary code in
the trusted execution environment. (CVE-2024-25742)

Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:

  • DMA engine subsystem;
  • HID subsystem;
  • I2C subsystem;
  • PHY drivers;
  • TTY drivers;
  • IPv4 networking;
    (CVE-2024-35997, CVE-2024-36016, CVE-2024-35990, CVE-2024-35984,
    CVE-2024-35992, CVE-2024-36008)

CVSS3

7.7

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

AI Score

9.2

Confidence

High