Multiple vulnerabilities in Dell Storage Resource Manager (SRM) and Dell Storage Monitoring and Reporting (SMR)

1) Race condition

EUVDB-ID: #VU74629

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-1582

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a race condition within fs/proc/task_mmu.c. A local user can exploit the race and crash the kernel.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://lore.kernel.org/linux-mm/Yg6ac8WlwtnDH6M0@kroah.com/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Use-after-free

EUVDB-ID: #VU94414

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48851

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the tx_complete() function in drivers/staging/gdm724x/gdm_lte.c. A local user can escalate privileges on the system.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/6dc7b87c62423bfa68139fe95e85028aab584c9a
http://git.kernel.org/stable/c/83a9c886c2b5a0d28c0b37e1736b47f38d61332a
http://git.kernel.org/stable/c/48ecdf3e29a6e514e8196691589c7dfc6c4ac169
http://git.kernel.org/stable/c/403e3afe241b62401de1f8629c9c6b9b3d69dbff
http://git.kernel.org/stable/c/6d9700b445098dbbce0caff4b8cfca214cf1e757
http://git.kernel.org/stable/c/1fb9dd3787495b4deb0efe66c58306b65691a48f
http://git.kernel.org/stable/c/d39dc79513e99147b4c158a8a9e46743e23944f5
http://git.kernel.org/stable/c/fc7f750dc9d102c1ed7bbe4591f991e770c99033

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Memory leak

EUVDB-ID: #VU94397

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48853

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the Documentation/DMA-attributes.txt, include/linux/dma-mapping.h, lib/swiotlb.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/c132f2ba716b5ee6b35f82226a6e5417d013d753
http://git.kernel.org/stable/c/971e5dadffd02beba1063e7dd9c3a82de17cf534
http://git.kernel.org/stable/c/8d9ac1b6665c73f23e963775f85d99679fd8e192
http://git.kernel.org/stable/c/6bfc5377a210dbda2a237f16d94d1bd4f1335026
http://git.kernel.org/stable/c/d4d975e7921079f877f828099bb8260af335508f
http://git.kernel.org/stable/c/7403f4118ab94be837ab9d770507537a8057bc63
http://git.kernel.org/stable/c/270475d6d2410ec66e971bf181afe1958dad565e
http://git.kernel.org/stable/c/ddbd89deb7d32b1fbb879f48d68fda1a8ac58e8e

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Memory leak

EUVDB-ID: #VU94396

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48856

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the gfar_get_ts_info() function in drivers/net/ethernet/freescale/gianfar_ethtool.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/6263f2eb93a85ad7df504daf0c341a7fb6bbe8a6
http://git.kernel.org/stable/c/f7b3b520349193f8a82cca74daf366199e06add9
http://git.kernel.org/stable/c/21044e679ed535345042d2023f7df0ca8e897e2a
http://git.kernel.org/stable/c/f49f646f9ec296fc0afe7ae92c2bb47f23e3846c
http://git.kernel.org/stable/c/0e1b9a2078e07fb1e6e91bf8badfd89ecab1e848
http://git.kernel.org/stable/c/2ac5b58e645c66932438bb021cb5b52097ce70b0

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Use-after-free

EUVDB-ID: #VU94412

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48857

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the nfc_digital_free_device() function in drivers/nfc/port100.c. A local user can escalate privileges on the system.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/205c4ec78e71cbf561794e6043da80e7bae6790f
http://git.kernel.org/stable/c/32e866ae5a7af590597ef4bcff8451bf96d5f980
http://git.kernel.org/stable/c/b1db33d4e54bc35d8db96ce143ea0ef92e23d58e
http://git.kernel.org/stable/c/cd2a5c0da0d1ddf11d1f84e9c9b1949f50f6e161
http://git.kernel.org/stable/c/2b1c85f56512d49e43bc53741fce2f508cd90029
http://git.kernel.org/stable/c/0e721b8f2ee5e11376dd55363f9ccb539d754b8a
http://git.kernel.org/stable/c/7194737e1be8fdc89d2a9382bd2f371f7ee2eda8
http://git.kernel.org/stable/c/f80cfe2f26581f188429c12bd937eb905ad3ac7b

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Use-after-free

EUVDB-ID: #VU94411

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48858

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the cmd_alloc_index() and cmd_ent_get() functions in drivers/net/ethernet/mellanox/mlx5/core/cmd.c. A local user can escalate privileges on the system.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/1a4017926eeea56c7540cc41b42106746ee8a0ee
http://git.kernel.org/stable/c/f3331bc17449f15832c31823f27573f4c0e13e5f
http://git.kernel.org/stable/c/7c519f769f555ff7d9d4ccba3497bbb589df360a
http://git.kernel.org/stable/c/0401bfb27a91d7bdd74b1635c1aae57cbb128da6
http://git.kernel.org/stable/c/063bd355595428750803d8736a9bb7c8db67d42d

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Memory leak

EUVDB-ID: #VU94395

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48859

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the prestera_switch_set_base_mac_addr() function in drivers/net/ethernet/marvell/prestera/prestera_main.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/b7c2fd1d126329340639adfb8dd2938fe4b65df7
http://git.kernel.org/stable/c/4cc66bf17220ff9631f9fa99b02a872e0ad5a08b
http://git.kernel.org/stable/c/c9ffa3e2bc451816ce0295e40063514fabf2bd36

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Memory leak

EUVDB-ID: #VU94394

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48860

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the xemaclite_of_probe() function in drivers/net/ethernet/xilinx/xilinx_emaclite.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/669172ce976608b25a2f76f3c65d47f042d125c9
http://git.kernel.org/stable/c/b7220f8e9d6c6b9594ddfb3125dad938cd478b1f
http://git.kernel.org/stable/c/8609e29611befc4bfbe7a91bb50fc65ae72ff549
http://git.kernel.org/stable/c/8ee065a7a9b6a3976c16340503677efc4d8351f6
http://git.kernel.org/stable/c/979b418b96e35f07136f77962ccfaa54cf3e30e1
http://git.kernel.org/stable/c/5e7c402892e189a7bc152b125e72261154aa585d
http://git.kernel.org/stable/c/1852854ee349881efb78ccdbbb237838975902e4
http://git.kernel.org/stable/c/b19ab4b38b06aae12442b2de95ccf58b5dc53584

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Use-after-free

EUVDB-ID: #VU94410

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48861

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the vp_vdpa_remove() function in drivers/vdpa/virtio_pci/vp_vdpa.c. A local user can escalate privileges on the system.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/4b1743bc715a3691a63ac21b349079b07bf1b19e
http://git.kernel.org/stable/c/dc54ba9932aeaaa1a21fe214af1f446593a78274
http://git.kernel.org/stable/c/eb057b44dbe35ae14527830236a92f51de8f9184

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Infinite loop

EUVDB-ID: #VU94469

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48862

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop within the vhost_chr_write_iter() function in drivers/vhost/vhost.c, within the vhost_iotlb_add_range_ctx() function in drivers/vhost/iotlb.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/f8d88e86e90ea1002226d7ac2430152bfea003d1
http://git.kernel.org/stable/c/d9a747e6b6561280bf1791bb24c5e9e082193dad
http://git.kernel.org/stable/c/e2ae38cf3d91837a493cb2093c87700ff3cbe667

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Memory leak

EUVDB-ID: #VU94393

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48863

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the dsp_pipeline_destroy() and dsp_pipeline_build() functions in drivers/isdn/mISDN/dsp_pipeline.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/a3d5fcc6cf2ecbba5a269631092570aa285a24cb
http://git.kernel.org/stable/c/7777b1f795af1bb43867375d8a776080111aae1b
http://git.kernel.org/stable/c/640445d6fc059d4514ffea79eb4196299e0e2d0f
http://git.kernel.org/stable/c/c6a502c2299941c8326d029cfc8a3bc8a4607ad5

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Out-of-bounds read

EUVDB-ID: #VU94429

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48866

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the thrustmaster_interrupts() function in drivers/hid/hid-thrustmaster.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/3ffbe85cda7f523dad896bae08cecd8db8b555ab
http://git.kernel.org/stable/c/56185434e1e50acecee56d8f5850135009b87947
http://git.kernel.org/stable/c/fc3ef2e3297b3c0e2006b5d7b3d66965e3392036

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Resource exhaustion

EUVDB-ID: #VU75412

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-30608

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://github.com/andialbrecht/sqlparse/security/advisories/GHSA-rrm6-wvj7-cwh2
http://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS
http://github.com/andialbrecht/sqlparse/commit/c457abd5f097dd13fb21543381e7cfafe7d31cfb
http://github.com/andialbrecht/sqlparse/commit/e75e35869473832a1eb67772b1adfee2db11b85a

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Out-of-bounds read

EUVDB-ID: #VU94428

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48847

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the watch_queue_set_filter() function in kernel/watch_queue.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/648895da69ced90ca770fd941c3d9479a9d72c16
http://git.kernel.org/stable/c/1b09f28f70a5046acd64138075ae3f095238b045
http://git.kernel.org/stable/c/b36588ebbcef74583824c08352e75838d6fb4ff2
http://git.kernel.org/stable/c/c993ee0f9f81caf5767a50d1faeba39a0dc82af2

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU96619

Risk: Low

CVSSv3.1: 5.8 [CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-31315

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper validation in a model specific register (MSR). A malicious application with ring0 access can modify SMM configuration while SMI lock is enabled, potentially leading to arbitrary code execution.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://www.amd.com/en/resources/product-security/bulletin/amd-sb-7014.html

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) Out-of-bounds read

EUVDB-ID: #VU80795

Risk: Low

CVSSv3.1: 4 [CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-37453

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows an attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary condition within the read_descriptors() function in drivers/usb/core/sysfs.c. An attacker with physical access to the system can attach a malicious USB device, trigger an out-of-bounds read error and crash the kernel.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://syzkaller.appspot.com/bug?extid=18996170f8096c6174d0
http://lore.kernel.org/all/000000000000c0ffe505fe86c9ca@google.com/T/
http://lore.kernel.org/all/000000000000e56434059580f86e@google.com/T/

Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

17) Buffer overflow

EUVDB-ID: #VU93622

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52762

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the virtblk_probe() function in drivers/block/virtio_blk.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/72775cad7f572bb2501f9ea609e1d20e68f0b38b
http://git.kernel.org/stable/c/472bd4787406bef2e8b41ee4c74d960a06a49a48
http://git.kernel.org/stable/c/017278f141141367f7d14b203e930b45b6ffffb9
http://git.kernel.org/stable/c/d667fe301dcbcb12d1d6494fc4b8abee2cb75d90
http://git.kernel.org/stable/c/fafb51a67fb883eb2dde352539df939a251851be

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

18) Out-of-bounds read

EUVDB-ID: #VU91086

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52766

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the hci_dma_irq_handler() function in drivers/i3c/master/mipi-i3c-hci/dma.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/d23ad76f240c0f597b7a9eb79905d246f27d40df
http://git.kernel.org/stable/c/8be39f66915b40d26ea2c18ba84b5c3d5da6809b
http://git.kernel.org/stable/c/7c2b91b30d74d7c407118ad72502d4ca28af1af6
http://git.kernel.org/stable/c/4c86cb2321bd9c72d3b945ce7f747961beda8e65
http://git.kernel.org/stable/c/45a832f989e520095429589d5b01b0c65da9b574

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

19) Use-after-free

EUVDB-ID: #VU90071

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52800

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the ath11k_htt_pktlog() function in drivers/net/wireless/ath/ath11k/dp_rx.c. A local user can escalate privileges on the system.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/03ed26935bebf6b6fd8a656490bf3dcc71b72679
http://git.kernel.org/stable/c/3a51e6b4da71fdfa43ec006d6abc020f3e22d14e
http://git.kernel.org/stable/c/e3199b3fac65c9f103055390b6fd07c5cffa5961
http://git.kernel.org/stable/c/423762f021825b5e57c3d6f01ff96a9ff19cdcd8
http://git.kernel.org/stable/c/69cede2a5a5f60e3f5602b901b52cb64edd2ea6c
http://git.kernel.org/stable/c/3f77c7d605b29df277d77e9ee75d96e7ad145d2d

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

20) Use-after-free

EUVDB-ID: #VU94326

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52885

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the svc_tcp_listen_data_ready() function in net/sunrpc/svcsock.c. A local user can escalate privileges on the system.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/c7b8c2d06e437639694abe76978e915cfb73f428
http://git.kernel.org/stable/c/dfc896c4a75cb8cd7cb2dfd9b469cf1e3f004254
http://git.kernel.org/stable/c/42725e5c1b181b757ba11d804443922982334d9b
http://git.kernel.org/stable/c/cd5ec3ee52ce4b7e283cc11facfa420c297c8065
http://git.kernel.org/stable/c/fbf4ace39b2e4f3833236afbb2336edbafd75eee
http://git.kernel.org/stable/c/ef047411887ff0845afd642d6a687819308e1a4e
http://git.kernel.org/stable/c/7e1f989055622fd086c5dfb291fc72adf5660b6f
http://git.kernel.org/stable/c/fc80fc2d4e39137869da3150ee169b40bf879287

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

21) Out-of-bounds read

EUVDB-ID: #VU94434

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52886

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the get_bMaxPacketSize0(), hub_port_init(), hub_port_connect() and usb_reset_and_verify_device() functions in drivers/usb/core/hub.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/9d241c5d9a9b7ad95c90c6520272fe404d5ac88f
http://git.kernel.org/stable/c/7fe9d87996062f5eb0ca476ad0257f79bf43aaf5
http://git.kernel.org/stable/c/8186596a663506b1124bede9fde6f243ef9f37ee
http://git.kernel.org/stable/c/b4a074b1fb222164ed7d5c0b8c922dc4a0840848
http://git.kernel.org/stable/c/b9fbfb349eacc0820f91c797d7f0a3ac7a4935b5
http://git.kernel.org/stable/c/ff33299ec8bb80cdcc073ad9c506bd79bb2ed20b

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

22) Resource management error

EUVDB-ID: #VU94710

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-1737

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources within the application when handling a very large number of RRs. Resolver caches and authoritative zone databases that hold significant numbers of RRs for the same hostname (of any RTYPE) can suffer from degraded performance as content is being added or updated, and also when handling client queries for this name.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://kb.isc.org/docs/cve-2024-1737
http://www.openwall.com/lists/oss-security/2024/07/23/1

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

23) Resource exhaustion

EUVDB-ID: #VU94711

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-1975

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources. If a server hosts a zone containing a "KEY" Resource Record, or a resolver DNSSEC-validates a "KEY" Resource Record from a DNSSEC-signed domain in cache, a client can exhaust resolver CPU resources by sending a stream of SIG(0) signed requests.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://kb.isc.org/docs/cve-2024-1975
http://www.openwall.com/lists/oss-security/2024/07/23/1

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

24) Reachable assertion

EUVDB-ID: #VU94713

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-4076

CWE-ID: CWE-617 - Reachable Assertion

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a reachable assertion when serving both stale cache data and authoritative zone content. A remote attacker can send specially crafted queries to the DNS server to trigger an assertion failure and perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://kb.isc.org/docs/cve-2024-4076
http://www.openwall.com/lists/oss-security/2024/07/23/1

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

25) Out-of-bounds read

EUVDB-ID: #VU93424

Risk: Low

CVSSv3.1: 3.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-5535

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary condition within the SSL_select_next_proto() function when using NPN. A remote attacker can send specially crafted data to the application, trigger an out-of-bounds read and perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://www.openssl.org/news/secadv/20240627.txt

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

26) Resource management error

EUVDB-ID: #VU94484

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48849

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the amdgpu_display_framebuffer_init() function in drivers/gpu/drm/amd/amdgpu/amdgpu_display.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/fcd1d79aa943fff4fbaa0cce1d576995a7960699
http://git.kernel.org/stable/c/cb29021be49858059138f75d6311a7c35a9379b2
http://git.kernel.org/stable/c/e2b993302f40c4eb714ecf896dd9e1c5be7d4cd7

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

27) NULL pointer dereference

EUVDB-ID: #VU94436

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48843

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the EXPORT_SYMBOL() function in drivers/gpu/drm/drm_connector.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/941e8bcd2b2ba95490738e33dfeca27168452779
http://git.kernel.org/stable/c/0ba557d330946c23559aaea2d51ea649fdeca98a
http://git.kernel.org/stable/c/3534c5c005ef99a1804ed50b8a72cdae254cabb5
http://git.kernel.org/stable/c/85271e92ae4f13aa679acaa6cf76b3c36bcb7bab
http://git.kernel.org/stable/c/62929726ef0ec72cbbe9440c5d125d4278b99894

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

28) Out-of-bounds read

EUVDB-ID: #VU95131

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-7264

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary condition within the ASN1 parser code in the GTime2str() function. A remote attacker can trigger an out-of-bounds read error and cause a denial of service condition on the system.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://curl.se/docs/CVE-2024-7264.json
http://curl.se/docs/CVE-2024-7264.html
http://hackerone.com/reports/2629968
http://www.openwall.com/lists/oss-security/2024/07/31/1

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

29) Improper locking

EUVDB-ID: #VU94451

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48826

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the vc4_dsi_host_attach() and vc4_dsi_dev_remove() functions in drivers/gpu/drm/vc4/vc4_dsi.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/770d1ba9a8201ce9bee0946eb03746449b6f3b80
http://git.kernel.org/stable/c/dddd832f35096fbc5004e3a7e58fb4d2cefb8deb
http://git.kernel.org/stable/c/0a3d12ab5097b1d045e693412e6b366b7e82031b

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

30) Resource management error

EUVDB-ID: #VU94474

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48814

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the vsc9953_mdio_bus_alloc() and vsc9953_mdio_bus_free() functions in drivers/net/dsa/ocelot/seville_vsc9953.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/1d13e7221035947c62800c9d3d99b4ed570e27e7
http://git.kernel.org/stable/c/0e816362d823cd46c666e64d8bffe329ee22f4cc
http://git.kernel.org/stable/c/bd488afc3b39e045ba71aab472233f2a78726e7b

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

31) Resource management error

EUVDB-ID: #VU94471

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48815

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the bcm_sf2_mdio_register() function in drivers/net/dsa/bcm_sf2.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/2770b795294ed312375c11ef1d0b810499c66b83
http://git.kernel.org/stable/c/caabb5f64f5c32fceed93356bb688ef1ec6c5783
http://git.kernel.org/stable/c/08e1a3554e99a1a5bd2835907381e2383ee85cae
http://git.kernel.org/stable/c/08f1a20822349004bb9cc1b153ecb516e9f2889d

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

32) Improper locking

EUVDB-ID: #VU94452

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48816

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the xs_get_srcport() function in net/sunrpc/xprtsock.c, within the rpc_sysfs_xprt_srcaddr_show() function in net/sunrpc/sysfs.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/9482ab4540f5bcc869b44c067ae99b5fca16bd07
http://git.kernel.org/stable/c/b49ea673e119f59c71645e2f65b3ccad857c90ee

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

33) Resource management error

EUVDB-ID: #VU94473

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48817

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the ar9331_sw_mbus_init() and ar9331_sw_remove() functions in drivers/net/dsa/qca/ar9331.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/475ce5dcf2d88fd4f3c213a0ac944e3e40702970
http://git.kernel.org/stable/c/aae1c6a1d3d696fc33b609fb12fe744a556d1dc5
http://git.kernel.org/stable/c/f1842a8cb71de4d7eb75a86f76e88c7ee739218c
http://git.kernel.org/stable/c/50facd86e9fbc4b93fe02e5fe05776047f45dbfb

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

34) Improper error handling

EUVDB-ID: #VU94461

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48818

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the mv88e6xxx_mdio_register() and mv88e6xxx_mdios_unregister() functions in drivers/net/dsa/mv88e6xxx/chip.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/8ccebe77df6e0d88c72ba5e69cf1835927e53b6c
http://git.kernel.org/stable/c/8b626d45127d6f5ada7d815b83cfdc09e8cb1394
http://git.kernel.org/stable/c/1b451c3994a2d322f8e55032c62c8b47b7d95900
http://git.kernel.org/stable/c/f53a2ce893b2c7884ef94471f170839170a4eba0

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

35) Memory leak

EUVDB-ID: #VU94404

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48820

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the stm32_usbphyc_pll_enable() function in drivers/phy/st/phy-stm32-usbphyc.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/94b16ca86ab688ed6fad4548f70137f93cf1f0a9
http://git.kernel.org/stable/c/0ad1a88fa3eb0ded7798f52b79bc33f75fc9a6d2
http://git.kernel.org/stable/c/cfc826c88a79e22ba5d8001556eb2c7efd8a01b6

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

36) Use-after-free

EUVDB-ID: #VU94417

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48821

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the fastrpc_dmabuf_alloc() function in drivers/misc/fastrpc.c. A local user can escalate privileges on the system.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/4e6fd2b5fcf8e7119305a6042bd92e7f2b9ed215
http://git.kernel.org/stable/c/a5ce7ee5fcc07583159f54ab4af5164de00148f5
http://git.kernel.org/stable/c/e4382d0a39f9a1e260d62fdc079ddae5293c037d
http://git.kernel.org/stable/c/76f85c307ef9f10aa2cef1b1d5ee654c1f3345fc
http://git.kernel.org/stable/c/46963e2e0629cb31c96b1d47ddd89dc3d8990b34

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

37) Memory leak

EUVDB-ID: #VU94403

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48822

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the ffs_data_put(), ffs_data_new(), ffs_epfiles_destroy() and ffs_func_eps_disable() functions in drivers/usb/gadget/function/f_fs.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/32048f4be071f9a6966744243f1786f45bb22dc2
http://git.kernel.org/stable/c/cfe5f6fd335d882bcc829a1c8a7d462a455c626e
http://git.kernel.org/stable/c/c9fc422c9a43e3d58d246334a71f3390401781dc
http://git.kernel.org/stable/c/0042178a69eb77a979e36a50dcce9794a3140ef8
http://git.kernel.org/stable/c/72a8aee863af099d4434314c4536d6c9a61dcf3c
http://git.kernel.org/stable/c/3e078b18753669615301d946297bafd69294ad2c
http://git.kernel.org/stable/c/ebe2b1add1055b903e2acd86b290a85297edc0b3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

38) Incorrect calculation

EUVDB-ID: #VU94488

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48823

CWE-ID: CWE-682 - Incorrect Calculation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to incorrect calculation within the qedf_initiate_cleanup() function in drivers/scsi/qedf/qedf_io.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/7cc32ff0cd6c44a3c26de5faecfe8b5546198fad
http://git.kernel.org/stable/c/87f187e5265bc8e3b38faef8b9db864cdd61dde7
http://git.kernel.org/stable/c/6be8eaad75ca73131e2a697f0270dc8ee73814a8
http://git.kernel.org/stable/c/7fcbed38503bb34c6e6538b6a9482d1c6bead1e8
http://git.kernel.org/stable/c/5239ab63f17cee643bd4bf6addfedebaa7d4f41e

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

39) NULL pointer dereference

EUVDB-ID: #VU94445

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48824

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the myrs_cleanup() function in drivers/scsi/myrs.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/5c5ceea00c8c9df150708e66cb9f2891192c1162
http://git.kernel.org/stable/c/0e42c4a3d732517edc3766dd45a14e60d29dd929
http://git.kernel.org/stable/c/6207f35c213f6cb2fc3f13b5e77f08c710e1de19
http://git.kernel.org/stable/c/1d6cd26605b4d662063a83c15c776b5299a1cb23
http://git.kernel.org/stable/c/4db09593af0b0b4d7d4805ebb3273df51d7cc30d

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

40) Resource management error

EUVDB-ID: #VU94485

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48825

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the qedf_vport_create() function in drivers/scsi/qedf/qedf_main.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/aa7352aa155e19815b41f09f114fe9f110fde4d8
http://git.kernel.org/stable/c/1f53bbf27a876f7e61262bd74c18680ac11d4c31
http://git.kernel.org/stable/c/0be556512cd0dfcf5ec1a140d9f42d88221a5d4e
http://git.kernel.org/stable/c/b70a99fd13282d7885f69bf1372e28b7506a1613

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

41) Buffer overflow

EUVDB-ID: #VU94479

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48827

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the nfsd4_encode_read() and nfsd4_encode_read_plus() functions in fs/nfsd/nfs4xdr.c, within the nfsd4_read() function in fs/nfsd/nfs4proc.c, within the nfsd3_proc_read() function in fs/nfsd/nfs3proc.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/1726a39b0879acfb490b22dca643f26f4f907da9
http://git.kernel.org/stable/c/c6eff5c4277146a78b4fb8c9b668dd64542c41b0
http://git.kernel.org/stable/c/44502aca8e02ab32d6b0eb52e006a5ec9402719b
http://git.kernel.org/stable/c/0cb4d23ae08c48f6bf3c29a8e5c4a74b8388b960

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

42) Improper locking

EUVDB-ID: #VU94446

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48842

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the ice_service_task() function in drivers/net/ethernet/intel/ice/ice_main.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/a9bbacc53d1f5ed8febbfdf31401d20e005f49ef
http://git.kernel.org/stable/c/e1014fc5572375658fa421531cedb6e084f477dc
http://git.kernel.org/stable/c/5cb1ebdbc4342b1c2ce89516e19808d64417bdbc

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

43) Integer underflow

EUVDB-ID: #VU94466

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48828

CWE-ID: CWE-191 - Integer underflow

Exploit availability: No

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer underflow within the nfsd_setattr() function in fs/nfsd/vfs.c. A local user can execute arbitrary code.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/38d02ba22e43b6fc7d291cf724bc6e3b7be6626b
http://git.kernel.org/stable/c/8e0ecaf7a7e57b30284d6b3289cc436100fadc48
http://git.kernel.org/stable/c/da22ca1ad548429d7822011c54cfe210718e0aa7
http://git.kernel.org/stable/c/e6faac3f58c7c4176b66f63def17a34232a17b0e

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

44) Input validation error

EUVDB-ID: #VU94492

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48829

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the svcxdr_decode_sattr3() function in fs/nfsd/nfs3xdr.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/a231ae6bb50e7c0a9e9efd7b0d10687f1d71b3a3
http://git.kernel.org/stable/c/37f2d2cd8eadddbbd9c7bda327a9393399b2f89b
http://git.kernel.org/stable/c/aa9051ddb4b378bd22e72a67bc77b9fc1482c5f0
http://git.kernel.org/stable/c/a648fdeb7c0e17177a2280344d015dba3fbe3314

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

45) Improper locking

EUVDB-ID: #VU94450

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48830

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the LIST_HEAD(), isotp_rcv() and isotp_init() functions in net/can/isotp.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/7b53d2204ce79b27a878074a77d64f40ec21dbca
http://git.kernel.org/stable/c/f90cc68f9f4b5d8585ad5d0a206a9d37ac299ef3
http://git.kernel.org/stable/c/5b068f33bc8acfcfd5ea7992a2dafb30d89bad30
http://git.kernel.org/stable/c/7c759040c1dd03954f650f147ae7175476d51314

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

46) Memory leak

EUVDB-ID: #VU94402

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48831

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the asymmetric_verify() function in security/integrity/digsig_asymmetric.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/0838d6d68182f0b28a5434bc6d50727c4757e35b
http://git.kernel.org/stable/c/89f586d3398f4cc0432ed870949dffb702940754
http://git.kernel.org/stable/c/926fd9f23b27ca6587492c3f58f4c7f4cd01dad5

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

47) Resource management error

EUVDB-ID: #VU94481

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48834

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the usbtmc_ioctl_request() function in drivers/usb/class/usbtmc.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/700a0715854c1e79a73341724ce4f5bb01abc016
http://git.kernel.org/stable/c/10a805334a11acd547602d6c4cf540a0f6ab5c6e
http://git.kernel.org/stable/c/c69aef9db878ab277068a8cc1b4bf0cf309dc2b7
http://git.kernel.org/stable/c/5f6a2d63c68c12cf61259df7c3527a0e05dce952
http://git.kernel.org/stable/c/e9b667a82cdcfe21d590344447d65daed52b353b

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

48) Improper locking

EUVDB-ID: #VU94448

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48835

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the mpt3sas_base_sync_reply_irqs() function in drivers/scsi/mpt3sas/mpt3sas_base.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/98e7a654a5bebaf1a28e987af5e44c002544a413
http://git.kernel.org/stable/c/0cd2dd4bcf4abc812148c4943f966a3c8dccb00f
http://git.kernel.org/stable/c/3916e33b917581e2b2086e856c291cb86ea98a05
http://git.kernel.org/stable/c/69ad4ef868c1fc7609daa235dfa46d28ba7a3ba3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

49) Improper locking

EUVDB-ID: #VU94447

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48836

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the aiptek_probe() function in drivers/input/tablet/aiptek.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/57277a8b5d881e02051ba9d7f6cb3f915c229821
http://git.kernel.org/stable/c/fc8033a55e2796d21e370260a784ac9fbb8305a6
http://git.kernel.org/stable/c/6de20111cd0bb7da9b2294073ba00c7d2a6c1c4f
http://git.kernel.org/stable/c/e732b0412f8c603d1e998f3bff41b5e7d5c3914c
http://git.kernel.org/stable/c/f0d43d22d24182b94d7eb78a2bf6ae7e2b33204a
http://git.kernel.org/stable/c/e762f57ff255af28236cd02ca9fc5c7e5a089d31
http://git.kernel.org/stable/c/35069e654bcab567ff8b9f0e68e1caf82c15dcd7
http://git.kernel.org/stable/c/5600f6986628dde8881734090588474f54a540a8

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

50) Integer overflow

EUVDB-ID: #VU94465

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48837

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer overflow within the rndis_set_response() function in drivers/usb/gadget/function/rndis.c. A local user can execute arbitrary code.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/8b3e4d26bc9cd0f6373d0095b9ffd99e7da8006b
http://git.kernel.org/stable/c/c7953cf03a26876d676145ce5d2ae6d8c9630b90
http://git.kernel.org/stable/c/138d4f739b35dfb40438a0d5d7054965763bfbe7
http://git.kernel.org/stable/c/21829376268397f9fd2c35cfa9135937b6aa3a1e
http://git.kernel.org/stable/c/28bc0267399f42f987916a7174e2e32f0833cc65
http://git.kernel.org/stable/c/56b38e3ca4064041d93c1ca18828c8cedad2e16c
http://git.kernel.org/stable/c/df7e088d51cdf78b1a0bf1f3d405c2593295c7b0
http://git.kernel.org/stable/c/65f3324f4b6fed78b8761c3b74615ecf0ffa81fa

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

51) Use-after-free

EUVDB-ID: #VU94415

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48838

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the usb_gadget_remove_driver(), udc_bind_to_driver() and dev_err() functions in drivers/usb/gadget/udc/core.c. A local user can escalate privileges on the system.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/4325124dde6726267813c736fee61226f1d38f0b
http://git.kernel.org/stable/c/e2d3a7009e505e120805f449c832942660f3f7f3
http://git.kernel.org/stable/c/609a7119bffe3ddd7c93f2fa65be8917e02a0b7e
http://git.kernel.org/stable/c/2282a6eb6d4e118e294e43dcc421e0e0fe4040b5
http://git.kernel.org/stable/c/00bdd9bf1ac6d401ad926d3d8df41b9f1399f646
http://git.kernel.org/stable/c/2015c23610cd0efadaeca4d3a8d1dae9a45aa35a
http://git.kernel.org/stable/c/27d64436984fb8835a8b7e95993193cc478b162e
http://git.kernel.org/stable/c/16b1941eac2bd499f065a6739a40ce0011a3d740

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

52) Memory leak

EUVDB-ID: #VU94392

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48839

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the tpacket_rcv() and packet_recvmsg() functions in net/packet/af_packet.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/b9d5772d60f8e7ef34e290f72fc20e3a4883e7d0
http://git.kernel.org/stable/c/b1e27cda1e3c12b705875bb7e247a97168580e33
http://git.kernel.org/stable/c/a33dd1e6693f80d805155b3f69c18c2f642915da
http://git.kernel.org/stable/c/268dcf1f7b3193bc446ec3d14e08a240e9561e4d
http://git.kernel.org/stable/c/70b7b3c055fd4a464da8da55ff4c1f84269f9b02
http://git.kernel.org/stable/c/a055f5f2841f7522b44a2b1eccb1951b4b03d51a
http://git.kernel.org/stable/c/ef591b35176029fdefea38e8388ffa371e18f4b2
http://git.kernel.org/stable/c/c700525fcc06b05adfea78039de02628af79e07a

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

53) Use of uninitialized resource

EUVDB-ID: #VU94463

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48840

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the iavf_remove() function in drivers/net/ethernet/intel/iavf/iavf_main.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/80974bb730270199c6fcb189af04d5945b87e813
http://git.kernel.org/stable/c/4477b9a4193b35eb3a8afd2adf2d42add2f88d57
http://git.kernel.org/stable/c/b04683ff8f0823b869c219c78ba0d974bddea0b5

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

54) NULL pointer dereference

EUVDB-ID: #VU94435

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48841

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the ice_update_vsi_tx_ring_stats() function in drivers/net/ethernet/intel/ice/ice_main.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/2397270ec97c5e3009a58ac110a25e1869e9d6ff
http://git.kernel.org/stable/c/f153546913bada41a811722f2c6d17c3243a0333

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

55) Code Injection

EUVDB-ID: #VU95339

Risk: High

CVSSv3.1: 7.1 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-6345

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation when processing URL in the package_index module of pypa/setuptools. A remote attacker can send a specially crafted request and execute arbitrary code on the target system via download functions.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://huntr.com/bounties/d6362117-ad57-4e83-951f-b8141c6e7ca5
http://github.com/pypa/setuptools/commit/88807c7062788254f654ea8c03427adc859321f0

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

56) Race condition

EUVDB-ID: #VU87596

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26583

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a race condition between async notify and socket close in TLS implementation in net/tls/tls_sw.c. A remote attacker can send specially crafted traffic to the system, trigger a race condition and perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/aec7961916f3f9e88766e2688992da6980f11b8d
http://git.kernel.org/stable/c/7a3ca06d04d589deec81f56229a9a9d62352ce01
http://git.kernel.org/stable/c/86dc27ee36f558fe223dbdfbfcb6856247356f4a
http://git.kernel.org/stable/c/6209319b2efdd8524691187ee99c40637558fa33

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

57) Resource management error

EUVDB-ID: #VU94476

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48812

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the gswip_mdio_rd(), gswip_mdio(), gswip_mdio_mask() and gswip_remove() functions in drivers/net/dsa/lantiq_gswip.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/e177d2e85ebcd3008c4b2abc293f4118e04eedef
http://git.kernel.org/stable/c/b5652bc50dde7b84e93dfb25479b64b817e377c1
http://git.kernel.org/stable/c/2443ba2fe396bdde187a2fdfa6a57375643ae93c
http://git.kernel.org/stable/c/0d120dfb5d67edc5bcd1804e167dba2b30809afd

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

58) Improper input validation

EUVDB-ID: #VU94585

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-21134

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote authenticated user to perform service disruption.

The vulnerability exists due to improper input validation within the Server: Connection Handling component in MySQL Server. A remote authenticated user can exploit this vulnerability to perform service disruption.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://www.oracle.com/security-alerts/cpujul2024.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

59) Improper input validation

EUVDB-ID: #VU94559

Risk: Low

CVSSv3.1: 3.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-21131

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The vulnerability exists due to improper input validation within the Hotspot component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://www.oracle.com/security-alerts/cpujul2024.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

60) Improper input validation

EUVDB-ID: #VU94560

Risk: Low

CVSSv3.1: 3.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-21138

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The vulnerability exists due to improper input validation within the Hotspot component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://www.oracle.com/security-alerts/cpujul2024.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

61) Improper input validation

EUVDB-ID: #VU94557

Risk: Medium

CVSSv3.1: 4.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-21140

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Hotspot component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://www.oracle.com/security-alerts/cpujul2024.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

62) Improper input validation

EUVDB-ID: #VU94558

Risk: Low

CVSSv3.1: 3.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-21144

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The vulnerability exists due to improper input validation within the Concurrency component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://www.oracle.com/security-alerts/cpujul2024.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

63) Improper input validation

EUVDB-ID: #VU94556

Risk: Medium

CVSSv3.1: 4.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-21145

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the 2D component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://www.oracle.com/security-alerts/cpujul2024.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

64) Improper input validation

EUVDB-ID: #VU94555

Risk: Medium

CVSSv3.1: 6.4 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-21147

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Hotspot component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://www.oracle.com/security-alerts/cpujul2024.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

65) Improper input validation

EUVDB-ID: #VU94570

Risk: Medium

CVSSv3.1: 4.3 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-20996

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the InnoDB component in MySQL Server. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://www.oracle.com/security-alerts/cpujul2024.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

66) Improper input validation

EUVDB-ID: #VU94569

Risk: Medium

CVSSv3.1: 4.3 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-21125

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: FTS component in MySQL Server. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://www.oracle.com/security-alerts/cpujul2024.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

67) Improper input validation

EUVDB-ID: #VU94577

Risk: Medium

CVSSv3.1: 4.3 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-21127

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: DDL component in MySQL Server. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://www.oracle.com/security-alerts/cpujul2024.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

68) Improper input validation

EUVDB-ID: #VU94578

Risk: Medium

CVSSv3.1: 4.3 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-21129

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: DDL component in MySQL Server. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://www.oracle.com/security-alerts/cpujul2024.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

69) Improper input validation

EUVDB-ID: #VU94579

Risk: Medium

CVSSv3.1: 4.3 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-21130

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: Optimizer component in MySQL Server. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://www.oracle.com/security-alerts/cpujul2024.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

70) Improper input validation

EUVDB-ID: #VU94584

Risk: Medium

CVSSv3.1: 4.3 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-21142

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: Security: Privileges component in MySQL Server. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://www.oracle.com/security-alerts/cpujul2024.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

71) Resource management error

EUVDB-ID: #VU95062

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42230

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the define_machine() function in arch/powerpc/platforms/pseries/setup.c, within the pseries_kexec_cpu_down() function in arch/powerpc/platforms/pseries/kexec.c, within the default_machine_kexec() function in arch/powerpc/kexec/core_64.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/c550679d604798d9fed8a5b2bb5693448a25407c
http://git.kernel.org/stable/c/d10e3c39001e9194b9a1bfd6979bd3fa19dccdc5
http://git.kernel.org/stable/c/8c6506616386ce37e59b2745fc481c6713fae4f3
http://git.kernel.org/stable/c/21a741eb75f80397e5f7d3739e24d7d75e619011

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

72) Improper input validation

EUVDB-ID: #VU94582

Risk: Medium

CVSSv3.1: 4.3 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-21162

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: Optimizer component in MySQL Server. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://www.oracle.com/security-alerts/cpujul2024.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

73) Improper input validation

EUVDB-ID: #VU94567

Risk: Medium

CVSSv3.1: 4.8 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-21163

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote privileged user to damange or delete data.

The vulnerability exists due to improper input validation within the Server: Optimizer component in MySQL Server. A remote privileged user can exploit this vulnerability to damange or delete data.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://www.oracle.com/security-alerts/cpujul2024.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

74) Improper input validation

EUVDB-ID: #VU94564

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-21171

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote authenticated user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: Optimizer component in MySQL Server. A remote authenticated user can exploit this vulnerability to perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://www.oracle.com/security-alerts/cpujul2024.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

75) Improper input validation

EUVDB-ID: #VU94574

Risk: Medium

CVSSv3.1: 4.3 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-21173

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the InnoDB component in MySQL Server. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://www.oracle.com/security-alerts/cpujul2024.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

76) Improper input validation

EUVDB-ID: #VU94563

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-21177

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote authenticated user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: Optimizer component in MySQL Server. A remote authenticated user can exploit this vulnerability to perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://www.oracle.com/security-alerts/cpujul2024.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

77) Improper input validation

EUVDB-ID: #VU94575

Risk: Medium

CVSSv3.1: 4.3 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-21179

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the InnoDB component in MySQL Server. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://www.oracle.com/security-alerts/cpujul2024.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

78) Improper input validation

EUVDB-ID: #VU94576

Risk: Medium

CVSSv3.1: 4.3 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-21185

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the InnoDB component in MySQL Server. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://www.oracle.com/security-alerts/cpujul2024.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

79) Improper access control

EUVDB-ID: #VU87607

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-22257

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions when the "AuthenticatedVoter#vote" passing a "null" Authentication parameter. A remote attacker can bypass implemented security restrictions and gain unauthorized access to the application.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://spring.io/security/cve-2024-22257

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

80) Server-Side Request Forgery (SSRF)

EUVDB-ID: #VU89801

Risk: Medium

CVSSv3.1: 6.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-22262

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

Exploit availability: No

The disclosed vulnerability allows a remote attacker to perform SSRF attacks.

The vulnerability exists due to insufficient validation of user-supplied input when parsing URL with the UriComponentsBuilder component. A remote attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems.

Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.

Note, this vulnerability exists due to incomplete fix for #VU87614 (CVE-2024-22259) and #VU86695 (CVE-2024-22243).

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://spring.io/security/cve-2024-22262

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

81) Insufficient Session Expiration

EUVDB-ID: #VU100042

Risk: Low

CVSSv3.1: 3 [CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-47242

CWE-ID: CWE-613 - Insufficient Session Expiration

Exploit availability: No

The vulnerability allows an adjacent user to gain access to sensitive information.

The vulnerability exists due to insufficient session expiration issue. An adjacent user can obtain or guess session token and gain unauthorized access to session that belongs to another user.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000235152/dsa-2024-421-dell-storage-resource-manager-srm-and-dell-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the local network (LAN).

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

82) Resource management error

EUVDB-ID: #VU93732

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-34750

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources within the application when handling HTTP/2 stream. A remote attacker can initiate multiple HTTP/2 connections to the server that are remain open and perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.90
http://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.25
http://lists.apache.org/thread/hmw3txqzzbc1yp2t5cg4dsws0n92ly0f

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

83) Buffer overflow

EUVDB-ID: #VU95054

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42145

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the MODULE_AUTHOR(), __get_agent(), send_handler(), recv_handler() and ib_umad_read() functions in drivers/infiniband/core/user_mad.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/1288cf1cceb0e6df276e182f5412370fb4169bcb
http://git.kernel.org/stable/c/b4913702419d064ec4c4bbf7270643c95cc89a1b
http://git.kernel.org/stable/c/62349fbf86b5e13b02721bdadf98c29afd1e7b5f
http://git.kernel.org/stable/c/d73cb8862e4d6760ccc94d3b57b9ef6271400607
http://git.kernel.org/stable/c/63d202d948bb6d3a28cd8e8b96b160fa53e18baa
http://git.kernel.org/stable/c/b8c5f635997f49c625178d1a0cb32a80ed33abe6
http://git.kernel.org/stable/c/a6627fba793cc75b7365d9504a0095fb2902dda4
http://git.kernel.org/stable/c/ca0b44e20a6f3032224599f02e7c8fb49525c894

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

84) Error handling

EUVDB-ID: #VU89001

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26584

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to an error when handling backlogging of crypto requests in net/tls/tls_sw.c. A remote attacker can send specially crafted traffic to the system and perform a denial of service attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/8590541473188741055d27b955db0777569438e3
http://git.kernel.org/stable/c/13eca403876bbea3716e82cdfe6f1e6febb38754
http://git.kernel.org/stable/c/ab6397f072e5097f267abf5cb08a8004e6b17694
http://git.kernel.org/stable/c/cd1bbca03f3c1d845ce274c0d0a66de8e5929f72

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

85) Out-of-bounds read

EUVDB-ID: #VU92328

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-38559

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the qedf_dbg_debug_cmd_write() function in drivers/scsi/qedf/qedf_debugfs.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/1f84a2744ad813be23fc4be99fb74bfb24aadb95
http://git.kernel.org/stable/c/a75001678e1d38aa607d5b898ec7ff8ed0700d59
http://git.kernel.org/stable/c/769b9fd2af02c069451fe9108dba73355d9a021c
http://git.kernel.org/stable/c/dccd97b39ab2f2b1b9a47a1394647a4d65815255
http://git.kernel.org/stable/c/d93318f19d1e1a6d5f04f5d965eaa9055bb7c613
http://git.kernel.org/stable/c/563e609275927c0b75fbfd0d90441543aa7b5e0d
http://git.kernel.org/stable/c/4907f5ad246fa9b51093ed7dfc7da9ebbd3f20b8
http://git.kernel.org/stable/c/177f43c6892e6055de6541fe9391a8a3d1f95fc9
http://git.kernel.org/stable/c/d0184a375ee797eb657d74861ba0935b6e405c62

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

86) Use-after-free

EUVDB-ID: #VU90210

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26800

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the struct_group(), tls_do_decryption() and tls_decrypt_sg() functions in net/tls/tls_sw.c. A local user can escalate privileges on the system.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/81be85353b0f5a7b660635634b655329b429eefe
http://git.kernel.org/stable/c/1ac9fb84bc7ecd4bc6428118301d9d864d2a58d1
http://git.kernel.org/stable/c/f2b85a4cc763841843de693bbd7308fe9a2c4c89
http://git.kernel.org/stable/c/13114dc5543069f7b97991e3b79937b6da05f5b0

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

87) NULL pointer dereference

EUVDB-ID: #VU90588

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26813

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the vfio_platform_set_irq_unmask(), vfio_automasked_irq_handler(), vfio_irq_handler(), vfio_set_trigger(), vfio_platform_set_irq_trigger(), vfio_platform_set_irqs_ioctl(), vfio_platform_irq_init() and vfio_platform_irq_cleanup() functions in drivers/vfio/platform/vfio_platform_irq.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/7932db06c82c5b2f42a4d1a849d97dba9ce4a362
http://git.kernel.org/stable/c/62d4e43a569b67929eb3319780be5359694c8086
http://git.kernel.org/stable/c/d6bedd6acc0bcb1e7e010bc046032e47f08d379f
http://git.kernel.org/stable/c/0f8d8f9c2173a541812dd750529f4a415117eb29
http://git.kernel.org/stable/c/675daf435e9f8e5a5eab140a9864dfad6668b375
http://git.kernel.org/stable/c/cc5838f19d39a5fef04c468199699d2a4578be3a
http://git.kernel.org/stable/c/07afdfd8a68f9eea8db0ddc4626c874f29d2ac5e
http://git.kernel.org/stable/c/09452c8fcbd7817c06e8e3212d99b45917e603a5

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

88) Improper error handling

EUVDB-ID: #VU92058

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26814

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the vfio_fsl_mc_set_irq_trigger() function in drivers/vfio/fsl-mc/vfio_fsl_mc_intr.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/083e750c9f5f4c3bf61161330fb84d7c8e8bb417
http://git.kernel.org/stable/c/ee0bd4ad780dfbb60355b99f25063357ab488267
http://git.kernel.org/stable/c/de87511fb0404d23b6da5f4660383b6ed095e28d
http://git.kernel.org/stable/c/6ec0d88166dac43f29e96801c0927d514f17add9
http://git.kernel.org/stable/c/7447d911af699a15f8d050dfcb7c680a86f87012
http://git.kernel.org/stable/c/250219c6a556f8c69c5910fca05a59037e24147d
http://git.kernel.org/stable/c/a563fc18583ca4f42e2fdd0c70c7c618288e7ede

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

89) Improper locking

EUVDB-ID: #VU90774

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26976

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the async_pf_execute(), kvm_clear_async_pf_completion_queue(), kvm_check_async_pf_completion() and kvm_setup_async_pf() functions in virt/kvm/async_pf.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/ab2c2f5d9576112ad22cfd3798071cb74693b1f5
http://git.kernel.org/stable/c/82e25cc1c2e93c3023da98be282322fc08b61ffb
http://git.kernel.org/stable/c/f8730d6335e5f43d09151fca1f0f41922209a264
http://git.kernel.org/stable/c/83d3c5e309611ef593e2fcb78444fc8ceedf9bac
http://git.kernel.org/stable/c/b54478d20375874aeee257744dedfd3e413432ff
http://git.kernel.org/stable/c/a75afe480d4349c524d9c659b1a5a544dbc39a98
http://git.kernel.org/stable/c/4f3a3bce428fb439c66a578adc447afce7b4a750
http://git.kernel.org/stable/c/caa9af2e27c275e089d702cfbaaece3b42bca31b
http://git.kernel.org/stable/c/3d75b8aa5c29058a512db29da7cbee8052724157

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

90) NULL pointer dereference

EUVDB-ID: #VU90508

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35878

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the of_modalias() function in drivers/of/module.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/e4a449368a2ce6d57a775d0ead27fc07f5a86e5b
http://git.kernel.org/stable/c/544561dc56f7e69a053c25e11e6170f48bb97898
http://git.kernel.org/stable/c/a1aa5390cc912934fee76ce80af5f940452fa987

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

91) Resource management error

EUVDB-ID: #VU93192

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35901

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the mana_get_rxbuf_cfg() function in drivers/net/ethernet/microsoft/mana/mana_en.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/ca58927b00385005f488b6a9905ced7a4f719aad
http://git.kernel.org/stable/c/05cb7c41fa1a7a7b2c2a6b81bbe7c67f5c11932b
http://git.kernel.org/stable/c/c0de6ab920aafb56feab56058e46b688e694a246

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

92) Out-of-bounds read

EUVDB-ID: #VU90307

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35905

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the check_stack_access_within_bounds() function in kernel/bpf/verifier.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/9970e059af471478455f9534e8c3db82f8c5496d
http://git.kernel.org/stable/c/37dc1718dc0c4392dbfcb9adec22a776e745dd69
http://git.kernel.org/stable/c/98cdac206b112bec63852e94802791e316acc2c1
http://git.kernel.org/stable/c/3f0784b2f1eb9147973d8c43ba085c5fdf44ff69
http://git.kernel.org/stable/c/203a68151e8eeb331d4a64ab78303f3a15faf103
http://git.kernel.org/stable/c/ecc6a2101840177e57c925c102d2d29f260d37c8

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

93) NULL pointer dereference

EUVDB-ID: #VU90384

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36926

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the pci_dma_bus_setup_pSeriesLP() function in arch/powerpc/platforms/pseries/iommu.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/7fb5793c53f8c024e3eae9f0d44eb659aed833c4
http://git.kernel.org/stable/c/802b13b79ab1fef66c6852fc745cf197dca0cb15
http://git.kernel.org/stable/c/2bed905a72485a2b79a001bd7e66c750942d2155
http://git.kernel.org/stable/c/49a940dbdc3107fecd5e6d3063dc07128177e058

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

94) Input validation error

EUVDB-ID: #VU93310

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36974

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the taprio_parse_mqprio_opt() function in net/sched/sch_taprio.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/f921a58ae20852d188f70842431ce6519c4fdc36
http://git.kernel.org/stable/c/0bf6cc96612bd396048f57d63f1ad454a846e39c
http://git.kernel.org/stable/c/724050ae4b76e4fae05a923cb54101d792cf4404
http://git.kernel.org/stable/c/c37a27a35eadb59286c9092c49c241270c802ae2
http://ssd-disclosure.com/ssd-advisory-linux-kernel-taprio-oob

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

95) Buffer overflow

EUVDB-ID: #VU92376

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-38541

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the of_modalias() function in drivers/of/module.c. A local user can escalate privileges on the system.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/0b0d5701a8bf02f8fee037e81aacf6746558bfd6
http://git.kernel.org/stable/c/ee332023adfd5882808f2dabf037b32d6ce36f9e
http://git.kernel.org/stable/c/e45b69360a63165377b30db4a1dfddd89ca18e9a
http://git.kernel.org/stable/c/cf7385cb26ac4f0ee6c7385960525ad534323252

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

96) Use-after-free

EUVDB-ID: #VU92307

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-38555

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the cmd_comp_notifier() function in drivers/net/ethernet/mellanox/mlx5/core/cmd.c. A local user can escalate privileges on the system.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/f6fbb8535e990f844371086ab2c1221f71f993d3
http://git.kernel.org/stable/c/3cb92b0ad73d3f1734e812054e698d655e9581b0
http://git.kernel.org/stable/c/bf8aaf0ae01c27ae3c06aa8610caf91e50393396
http://git.kernel.org/stable/c/1337ec94bc5a9eed250e33f5f5c89a28a6bfabdb
http://git.kernel.org/stable/c/1d5dce5e92a70274de67a59e1e674c3267f94cd7
http://git.kernel.org/stable/c/7ac4c69c34240c6de820492c0a28a0bd1494265a
http://git.kernel.org/stable/c/db9b31aa9bc56ff0d15b78f7e827d61c4a096e40

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

97) Use-after-free

EUVDB-ID: #VU93322

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-39463

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the v9fs_cached_dentry_delete() function in fs/9p/vfs_dentry.c. A local user can escalate privileges on the system.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/cb299cdba09f46f090b843d78ba26b667d50a456
http://git.kernel.org/stable/c/f0c5c944c6d8614c19e6e9a97fd2011dcd30e8f5
http://git.kernel.org/stable/c/fe17ebf22feb4ad7094d597526d558a49aac92b4
http://git.kernel.org/stable/c/c898afdc15645efb555acb6d85b484eb40a45409
http://www.zerodayinitiative.com/advisories/ZDI-24-1194/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

98) Buffer overflow

EUVDB-ID: #VU95039

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42093

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the dpaa2_eth_xdp_xmit() and update_xps() functions in drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c. A local user can escalate privileges on the system.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/b2262b3be27cee334a2fa175ae3afb53f38fb0b1
http://git.kernel.org/stable/c/763896ab62a672d728f5eb10ac90d98c607a8509
http://git.kernel.org/stable/c/a55afc0f5f20ba30970aaf7271929dc00eee5e7d
http://git.kernel.org/stable/c/48147337d7efdea6ad6e49f5b8eb894b95868ef0
http://git.kernel.org/stable/c/69f49527aea12c23b78fb3d0a421950bf44fb4e2
http://git.kernel.org/stable/c/5e4f25091e6d06e99a23f724c839a58a8776a527
http://git.kernel.org/stable/c/d33fe1714a44ff540629b149d8fab4ac6967585c

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

99) Use-after-free

EUVDB-ID: #VU94223

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-39494

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the ima_eventname_init_common() function in security/integrity/ima/ima_template_lib.c, within the ima_collect_measurement() and ima_d_path() functions in security/integrity/ima/ima_api.c. A local user can escalate privileges on the system.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/7fb374981e31c193b1152ed8d3b0a95b671330d4
http://git.kernel.org/stable/c/dd431c3ac1fc34a9268580dd59ad3e3c76b32a8c
http://git.kernel.org/stable/c/a78a6f0da57d058e2009e9958fdcef66f165208c
http://git.kernel.org/stable/c/be84f32bb2c981ca670922e047cdde1488b233de

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

100) Buffer overflow

EUVDB-ID: #VU94296

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-40902

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the ea_get() function in fs/jfs/xattr.c. A local user can escalate privileges on the system.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/f0dedb5c511ed82cbaff4997a8decf2351ba549f
http://git.kernel.org/stable/c/1e84c9b1838152a87cf453270a5fa75c5037e83a
http://git.kernel.org/stable/c/fc745f6e83cb650f9a5f2c864158e3a5ea76dad0
http://git.kernel.org/stable/c/480e5bc21f2c42d90c2c16045d64d824dcdd5ec7
http://git.kernel.org/stable/c/33aecc5799c93d3ee02f853cb94e201f9731f123
http://git.kernel.org/stable/c/4598233d9748fe4db4e13b9f473588aa25e87d69
http://git.kernel.org/stable/c/b537cb2f4c4a1357479716a9c339c0bda03d873f
http://git.kernel.org/stable/c/7c55b78818cfb732680c4a72ab270cc2d2ee3d0f

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

101) Double free

EUVDB-ID: #VU94289

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-40937

CWE-ID: CWE-415 - Double Free

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a double free error within the gve_rx_skb_hash() and gve_rx_poll_dqo() functions in drivers/net/ethernet/google/gve/gve_rx_dqo.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/75afd8724739ee5ed8165acde5f6ac3988b485cc
http://git.kernel.org/stable/c/d221284991118c0ab16480b53baecd857c0bc442
http://git.kernel.org/stable/c/2ce5341c36993b776012601921d7688693f8c037
http://git.kernel.org/stable/c/a68184d5b420ea4fc7e6b7ceb52bbc66f90d3c50
http://git.kernel.org/stable/c/6f4d93b78ade0a4c2cafd587f7b429ce95abb02e

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

102) Use-after-free

EUVDB-ID: #VU94217

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-40954

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the sk_common_release() function in net/core/sock.c. A local user can escalate privileges on the system.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/78e4aa528a7b1204219d808310524344f627d069
http://git.kernel.org/stable/c/893eeba94c40d513cd0fe6539330ebdaea208c0e
http://git.kernel.org/stable/c/454c454ed645fed051216b79622f7cb69c1638f5
http://git.kernel.org/stable/c/5dfe2408fd7dc4d2e7ac38a116ff0a37b1cfd3b9
http://git.kernel.org/stable/c/6cd4a78d962bebbaf8beb7d2ead3f34120e3f7b2

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

103) Use-after-free

EUVDB-ID: #VU94216

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-40956

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the irq_process_work_list() function in drivers/dma/idxd/irq.c. A local user can escalate privileges on the system.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/1b08bf5a17c66ab7dbb628df5344da53c8e7ab33
http://git.kernel.org/stable/c/83163667d881100a485b6c2daa30301b7f68d9b5
http://git.kernel.org/stable/c/faa35db78b058a2ab6e074ee283f69fa398c36a8
http://git.kernel.org/stable/c/a14968921486793f2a956086895c3793761309dd
http://git.kernel.org/stable/c/e3215deca4520773cd2b155bed164c12365149a7

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

104) Input validation error

EUVDB-ID: #VU94324

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-40989

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the vgic_v3_free_redist_region() and vgic_v3_set_redist_base() functions in arch/arm64/kvm/vgic/vgic-mmio-v3.c, within the kvm_vgic_dist_destroy() function in arch/arm64/kvm/vgic/vgic-init.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/68df4fc449fcc24347209e500ce26d5816705a77
http://git.kernel.org/stable/c/48bb62859d47c5c4197a8c01128d0fa4f46ee58c
http://git.kernel.org/stable/c/152b4123f21e6aff31cea01158176ad96a999c76
http://git.kernel.org/stable/c/0d92e4a7ffd5c42b9fa864692f82476c0bf8bcc8

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

105) Integer overflow

EUVDB-ID: #VU94294

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-40994

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer overflow within the max_vclocks_store() function in drivers/ptp/ptp_sysfs.c. A local user can execute arbitrary code.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/4b03da87d0b7074c93d9662c6e1a8939f9b8b86e
http://git.kernel.org/stable/c/d50d62d5e6ee6aa03c00bddb91745d0b632d3b0f
http://git.kernel.org/stable/c/666e934d749e50a37f3796caaf843a605f115b6f
http://git.kernel.org/stable/c/e1fccfb4638ee6188377867f6015d0ce35764a8e
http://git.kernel.org/stable/c/81d23d2a24012e448f651e007fac2cfd20a45ce0

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

106) Input validation error

EUVDB-ID: #VU94530

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41011

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the kfd_ioctl_alloc_memory_of_gpu(), criu_restore_memory_of_gpu() and kfd_mmio_mmap() functions in drivers/gpu/drm/amd/amdkfd/kfd_chardev.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/89fffbdf535ce659c1a26b51ad62070566e33b28
http://git.kernel.org/stable/c/4b4cff994a27ebf7bd3fb9a798a1cdfa8d01b724
http://git.kernel.org/stable/c/6186c93560889265bfe0914609c274eff40bbeb5
http://git.kernel.org/stable/c/be4a2a81b6b90d1a47eaeaace4cc8e2cb57b96c7

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

107) Use-after-free

EUVDB-ID: #VU94672

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41012

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the fcntl_setlk() function in fs/locks.c. A local user can escalate privileges on the system.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/b6d223942c34057fdfd8f149e763fa823731b224
http://git.kernel.org/stable/c/3cad1bc010416c6dd780643476bc59ed742436b9

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

108) Use of uninitialized resource

EUVDB-ID: #VU95033

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41059

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the hfsplus_listxattr() function in fs/hfsplus/xattr.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/72805debec8f7aa342da194fe0ed7bc8febea335
http://git.kernel.org/stable/c/c733e24a61cbcff10f660041d6d84d32bb7e4cb4
http://git.kernel.org/stable/c/34f8efd2743f2d961e92e8e994de4c7a2f9e74a0
http://git.kernel.org/stable/c/d02d8c1dacafb28930c39e16d48e40bb6e4cbc70
http://git.kernel.org/stable/c/22999936b91ba545ce1fbbecae6895127945e91c
http://git.kernel.org/stable/c/f08956d8e0f80fd0d4ad84ec917302bb2f3a9c6a
http://git.kernel.org/stable/c/ad57dc2caf1e0a3c0a9904400fae7afbc9f74bb2
http://git.kernel.org/stable/c/0570730c16307a72f8241df12363f76600baf57d

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

109) Use-after-free

EUVDB-ID: #VU94943

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41069

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the soc_tplg_dapm_graph_elems_load() function in sound/soc/soc-topology.c. A local user can escalate privileges on the system.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/b188d7f3dfab10e332e3c1066e18857964a520d2
http://git.kernel.org/stable/c/ab5a6208b4d6872b1c6ecea1867940fc668cc76d
http://git.kernel.org/stable/c/ccae5c6a1fab9494c86b7856faf05e296c617702
http://git.kernel.org/stable/c/97ab304ecd95c0b1703ff8c8c3956dc6e2afe8e1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

110) Out-of-bounds read

EUVDB-ID: #VU94840

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41090

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the tap_get_user_xdp() function in drivers/net/tap.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/8be915fc5ff9a5e296f6538be12ea75a1a93bdea
http://git.kernel.org/stable/c/7431144b406ae82807eb87d8c98e518475b0450f
http://git.kernel.org/stable/c/e5e5e63c506b93b89b01f522b6a7343585f784e6
http://git.kernel.org/stable/c/ee93e6da30377cf2a75e16cd32bb9fcd86a61c46
http://git.kernel.org/stable/c/aa6a5704cab861c9b2ae9f475076e1881e87f5aa
http://git.kernel.org/stable/c/73d462a38d5f782b7c872fe9ae8393d9ef5483da
http://git.kernel.org/stable/c/e1a786b9bbb767fd1c922d424aaa8078cc542309
http://git.kernel.org/stable/c/ed7f2afdd0e043a397677e597ced0830b83ba0b3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

111) Resource management error

EUVDB-ID: #VU94475

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48813

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the vsc9959_mdio_bus_alloc() and vsc9959_mdio_bus_free() functions in drivers/net/dsa/ocelot/felix_vsc9959.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/95e5402f9430b3c7d885dd3ec4c8c02c17936923
http://git.kernel.org/stable/c/8cda7577a0b4018572f31e0caadfabd305ea2786
http://git.kernel.org/stable/c/9db6f056efd089e80d81c774c01b639adf30c097
http://git.kernel.org/stable/c/209bdb7ec6a28c7cdf580a0a98afbc9fc3b98932

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

112) NULL pointer dereference

EUVDB-ID: #VU94444

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48811

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the init_crq_queue(), __ibmvnic_open() and ibmvnic_open() functions in drivers/net/ethernet/ibm/ibmvnic.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/960dfaf3b578dd23af012590e809ae2d58ba1827
http://git.kernel.org/stable/c/e08cb9056fb2564d1f6bad789bdf79ab09bf2f81
http://git.kernel.org/stable/c/61772b0908c640d0309c40f7d41d062ca4e979fa

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

113) NULL pointer dereference

EUVDB-ID: #VU92920

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48713

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the pt_handle_status() function in arch/x86/events/intel/pt.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/456f041e035913fcedb275aff6f8a71dfebcd394
http://git.kernel.org/stable/c/e83d941fd3445f660d2f43647c580a320cc384f6
http://git.kernel.org/stable/c/feffb6ae2c80b9a8206450cdef90f5943baced99
http://git.kernel.org/stable/c/1d9093457b243061a9bba23543c38726e864a643

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

114) Use-after-free

EUVDB-ID: #VU92304

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47616

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the rxe_qp_from_init() function in drivers/infiniband/sw/rxe/rxe_qp.c. A local user can escalate privileges on the system.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/acb53e47db1fbc7cd37ab10b46388f045a76e383
http://git.kernel.org/stable/c/84b01721e8042cdd1e8ffeb648844a09cd4213e0

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

115) Infinite loop

EUVDB-ID: #VU92929

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47617

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop within the pciehp_ist() function in drivers/pci/hotplug/pciehp_hpc.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/ff27f7d0333cff89ec85c419f431aca1b38fb16a
http://git.kernel.org/stable/c/464da38ba827f670deac6500a1de9a4f0f44c41d
http://git.kernel.org/stable/c/3b4c966fb156ff3e70b2526d964952ff7c1574d9
http://git.kernel.org/stable/c/1db58c6584a72102e98af2e600ea184ddaf2b8af
http://git.kernel.org/stable/c/6d6f1f0dac3e3441ecdb1103d4efb11b9ed24dd5
http://git.kernel.org/stable/c/23584c1ed3e15a6f4bfab8dc5a88d94ab929ee12

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

116) NULL pointer dereference

EUVDB-ID: #VU92918

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47618

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the obj-$() function in arch/arm/probes/kprobes/Makefile. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/1515e72aae803fc6b466adf918e71c4e4c9d5b3d
http://git.kernel.org/stable/c/ba1863be105b06e10d0e2f6b1b8a0570801cfc71
http://git.kernel.org/stable/c/8b59b0a53c840921b625378f137e88adfa87647e

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

117) NULL pointer dereference

EUVDB-ID: #VU92919

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47619

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the i40e_get_lump() function in drivers/net/ethernet/intel/i40e/i40e_main.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/d46fa4ea9756ef6cbcf9752d0832cc66e2d7121b
http://git.kernel.org/stable/c/be6998f232b8e4ca8225029e305b8329d89bfd59
http://git.kernel.org/stable/c/768eb705e6381f0c70ca29d4e66f19790d5d19a1
http://git.kernel.org/stable/c/00eddb0e4ea115154581d1049507a996acfc2d3e
http://git.kernel.org/stable/c/4b3aa858268b7b9aeef02e5f9c4cd8f8fac101c8
http://git.kernel.org/stable/c/92947844b8beee988c0ce17082b705c2f75f0742

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

118) Out-of-bounds read

EUVDB-ID: #VU92905

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47620

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the hci_le_adv_report_evt() function in net/bluetooth/hci_event.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/305e92f525450f3e1b5f5c9dc7eadb152d66a082
http://git.kernel.org/stable/c/7889b38a7f21ed19314f83194622b195d328465c
http://git.kernel.org/stable/c/5a539c08d743d9910631448da78af5e961664c0e
http://git.kernel.org/stable/c/8819f93cd4a443dfe547aa622b21f723757df3fb
http://git.kernel.org/stable/c/835d3706852537bf92eb23eb8635b8dee0c0aa67
http://git.kernel.org/stable/c/83d5196b65d1b29e27d7dd16a3b9b439fb1d2dba
http://git.kernel.org/stable/c/bcea886771c3f22a590c8c8b9139a107bd7f1e1c
http://git.kernel.org/stable/c/5c968affa804ba98c3c603f37ffea6fba618025e
http://git.kernel.org/stable/c/899663be5e75dc0174dc8bda0b5e6826edf0b29a

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

119) Improper locking

EUVDB-ID: #VU94457

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47622

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the EXPORT_SYMBOL_GPL(), ufshcd_hba_capabilities(), ufshcd_wait_for_dev_cmd(), ufshcd_exec_dev_cmd(), ufshcd_issue_devman_upiu_cmd() and ufshcd_init() functions in drivers/scsi/ufs/ufshcd.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/493c9e850677df8b4eda150c2364b1c1a72ed724
http://git.kernel.org/stable/c/d69d98d8edf90e25e4e09930dd36dd6d09dd6768
http://git.kernel.org/stable/c/945c3cca05d78351bba29fa65d93834cb7934c7b

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

120) Memory leak

EUVDB-ID: #VU94401

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47624

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the rpc_sysfs_xprt_state_change() function in net/sunrpc/sysfs.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/stable/c/4b22aa42bd4d2d630ef1854c139275c3532937cb
http://git.kernel.org/stable/c/5f6024c05a2c0fdd180b29395aaf686d25af3a0f
http://git.kernel.org/stable/c/776d794f28c95051bc70405a7b1fa40115658a18

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

121) Memory leak

EUVDB-ID: #VU63427

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-0854

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due memory leak in the Linux kernel’s DMA subsystem when processing DMA_FROM_DEVICE calls. A local user can trigger a memory leak error and read random memory from the kernel space.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/kernel/dma/swiotlb.c?h=v5.17-rc8&id=aa6f8dcbab473f3a3c7454b74caa46d36cdc5d13

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

122) Out-of-bounds read

EUVDB-ID: #VU67473

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-20368

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary condition within the packet_recvmsg() function in Linux kernel. A local user can trigger an out-of-bounds read error and potentially escalate privileges on the system.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:

http://source.android.com/security/bulletin/pixel/2022-08-01
http://android.googlesource.com/kernel/common/+/a0046956bf6fe

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

123) Input validation error

EUVDB-ID: #VU92925

Risk: Low