Dell RecoverPoint for Virtual Machines update for third-party components

1) Memory leak

EUVDB-ID: #VU94929

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41078

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the btrfs_quota_disable() function in fs/btrfs/qgroup.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Input validation error

EUVDB-ID: #VU94842

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41015

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the ocfs2_check_dir_entry(), ocfs2_search_dirblock(), __ocfs2_delete_entry(), __ocfs2_add_entry(), ocfs2_dir_foreach_blk_id(), ocfs2_dir_foreach_blk_el(), ocfs2_find_dir_space_id() and ocfs2_find_dir_space_el() functions in fs/ocfs2/dir.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Resource management error

EUVDB-ID: #VU93202

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-27437

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the vfio_intx_set_signal() function in drivers/vfio/pci/vfio_pci_intrs.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Improper locking

EUVDB-ID: #VU94451

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48826

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the vc4_dsi_host_attach() and vc4_dsi_dev_remove() functions in drivers/gpu/drm/vc4/vc4_dsi.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Resource management error

EUVDB-ID: #VU94307

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-40987

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the sumo_construct_vid_mapping_table() function in drivers/gpu/drm/amd/amdgpu/kv_dpm.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Use of uninitialized resource

EUVDB-ID: #VU95033

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41059

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the hfsplus_listxattr() function in fs/hfsplus/xattr.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Improper locking

EUVDB-ID: #VU94266

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-40998

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the __ext4_fill_super() function in fs/ext4/super.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Incorrect calculation

EUVDB-ID: #VU94488

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48823

CWE-ID: CWE-682 - Incorrect Calculation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to incorrect calculation within the qedf_initiate_cleanup() function in drivers/scsi/qedf/qedf_io.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Use-after-free

EUVDB-ID: #VU94420

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48792

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the mpi_ssp_completion() and mpi_sata_completion() functions in drivers/scsi/pm8001/pm80xx_hwi.c. A local user can escalate privileges on the system.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Resource management error

EUVDB-ID: #VU94299

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-40978

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the qedi_dbg_do_not_recover_cmd_read() function in drivers/scsi/qedi/qedi_debugfs.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Resource management error

EUVDB-ID: #VU95051

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41081

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the ila_output() function in net/ipv6/ila/ila_lwt.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Out-of-bounds read

EUVDB-ID: #VU91391

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-35949

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the __btrfs_check_leaf() and __btrfs_check_node() functions in fs/btrfs/tree-checker.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Improper locking

EUVDB-ID: #VU94991

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41064

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the eeh_pe_bus_get() function in arch/powerpc/kernel/eeh_pe.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Out-of-bounds read

EUVDB-ID: #VU94956

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41071

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the ieee80211_prep_hw_scan() function in net/mac80211/scan.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) Buffer overflow

EUVDB-ID: #VU94479

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48827

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the nfsd4_encode_read() and nfsd4_encode_read_plus() functions in fs/nfsd/nfs4xdr.c, within the nfsd4_read() function in fs/nfsd/nfs4proc.c, within the nfsd3_proc_read() function in fs/nfsd/nfs3proc.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) Improper locking

EUVDB-ID: #VU94992

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41063

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the hci_unregister_dev() function in net/bluetooth/hci_core.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

17) Integer underflow

EUVDB-ID: #VU94466

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48828

CWE-ID: CWE-191 - Integer underflow

Exploit availability: No

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer underflow within the nfsd_setattr() function in fs/nfsd/vfs.c. A local user can execute arbitrary code.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

18) Input validation error

EUVDB-ID: #VU94492

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48829

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the svcxdr_decode_sattr3() function in fs/nfsd/nfs3xdr.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

19) NULL pointer dereference

EUVDB-ID: #VU94978

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41060

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the radeon_gem_va_update_vm() function in drivers/gpu/drm/radeon/radeon_gem.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

20) NULL pointer dereference

EUVDB-ID: #VU94971

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41089

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the nv17_tv_get_hd_modes() function in drivers/gpu/drm/nouveau/dispnv04/tvnv17.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

21) Buffer overflow

EUVDB-ID: #VU95039

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42093

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the dpaa2_eth_xdp_xmit() and update_xps() functions in drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c. A local user can escalate privileges on the system.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

22) Memory leak

EUVDB-ID: #VU94927

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41066

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the ibmvnic_xmit() function in drivers/net/ethernet/ibm/ibmvnic.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

23) Input validation error

EUVDB-ID: #VU95108

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41044

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the ppp_read() and ppp_write() functions in drivers/net/ppp/ppp_generic.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

24) Improper locking

EUVDB-ID: #VU94267

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-40995

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the tcf_idr_check_alloc() and rcu_read_unlock() functions in net/sched/act_api.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

25) NULL pointer dereference

EUVDB-ID: #VU94982

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41048

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the sk_msg_recvmsg() function in net/core/skmsg.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

26) Input validation error

EUVDB-ID: #VU95106

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41072

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the cfg80211_wext_siwscan() function in net/wireless/scan.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

27) Improper error handling

EUVDB-ID: #VU95012

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42224

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the mv88e6xxx_default_mdio_bus() function in drivers/net/dsa/mv88e6xxx/chip.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

28) NULL pointer dereference

EUVDB-ID: #VU94966

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41095

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the nv17_tv_get_ld_modes() function in drivers/gpu/drm/nouveau/dispnv04/tvnv17.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

29) Input validation error

EUVDB-ID: #VU95099

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42120

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the dce110_vblank_set() function in drivers/gpu/drm/amd/display/dc/irq/dce110/irq_service_dce110.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

30) Out-of-bounds read

EUVDB-ID: #VU94837

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41016

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the ocfs2_xattr_find_entry() function in fs/ocfs2/xattr.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

31) Type Confusion

EUVDB-ID: #VU94923

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42070

CWE-ID: CWE-843 - Type confusion

Exploit availability: No

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to a type confusion error within the nft_lookup_init() function in net/netfilter/nft_lookup.c, within the nf_tables_fill_setelem() and nft_validate_register_store() functions in net/netfilter/nf_tables_api.c. A local user can pass specially crafted data to the packet filtering to trigger a type confusion error and gain access to sensitive information.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

32) Integer overflow

EUVDB-ID: #VU95037

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42223

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer overflow within the tda10048_set_if() function in drivers/media/dvb-frontends/tda10048.c. A local user can execute arbitrary code.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

33) NULL pointer dereference

EUVDB-ID: #VU94240

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-40982

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the ssb_bus_match() function in drivers/ssb/main.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

34) Buffer overflow

EUVDB-ID: #VU94315

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-40941

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the iwl_mvm_mfu_assert_dump_notif() function in drivers/net/wireless/intel/iwlwifi/mvm/fw.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

35) Improper error handling

EUVDB-ID: #VU94290

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-40923

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the vmxnet3_rq_destroy_all_rxdataring() function in drivers/net/vmxnet3/vmxnet3_drv.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

36) Improper locking

EUVDB-ID: #VU94284

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-39507

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the hclge_push_link_status(), hclge_update_link_status(), hclge_uninit_need_wait() and hclge_uninit_client_instance() functions in drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

37) Double free

EUVDB-ID: #VU94289

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-40937

CWE-ID: CWE-415 - Double Free

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a double free error within the gve_rx_skb_hash() and gve_rx_poll_dqo() functions in drivers/net/ethernet/google/gve/gve_rx_dqo.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

38) Security features bypass

EUVDB-ID: #VU53579

Risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-26558

CWE-ID: CWE-254 - Security Features

Exploit availability: No

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to an impersonation in the Passkey Entry protocol flaw. A remote attacker on the local network can perform a man-in-the-middle (MITM) attack and impersonate the initiating device without any previous knowledge.

Note: This vulnerability affects the following specifications:

• BR/EDR Secure Simple Pairing in Bluetooth Core Specifications 2.1 through 5.2
• BR/EDR Secure Connections Pairing in Bluetooth Core Specifications 4.1 through 5.2 
• LE Secure Connections Pairing in Bluetooth Core Specifications 4.2 through 5.2

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

39) Improper access control

EUVDB-ID: #VU54202

Risk: Low

CVSSv4.0: 4.5 [CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-0129

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A remote authenticated attacker on the local network can bypass implemented security restrictions and enable information disclosure

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

40) NULL pointer dereference

EUVDB-ID: #VU94444

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48811

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the init_crq_queue(), __ibmvnic_open() and ibmvnic_open() functions in drivers/net/ethernet/ibm/ibmvnic.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

41) Out-of-bounds read

EUVDB-ID: #VU92318

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-47580

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the p_fill_from_dev_buffer(), resp_inquiry(), resp_requests(), resp_mode_sense(), resp_ie_l_pg(), resp_log_sense() and resp_report_zones() functions in drivers/scsi/scsi_debug.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

42) Use of uninitialized resource

EUVDB-ID: #VU94464

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48855

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the inet_diag_msg_sctpasoc_fill() and inet_sctp_diag_fill() functions in net/sctp/sctp_diag.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

43) Out-of-bounds read

EUVDB-ID: #VU90343

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-52594

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the ath9k_htc_txstatus() function in drivers/net/wireless/ath/ath9k/htc_drv_txrx.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

44) Improper locking

EUVDB-ID: #VU94453

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48810

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the ip6mr_rules_init() function in net/ipv6/ip6mr.c, within the ipmr_rules_init() function in net/ipv4/ipmr.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

45) Resource management error

EUVDB-ID: #VU93467

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-47395

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the ieee80211_parse_tx_radiotap() function in net/mac80211/tx.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

46) Improper locking

EUVDB-ID: #VU92012

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-47468

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the nj_release() function in drivers/isdn/hardware/mISDN/netjet.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

47) Resource management error

EUVDB-ID: #VU93277

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-47582

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the usbdev_release(), do_proc_control() and do_proc_bulk() functions in drivers/usb/core/devio.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

48) Buffer overflow

EUVDB-ID: #VU92955

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-35995

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the show_cppc_data(), acpi_cppc_processor_probe(), cpc_read() and cpc_write() functions in drivers/acpi/cppc_acpi.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

49) NULL pointer dereference

EUVDB-ID: #VU94437

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48850

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the speed_show() function in net/core/net-sysfs.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

50) Improper locking

EUVDB-ID: #VU94275

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-40966

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the con_cleanup() function in drivers/tty/vt/vt.c, within the tty_set_ldisc() function in drivers/tty/tty_ldisc.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

51) Improper locking

EUVDB-ID: #VU94274

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-40967

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the imx_uart_console_write() function in drivers/tty/serial/imx.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

52) Out-of-bounds read

EUVDB-ID: #VU94431

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48804

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the vt_ioctl() function in drivers/tty/vt/vt_ioctl.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

53) Integer underflow

EUVDB-ID: #VU92374

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-47588

CWE-ID: CWE-191 - Integer underflow

Exploit availability: No

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer underflow within the sit_init_net() function in net/ipv6/sit.c. A local user can execute arbitrary code.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

54) Use of uninitialized resource

EUVDB-ID: #VU93435

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-35837

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the mvpp2_bm_pool_cleanup() and mvpp2_bm_init() functions in drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

55) Input validation error

EUVDB-ID: #VU94287

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-40999

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the ena_com_cdesc_rx_pkt_get() and ena_com_rx_pkt() functions in drivers/net/ethernet/amazon/ena/ena_eth_com.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

56) Out-of-bounds read

EUVDB-ID: #VU94840

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41090

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the tap_get_user_xdp() function in drivers/net/tap.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

57) Out-of-bounds read

EUVDB-ID: #VU94841

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41091

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the tun_xdp_one() function in drivers/net/tun.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

58) Out-of-bounds read

EUVDB-ID: #VU94836

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41014

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the xlog_recover_process_data() function in fs/xfs/xfs_log_recover.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

59) Use-after-free

EUVDB-ID: #VU90140

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-47388

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the ieee80211_crypto_ccmp_decrypt() and ieee80211_crypto_gcmp_decrypt() functions in net/mac80211/wpa.c. A local user can escalate privileges on the system.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

60) Memory leak

EUVDB-ID: #VU91623

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-47403

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the ipoctal_port_activate() and ipoctal_cleanup() functions in drivers/ipack/devices/ipoctal.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

61) Memory leak

EUVDB-ID: #VU94204

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-40932

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the vidi_get_modes() function in drivers/gpu/drm/exynos/exynos_drm_vidi.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

62) Resource management error

EUVDB-ID: #VU94308

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-40988

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the sumo_construct_vid_mapping_table() function in drivers/gpu/drm/radeon/sumo_dpm.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

63) Improper error handling

EUVDB-ID: #VU95015

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42119

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the find_first_free_audio() function in drivers/gpu/drm/amd/display/dc/core/dc_resource.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

64) Input validation error

EUVDB-ID: #VU95097

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42124

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the qedf_execute_tmf() function in drivers/scsi/qedf/qedf_io.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

65) Memory leak

EUVDB-ID: #VU94393

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48863

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the dsp_pipeline_destroy() and dsp_pipeline_build() functions in drivers/isdn/mISDN/dsp_pipeline.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

66) Buffer overflow

EUVDB-ID: #VU93248

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48769

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the efi_systab_report_header() function in drivers/firmware/efi/efi.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

67) Input validation error

EUVDB-ID: #VU96196

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-43831

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the vpu_dec_init() function in drivers/media/platform/mediatek/vcodec/decoder/vdec_vpu_if.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

68) Use-after-free

EUVDB-ID: #VU96107

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42285

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the EXPORT_SYMBOL(), destroy_cm_id() and cm_work_handler() functions in drivers/infiniband/core/iwcm.c. A local user can escalate privileges on the system.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

69) Out-of-bounds read

EUVDB-ID: #VU96116

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42301

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the do_active_device(), do_autoprobe(), do_hardware_base_addr(), do_hardware_irq(), do_hardware_dma() and do_hardware_modes() functions in drivers/parport/procfs.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

70) Resource management error

EUVDB-ID: #VU96189

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42322

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the ip_vs_add_service() function in net/netfilter/ipvs/ip_vs_ctl.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

71) Memory leak

EUVDB-ID: #VU96099

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-43854

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the bio_integrity_prep() function in block/bio-integrity.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

72) NULL pointer dereference

EUVDB-ID: #VU96135

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42309

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the psb_intel_lvds_get_modes() function in drivers/gpu/drm/gma500/psb_intel_lvds.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

73) NULL pointer dereference

EUVDB-ID: #VU96134

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42310

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the cdv_intel_lvds_get_modes() function in drivers/gpu/drm/gma500/cdv_intel_lvds.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

74) Input validation error

EUVDB-ID: #VU96209

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42312

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the proc_sys_make_inode() function in fs/proc/proc_sysctl.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

75) Buffer overflow

EUVDB-ID: #VU96176

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42284

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the tipc_udp_addr2str() function in net/tipc/udp_media.c. A local user can escalate privileges on the system.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

76) Use-after-free

EUVDB-ID: #VU96106

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42280

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the hfcmulti_dtmf() and HFC_wait_nodebug() functions in drivers/isdn/hardware/mISDN/hfcmulti.c. A local user can escalate privileges on the system.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

77) Input validation error

EUVDB-ID: #VU94139

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26677

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the rxrpc_propose_delay_ACK(), rxrpc_send_initial_ping() and rxrpc_input_call_event() functions in net/rxrpc/call_event.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

78) NULL pointer dereference

EUVDB-ID: #VU94239

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-40984

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the acpi_ex_system_memory_space_handler() function in drivers/acpi/acpica/exregion.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

79) Buffer overflow

EUVDB-ID: #VU96191

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-43856

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the dmam_free_coherent() function in kernel/dma/mapping.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

80) Input validation error

EUVDB-ID: #VU96197

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-43839

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the bnad_tx_msix_register() and bnad_rx_msix_register() functions in drivers/net/ethernet/brocade/bna/bnad.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

81) Use-after-free

EUVDB-ID: #VU96105

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42271

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the iucv_sever_path() function in net/iucv/af_iucv.c. A local user can escalate privileges on the system.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

82) Use-after-free

EUVDB-ID: #VU90132

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-47341

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the kvm_vm_ioctl_unregister_coalesced_mmio() function in virt/kvm/coalesced_mmio.c. A local user can escalate privileges on the system.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

83) Input validation error

EUVDB-ID: #VU95090

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42157

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the pkey_unlocked_ioctl() function in drivers/s390/crypto/pkey_api.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

84) NULL pointer dereference

EUVDB-ID: #VU96130

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-43819

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the kvm_arch_prepare_memory_region() function in arch/s390/kvm/kvm-s390.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

85) Integer overflow

EUVDB-ID: #VU91180

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26668

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer overflow within the nft_limit_eval() and nft_limit_init() functions in net/netfilter/nft_limit.c. A local user can execute arbitrary code.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

86) Use-after-free

EUVDB-ID: #VU94672

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41012

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the fcntl_setlk() function in fs/locks.c. A local user can escalate privileges on the system.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

87) Improper locking

EUVDB-ID: #VU94996

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41020

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the fcntl_setlk64() function in fs/locks.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

88) Use-after-free

EUVDB-ID: #VU90057

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-36013

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the l2cap_command_rej(), l2cap_connect() and l2cap_chan_unlock() functions in net/bluetooth/l2cap_core.c. A local user can escalate privileges on the system.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

89) Memory leak

EUVDB-ID: #VU90463

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-27011

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the nft_data_hold() and __nf_tables_abort() functions in net/netfilter/nf_tables_api.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

90) Resource management error

EUVDB-ID: #VU96304

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-43879

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the cfg80211_calculate_bitrate_he() function in net/wireless/util.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

91) Input validation error

EUVDB-ID: #VU95510

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42244

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the mos7840_port_remove() function in drivers/usb/serial/mos7840.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

92) Memory leak

EUVDB-ID: #VU95502

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42236

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the usb_string_copy() function in drivers/usb/gadget/configfs.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

93) Resource management error

EUVDB-ID: #VU95063

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42226

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the handle_tx_event() function in drivers/usb/host/xhci-ring.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

94) Memory leak

EUVDB-ID: #VU94084

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-39489

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the seg6_hmac_init_algo() and seg6_hmac_net_init() functions in net/ipv6/seg6_hmac.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

95) Improper locking

EUVDB-ID: #VU96294

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-43872

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the next_ceqe_sw_v2(), hns_roce_v2_msix_interrupt_eq(), hns_roce_ceq_work(), __hns_roce_request_irq() and __hns_roce_free_irq() functions in drivers/infiniband/hw/hns/hns_roce_hw_v2.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

96) Input validation error

EUVDB-ID: #VU96206

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42281

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the bpf_skb_net_grow() function in net/core/filter.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

97) Input validation error

EUVDB-ID: #VU95109

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41035

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the usb_parse_endpoint() function in drivers/usb/core/config.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

98) Buffer overflow

EUVDB-ID: #VU95054

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42145

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the MODULE_AUTHOR(), __get_agent(), send_handler(), recv_handler() and ib_umad_read() functions in drivers/infiniband/core/user_mad.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

99) Buffer overflow

EUVDB-ID: #VU95055

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42082

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the __xdp_reg_mem_model() function in net/core/xdp.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

100) NULL pointer dereference

EUVDB-ID: #VU92919

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-47619

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the i40e_get_lump() function in drivers/net/ethernet/intel/i40e/i40e_main.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

101) Memory leak

EUVDB-ID: #VU89955

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-47295

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the tcindex_filter_result_init() and tcindex_partial_destroy_work() functions in net/sched/cls_tcindex.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

102) Use-after-free

EUVDB-ID: #VU93021

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-38630

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the cpu5wdt_exit() function in drivers/watchdog/cpu5wdt.c. A local user can escalate privileges on the system.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

103) NULL pointer dereference

EUVDB-ID: #VU90532

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-47559

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the smc_link_down_work() and smc_vlan_by_tcpsk() functions in net/smc/smc_core.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

104) NULL pointer dereference

EUVDB-ID: #VU94258

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-39506

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the lio_vf_rep_copy_packet() function in drivers/net/ethernet/cavium/liquidio/lio_vf_rep.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

105) Improper locking

EUVDB-ID: #VU94987

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42096

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the profile_pc() function in arch/x86/kernel/time.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

106) Memory leak

EUVDB-ID: #VU89966

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-47405

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the hid_ctrl() and usbhid_stop() functions in drivers/hid/usbhid/hid-core.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

107) Use-after-free

EUVDB-ID: #VU94942

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41070

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the kvm_spapr_tce_attach_iommu_group() function in arch/powerpc/kvm/book3s_64_vio.c. A local user can escalate privileges on the system.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

108) Use-after-free

EUVDB-ID: #VU94223

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-39494

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the ima_eventname_init_common() function in security/integrity/ima/ima_template_lib.c, within the ima_collect_measurement() and ima_d_path() functions in security/integrity/ima/ima_api.c. A local user can escalate privileges on the system.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

109) NULL pointer dereference

EUVDB-ID: #VU93262

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-47257

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the ieee802154_llsec_parse_dev_addr() function in net/ieee802154/nl802154.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

110) Use of uninitialized resource

EUVDB-ID: #VU95029

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42228

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the amdgpu_vce_ring_parse_cs() function in drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

111) NULL pointer dereference

EUVDB-ID: #VU94963

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42101

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the nouveau_connector_get_modes() function in drivers/gpu/drm/nouveau/nouveau_connector.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

112) Improper locking

EUVDB-ID: #VU94988

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42090

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the create_pinctrl() function in drivers/pinctrl/core.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

113) Resource management error

EUVDB-ID: #VU95072

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41068

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the sclp_init() function in drivers/s390/char/sclp.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

114) Incorrect calculation

EUVDB-ID: #VU95074

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42162

CWE-ID: CWE-682 - Incorrect Calculation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to incorrect calculation within the gve_get_drvinfo() and gve_get_ethtool_stats() functions in drivers/net/ethernet/google/gve/gve_ethtool.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

115) NULL pointer dereference

EUVDB-ID: #VU94438

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48865

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the tipc_enable_bearer() function in net/tipc/bearer.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

116) Use of uninitialized resource

EUVDB-ID: #VU95024

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42106

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the inet_diag_dump_compat() and inet_diag_get_exact_compat() functions in net/ipv4/inet_diag.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

117) Out-of-bounds read

EUVDB-ID: #VU94952

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42148

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the drivers/net/ethernet/broadcom/bnx2x/bnx2x.h. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

118) Resource management error

EUVDB-ID: #VU95050

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42110

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the ntb_netdev_rx_handler() function in drivers/net/ntb_netdev.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

119) Improper locking

EUVDB-ID: #VU93033

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-38662

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the may_update_sockmap() and check_map_func_compatibility() functions in kernel/bpf/verifier.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

120) Use-after-free

EUVDB-ID: #VU95503

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42232

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the delayed_work() and EXPORT_SYMBOL() functions in net/ceph/mon_client.c. A local user can escalate privileges on the system.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

121) Improper locking

EUVDB-ID: #VU94455

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48786

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the vsock_stream_connect() function in net/vmw_vsock/af_vsock.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

122) Resource management error

EUVDB-ID: #VU93596

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-4440

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the SYM_CODE_START() function in arch/x86/xen/xen-asm.S, within the native_patch() function in arch/x86/kernel/paravirt_patch.c, within the paravirt_patch_default() and native_steal_clock() functions in arch/x86/kernel/paravirt.c, within the main() function in arch/x86/kernel/asm-offsets_64.c, within the SYM_INNER_LABEL() and SYM_CODE_END() functions in arch/x86/entry/entry_64.S. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

123) NULL pointer dereference

EUVDB-ID: #VU94970

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41098

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the ata_host_release() function in drivers/ata/libata-core.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

124) Infinite loop

EUVDB-ID: #VU95515

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42246

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop within the xs_tcp_setup_socket() function in net/sunrpc/xprtsock.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

125) Information disclosure

EUVDB-ID: #VU91338

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-47425

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

Exploit availability: No

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to information disclosure within the i2c_acpi_notify() function in drivers/i2c/i2c-core-acpi.c. A local user can gain access to sensitive information.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

126) Off-by-one

EUVDB-ID: #VU91173

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-47373

CWE-ID: CWE-193 - Off-by-one Error

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an off-by-one error within the its_vpe_irq_domain_alloc() function in drivers/irqchip/irq-gic-v3-its.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

127) Use-after-free

EUVDB-ID: #VU90056

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-47549

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the sata_fsl_init_controller() and sata_fsl_remove() functions in drivers/ata/sata_fsl.c. A local user can escalate privileges on the system.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

128) Improper error handling

EUVDB-ID: #VU90936

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-52708

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the mmc_spi_probe() function in drivers/mmc/host/mmc_spi.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

129) Memory leak

EUVDB-ID: #VU94394

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48860

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the xemaclite_of_probe() function in drivers/net/ethernet/xilinx/xilinx_emaclite.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

130) Out-of-bounds read

EUVDB-ID: #VU94236

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-40953

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the kvm_vcpu_on_spin() function in virt/kvm/kvm_main.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

131) Memory leak

EUVDB-ID: #VU96287

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-43871

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the EXPORT_SYMBOL_GPL() function in drivers/base/devres.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

132) Improper error handling

EUVDB-ID: #VU97547

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-46784

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the mana_destroy_txq(), mana_create_txq() and mana_destroy_rxq() functions in drivers/net/ethernet/microsoft/mana/mana_en.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

133) Integer overflow

EUVDB-ID: #VU85183

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2024-20696

CWE-ID: CWE-190 - Integer overflow

Exploit availability: Yes

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to integer overflow within the rar4 reader in Libarchive. A remote user can trick a victim to open a specially crafted file and execute arbitrary code on the target system.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

134) Incorrect Regular Expression

EUVDB-ID: #VU96745

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-6232

CWE-ID: CWE-185 - Incorrect Regular Expression

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of .tar archives when processing it with regular expressions. A remote attacker can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

135) Heap-based buffer overflow

EUVDB-ID: #VU89430

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-34459

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error when parsing XML data. A remote attacker can pass specially crafted data to the application, trigger a heap-based buffer overflow and perform a denial of service (DoS) attack.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

136) Resource exhaustion

EUVDB-ID: #VU94711

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-1975

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources. If a server hosts a zone containing a "KEY" Resource Record, or a resolver DNSSEC-validates a "KEY" Resource Record from a DNSSEC-signed domain in cache, a client can exhaust resolver CPU resources by sending a stream of SIG(0) signed requests.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

137) Resource management error

EUVDB-ID: #VU94710

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-1737

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources within the application when handling a very large number of RRs. Resolver caches and authoritative zone databases that hold significant numbers of RRs for the same hostname (of any RTYPE) can suffer from degraded performance as content is being added or updated, and also when handling client queries for this name.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000320811/dsa-2025-202-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

138) Observable discrepancy

EUVDB-ID: #VU97424

Risk: Low

CVSSv4.0: 0.2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-23984

CWE-ID: CWE-203 - Observable discrepancy

Exploit availability: No

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to observable discrepancy in Running Average Power Limit (RAPL) interface. A local privileged user can gain access to potentially sensitive information.

Install update from vendor's website.

RecoverPoint for Virtual Machines: 6.0 SP1 - 6.0 SP2

• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P1:*:*:*:*:*:*
• cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:SP1 P2:*:*:*:*:*:*