Multiple vulnerabilities in IBM DataPower Gateway

1) NULL pointer dereference

EUVDB-ID: #VU91236

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-27038

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the clk_core_get() function in drivers/clk/clk.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Race condition

EUVDB-ID: #VU91475

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26960

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition within the __swap_entry_free_locked() and free_swap_and_cache() functions in mm/swapfile.c. A local user can escalate privileges on the system.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Improper locking

EUVDB-ID: #VU90773

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26987

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the __page_handle_poison() function in mm/memory-failure.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Buffer overflow

EUVDB-ID: #VU93305

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26988

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the setup_command_line() function in init/main.c. A local user can escalate privileges on the system.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Improper locking

EUVDB-ID: #VU90769

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-27010

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the qdisc_alloc() function in net/sched/sch_generic.c, within the qdisc_run_end() function in net/core/dev.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Memory leak

EUVDB-ID: #VU90463

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-27011

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the nft_data_hold() and __nf_tables_abort() functions in net/netfilter/nf_tables_api.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Memory leak

EUVDB-ID: #VU90461

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-27012

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the nft_rbtree_activate() and nft_rbtree_walk() functions in net/netfilter/nft_set_rbtree.c, within the nft_pipapo_activate() and nft_pipapo_walk() functions in net/netfilter/nft_set_pipapo.c, within the nft_rhash_activate(), nft_rhash_walk(), nft_hash_activate() and nft_hash_walk() functions in net/netfilter/nft_set_hash.c, within the nft_bitmap_activate() and nft_bitmap_walk() functions in net/netfilter/nft_set_bitmap.c, within the nft_mapelem_deactivate(), nft_map_catchall_deactivate(), nft_setelem_validate(), nf_tables_bind_check_setelem(), nft_mapelem_activate(), nft_map_catchall_activate(), nf_tables_dump_setelem(), nft_setelem_activate(), nft_setelem_flush() and nf_tables_loop_check_setelem() functions in net/netfilter/nf_tables_api.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Incorrect calculation

EUVDB-ID: #VU93615

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-27017

CWE-ID: CWE-682 - Incorrect Calculation

Exploit availability: No

The vulnerability allows a local user to manipulate data.

The vulnerability exists due to incorrect calculation within the nft_pipapo_walk() function in net/netfilter/nft_set_pipapo.c, within the nft_map_deactivate(), nf_tables_bind_set(), nft_map_activate(), nf_tables_dump_set(), nft_set_flush() and nf_tables_check_loops() functions in net/netfilter/nf_tables_api.c. A local user can manipulate data.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Resource management error

EUVDB-ID: #VU93202

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-27437

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the vfio_intx_set_signal() function in drivers/vfio/pci/vfio_pci_intrs.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Resource management error

EUVDB-ID: #VU89055

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26924

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources within the nft_pipapo_remove() function in net/netfilter/nft_set_pipapo.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Resource management error

EUVDB-ID: #VU91612

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-35814

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to double allocation of slots within the swiotlb_area_find_slots() function in kernel/dma/swiotlb.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Memory leak

EUVDB-ID: #VU91641

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-35859

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the bdev_open_by_dev() function in block/bdev.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) NULL pointer dereference

EUVDB-ID: #VU90508

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-35878

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the of_modalias() function in drivers/of/module.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Infinite loop

EUVDB-ID: #VU91413

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-35886

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop within the inet6_dump_fib() function in net/ipv6/ip6_fib.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) Use of uninitialized resource

EUVDB-ID: #VU90873

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-35888

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the ip6erspan_rcv() function in net/ipv6/ip6_gre.c, within the erspan_rcv() function in net/ipv4/ip_gre.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) Improper locking

EUVDB-ID: #VU91446

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-35892

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the qdisc_tree_reduce_backlog() function in net/sched/sch_api.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

17) Incorrect calculation

EUVDB-ID: #VU93613

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-35900

CWE-ID: CWE-682 - Incorrect Calculation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to incorrect calculation within the nf_tables_addchain() function in net/netfilter/nf_tables_api.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

18) Use-after-free

EUVDB-ID: #VU90183

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26958

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the , within the wait_on_commit() function in fs/nfs/write.c, within the nfs_direct_commit_schedule() function in fs/nfs/direct.c. A local user can escalate privileges on the system.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

19) Integer underflow

EUVDB-ID: #VU91672

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26921

CWE-ID: CWE-191 - Integer underflow

Exploit availability: No

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer underflow within the nf_ct_frag6_queue() and nf_ct_frag6_gather() functions in net/ipv6/netfilter/nf_conntrack_reasm.c, within the ip_frag_queue() and ip_defrag() functions in net/ipv4/ip_fragment.c, within the FRAG_CB(), inet_frag_queue_insert(), inet_frag_reasm_prepare(), EXPORT_SYMBOL() and inet_frag_reasm_finish() functions in net/ipv4/inet_fragment.c. A local user can execute arbitrary code.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

20) Improper locking

EUVDB-ID: #VU91503

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-36028

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the __update_and_free_page() function in mm/hugetlb.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

21) Double free

EUVDB-ID: #VU90929

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26704

CWE-ID: CWE-415 - Double Free

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a double free error within the ext4_move_extents() function in fs/ext4/move_extent.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

22) Integer overflow

EUVDB-ID: #VU91424

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-52683

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer overflow within the lpit_update_residency() function in drivers/acpi/acpi_lpit.c. A local user can execute arbitrary code.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

23) Buffer overflow

EUVDB-ID: #VU93622

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-52762

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the virtblk_probe() function in drivers/block/virtio_blk.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

24) Improper locking

EUVDB-ID: #VU93770

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26601

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the ext4_mb_generate_buddy() and mb_free_blocks() functions in fs/ext4/mballoc.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

25) Race condition within a thread

EUVDB-ID: #VU91436

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26631

CWE-ID: CWE-366 - Race Condition within a Thread

Exploit availability: No

The vulnerability allows a local user to manipulate data.

The vulnerability exists due to a data race within the ipv6_mc_down() function in net/ipv6/mcast.c. A local user can manipulate data.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

26) Access of Uninitialized Pointer

EUVDB-ID: #VU89396

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-26641

CWE-ID: CWE-824 - Access of Uninitialized Pointer

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to access to uninitialized data within the __ip6_tnl_rcv() function in net/ipv6/ip6_tunnel.c. A remote attacker can send specially crafted data to the system and perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

27) Buffer overflow

EUVDB-ID: #VU91204

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26646

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the hfi_parse_features() and intel_hfi_init() functions in drivers/thermal/intel/intel_hfi.c. A local user can escalate privileges on the system.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

28) Memory leak

EUVDB-ID: #VU90010

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26669

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the fl_tmplt_destroy() function in net/sched/cls_flower.c, within the tcf_block_playback_offloads() and tc_chain_tmplt_add() functions in net/sched/cls_api.c, within the void() function in include/net/sch_generic.h. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

29) Buffer overflow

EUVDB-ID: #VU92952

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26733

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the arp_req_get() function in net/ipv4/arp.c. A local user can escalate privileges on the system.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

30) Buffer overflow

EUVDB-ID: #VU92006

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26870

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the nfs4_listxattr() function in fs/nfs/nfs4proc.c. A local user can escalate privileges on the system.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

31) Improper locking

EUVDB-ID: #VU90789

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26740

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the mirred_egress_to_ingress_tcp_test() function in tools/testing/selftests/net/forwarding/tc_actions.sh, within the is_mirred_nested() and tcf_mirred_to_dev() functions in net/sched/act_mirred.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

32) Race condition

EUVDB-ID: #VU91479

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26759

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition within the swapcache_prepare() function in mm/swapfile.c, within the do_swap_page() and folio_unlock() functions in mm/memory.c. A local user can escalate privileges on the system.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

33) Improper locking

EUVDB-ID: #VU92041

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26772

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the ext4_mb_find_by_goal() function in fs/ext4/mballoc.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

34) Division by zero

EUVDB-ID: #VU93751

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26774

CWE-ID: CWE-369 - Divide By Zero

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a division by zero error within the mb_update_avg_fragment_size() function in fs/ext4/mballoc.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

35) Improper locking

EUVDB-ID: #VU91529

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26812

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the vfio_send_intx_eventfd(), vfio_intx_handler() and vfio_pci_set_intx_trigger() functions in drivers/vfio/pci/vfio_pci_intrs.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

36) Out-of-bounds read

EUVDB-ID: #VU90326

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26815

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the NLA_POLICY_MAX() function in net/sched/sch_taprio.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

37) Resource management error

EUVDB-ID: #VU93772

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26835

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the nf_tables_updtable() function in net/netfilter/nf_tables_api.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

38) NULL pointer dereference

EUVDB-ID: #VU93050

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-36010

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the igb_set_fw_version() function in drivers/net/ethernet/intel/igb/igb_main.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

39) Improper locking

EUVDB-ID: #VU90736

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-36882

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the page_cache_ra_order() function in mm/readahead.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

40) NULL pointer dereference

EUVDB-ID: #VU90626

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-52492

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the EXPORT_SYMBOL_GPL() function in drivers/dma/dmaengine.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

41) NULL pointer dereference

EUVDB-ID: #VU91224

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-36901

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the ip6_output() function in net/ipv6/ip6_output.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

42) Input validation error

EUVDB-ID: #VU96160

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-43817

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the include/linux/virtio_net.h. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

43) Buffer overflow

EUVDB-ID: #VU96191

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-43856

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the dmam_free_coherent() function in kernel/dma/mapping.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

44) Memory leak

EUVDB-ID: #VU96286

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-43870

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the event_sched_out() function in kernel/events/core.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

45) Use-after-free

EUVDB-ID: #VU96513

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-43888

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the list_lru_from_memcg_idx() and EXPORT_SYMBOL_GPL() functions in mm/list_lru.c. A local user can escalate privileges on the system.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

46) Race condition

EUVDB-ID: #VU96546

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-43892

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition within the MEM_CGROUP_ID_MAX(), mem_cgroup_alloc() and mem_cgroup_css_online() functions in mm/memcontrol.c. A local user can escalate privileges on the system.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

47) Buffer overflow

EUVDB-ID: #VU92951

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-27414

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the rtnl_bridge_setlink() function in net/core/rtnetlink.c. A local user can escalate privileges on the system.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

48) Improper locking

EUVDB-ID: #VU90780

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26899

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the DEFINE_MUTEX(), bd_link_disk_holder(), kfree() and bd_unlink_disk_holder() functions in block/holder.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

49) NULL pointer dereference

EUVDB-ID: #VU91222

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-36902

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the __fib6_rule_action() function in net/ipv6/fib6_rules.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

50) Use-after-free

EUVDB-ID: #VU94947

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41049

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the posix_lock_inode() function in fs/locks.c. A local user can escalate privileges on the system.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

51) Use-after-free

EUVDB-ID: #VU90214

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26739

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the tcf_mirred_to_dev() function in net/sched/act_mirred.c. A local user can escalate privileges on the system.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

52) Improper locking

EUVDB-ID: #VU92030

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-27022

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to improper locking within the dup_mmap() function in kernel/fork.c. A local user can execute arbitrary code.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

53) NULL pointer dereference

EUVDB-ID: #VU92345

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-38573

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the cppc_cpufreq_get_rate() and hisi_cppc_cpufreq_get_rate() functions in drivers/cpufreq/cppc_cpufreq.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

54) Input validation error

EUVDB-ID: #VU94120

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-38615

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the __cpufreq_offline() and cpufreq_remove_dev() functions in drivers/cpufreq/cpufreq.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

55) NULL pointer dereference

EUVDB-ID: #VU94239

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-40984

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the acpi_ex_system_memory_space_handler() function in drivers/acpi/acpica/exregion.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

56) Infinite loop

EUVDB-ID: #VU95515

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42246

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop within the xs_tcp_setup_socket() function in net/sunrpc/xprtsock.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

57) Input validation error

EUVDB-ID: #VU96205

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42276

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the nvme_prep_rq() function in drivers/nvme/host/pci.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

58) Use-after-free

EUVDB-ID: #VU94672

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41012

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the fcntl_setlk() function in fs/locks.c. A local user can escalate privileges on the system.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

59) NULL pointer dereference

EUVDB-ID: #VU90379

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-36891

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the mas_empty_area_rev() function in lib/maple_tree.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

60) Resource management error

EUVDB-ID: #VU93291

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-38604

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the blkdev_iomap_begin() function in block/fops.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

61) Race condition

EUVDB-ID: #VU93375

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-36905

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a race condition within the tcp_send_fin() function in net/ipv4/tcp_output.c, within the tcp_rcv_state_process() function in net/ipv4/tcp_input.c, within the tcp_shutdown() and __tcp_close() functions in net/ipv4/tcp.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

62) Buffer overflow

EUVDB-ID: #VU92094

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-36917

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the blk_ioctl_discard() function in block/ioctl.c. A local user can escalate privileges on the system.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

63) Use of uninitialized resource

EUVDB-ID: #VU90863

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-36927

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the raw_sendmsg() function in net/ipv4/raw.c, within the __ip_make_skb() function in net/ipv4/ip_output.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

64) Improper error handling

EUVDB-ID: #VU92054

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-36939

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the nfs_net_init() function in fs/nfs/inode.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

65) Memory leak

EUVDB-ID: #VU91561

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-36967

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the tpm2_key_encode() function in security/keys/trusted-keys/trusted_tpm2.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

66) Input validation error

EUVDB-ID: #VU93310

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-36974

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the taprio_parse_mqprio_opt() function in net/sched/sch_taprio.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

67) Race condition within a thread

EUVDB-ID: #VU92380

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-38596

CWE-ID: CWE-366 - Race Condition within a Thread

Exploit availability: No

The vulnerability allows a local user to manipulate data.

The vulnerability exists due to a data race within the unix_stream_sendmsg() function in net/unix/af_unix.c. A local user can manipulate data.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

68) Memory leak

EUVDB-ID: #VU93020

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-38632

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the vfio_intx_enable() function in drivers/vfio/pci/vfio_pci_intrs.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

69) Improper locking

EUVDB-ID: #VU94275

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-40966

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the con_cleanup() function in drivers/tty/vt/vt.c, within the tty_set_ldisc() function in drivers/tty/tty_ldisc.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

70) Memory leak

EUVDB-ID: #VU93320

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-39276

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the ext4_xattr_block_cache_find() function in fs/ext4/xattr.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

71) Resource management error

EUVDB-ID: #VU93339

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-39298

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the me_huge_page() function in mm/memory-failure.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

72) NULL pointer dereference

EUVDB-ID: #VU93823

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-39474

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the vm_area_alloc_pages() function in mm/vmalloc.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

73) Memory leak

EUVDB-ID: #VU94201

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-39499

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the event_deliver() function in drivers/misc/vmw_vmci/vmci_event.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

74) Use-after-free

EUVDB-ID: #VU94230

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-39503

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the list_set_kadd(), list_set_kdel(), list_set_utest(), list_set_uadd(), list_set_udel() and list_set_destroy() functions in net/netfilter/ipset/ip_set_list_set.c, within the call_rcu(), ip_set_destroy() and ip_set_net_init() functions in net/netfilter/ipset/ip_set_core.c. A local user can escalate privileges on the system.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

75) Improper error handling

EUVDB-ID: #VU94290

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-40923

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the vmxnet3_rq_destroy_all_rxdataring() function in drivers/net/vmxnet3/vmxnet3_drv.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

76) Improper Initialization

EUVDB-ID: #VU94298

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-40925

CWE-ID: CWE-665 - Improper Initialization

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper initialization within the blk_flush_complete_seq() and flush_end_io() functions in block/blk-flush.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

77) Input validation error

EUVDB-ID: #VU94286

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-40948

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the page_table_check_clear(), page_table_check_set() and __page_table_check_zero() functions in mm/page_table_check.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

78) Information disclosure

EUVDB-ID: #VU93098

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-52501

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

Exploit availability: No

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application. A local user can gain unauthorized access to sensitive information on the system.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

79) NULL pointer dereference

EUVDB-ID: #VU90656

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-52473

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the device_del() function in drivers/thermal/thermal_core.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

80) Memory leak

EUVDB-ID: #VU94928

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41076

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the nfs4_set_security_label() function in fs/nfs/nfs4proc.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

81) Resource management error

EUVDB-ID: #VU93269

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-35897

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the nf_tables_table_disable() and nf_tables_updtable() functions in net/netfilter/nf_tables_api.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

82) Race condition within a thread

EUVDB-ID: #VU91427

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-35898

CWE-ID: CWE-366 - Race Condition within a Thread

Exploit availability: No

The vulnerability allows a local user to manipulate data.

The vulnerability exists due to a data race within the nf_tables_flowtable_parse_hook() and nft_flowtable_type_get() functions in net/netfilter/nf_tables_api.c. A local user can manipulate data.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

83) Input validation error

EUVDB-ID: #VU93176

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-35962

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the do_replace() and compat_do_replace() functions in net/ipv6/netfilter/ip6_tables.c, within the do_replace() and compat_do_replace() functions in net/ipv4/netfilter/ip_tables.c, within the do_replace() and compat_do_replace() functions in net/ipv4/netfilter/arp_tables.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

84) NULL pointer dereference

EUVDB-ID: #VU94257

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-40905

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the rt6_get_pcpu_route() function in net/ipv6/route.c, within the __fib6_drop_pcpu_from() function in net/ipv6/ip6_fib.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

85) Improper error handling

EUVDB-ID: #VU94291

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-40914

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the unpoison_memory() function in mm/memory-failure.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

86) NULL pointer dereference

EUVDB-ID: #VU94247

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-40957

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the input_action_end_dx6() and input_action_end_dx4() functions in net/ipv6/seg6_local.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

87) Resource management error

EUVDB-ID: #VU95069

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41041

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the sock_set_flag() and spin_unlock() functions in net/ipv4/udp.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

88) Use-after-free

EUVDB-ID: #VU73772

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-3523

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error when in mm/memory.c in Linux kernel. A local user can trigger a use-after-free error and perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

89) Improper locking

EUVDB-ID: #VU91317

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-27415

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the nf_conntrack_init_end() function in net/netfilter/nf_conntrack_core.c, within the nf_ct_bridge_pre() function in net/bridge/netfilter/nf_conntrack_bridge.c, within the IS_ENABLED() and br_nf_pre_routing() functions in net/bridge/br_netfilter_hooks.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

90) Information exposure through microarchitectural state after transient execution

EUVDB-ID: #VU79262

Risk: Medium

CVSSv4.0: 2.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-40982

CWE-ID: CWE-1342 - Information Exposure through Microarchitectural State after Transient Execution

Exploit availability: No

The vulnerability allows a malicious guest to escalate privileges on the system.

The vulnerability exists due to the way data is shared between threads whereby the AVX GATHER instructions on Intel processors can forward the content of stale vector registers to dependent instructions. A malicious guest can infer data from different contexts on the same core and execute arbitrary code with elevated privileges.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

91) Memory leak

EUVDB-ID: #VU73765

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-0597

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to memory leak within the Linux kernel cpu_entry_area mapping of X86 CPU data. A local user can gain access to sensitive information.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

92) Use-after-free

EUVDB-ID: #VU77954

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-1249

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error within the core dump subsystem in Linux kernel. A local user can trigger a use-after-free error and crash the kernel.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

93) Use-after-free

EUVDB-ID: #VU78941

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-3609

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the the Linux kernel net/sched: cls_u32 component. A local user can trigger a use-after-free error and execute arbitrary code with elevated privileges.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

94) NULL pointer dereference

EUVDB-ID: #VU80578

Risk: Low

CVSSv4.0: 4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-3772

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error within the xfrm_update_ae_params() function in the IP framework for transforming packets (XFRM subsystem). A local user with CAP_NET_ADMIN privileges can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

95) Out-of-bounds read

EUVDB-ID: #VU80579

Risk: Low

CVSSv4.0: 4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-3773

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition in IP framework for transforming packets (XFRM subsystem). A local user with CAP_NET_ADMIN privileges can cause a 4 byte out-of-bounds read of XFRMA_MTIMER_THRESH when parsing netlink attributes and gain access to sensitive information.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

96) Out-of-bounds read

EUVDB-ID: #VU90309

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-35896

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the do_replace() and compat_do_replace() functions in net/ipv6/netfilter/ip6_tables.c, within the do_replace() and compat_do_replace() functions in net/ipv4/netfilter/ip_tables.c, within the do_replace() and compat_do_replace() functions in net/ipv4/netfilter/arp_tables.c, within the do_replace(), update_counters() and compat_update_counters() functions in net/bridge/netfilter/ebtables.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

97) Race condition within a thread

EUVDB-ID: #VU91432

Risk: Low

CVSSv4.0: 4.4 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-27020

CWE-ID: CWE-366 - Race Condition within a Thread

Exploit availability: No

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to a data race within the __nft_expr_type_get() and nft_expr_type_get() functions in net/netfilter/nf_tables_api.c. A local user can execute arbitrary code.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

98) Use-after-free

EUVDB-ID: #VU80587

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-4207

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the the cls_fw component in Linux kernel packet scheduler. A local user can trigger a use-after-free error and execute arbitrary code with elevated privileges.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

99) NULL pointer dereference

EUVDB-ID: #VU90469

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-47385

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the w83792d_detect_subclients() function in drivers/hwmon/w83792d.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

100) NULL pointer dereference

EUVDB-ID: #VU90657

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-52458

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the blkpg_do_ioctl() function in block/ioctl.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

101) Race condition

EUVDB-ID: #VU88938

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26737

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition between the bpf_timer_cancel_and_free and bpf_timer_cancel calls in kernel/bpf/helpers.c. A local user can exploit the race and escalate privileges on the system.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

102) Improper locking

EUVDB-ID: #VU93787

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26773

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the ext4_mb_try_best_found() function in fs/ext4/mballoc.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

103) Use-after-free

EUVDB-ID: #VU90194

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26852

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the ip6_route_multipath_add() and list_for_each_entry_safe() functions in net/ipv6/route.c. A local user can escalate privileges on the system.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

104) NULL pointer dereference

EUVDB-ID: #VU91235

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-35857

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the icmp_build_probe() function in net/ipv4/icmp.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

105) Improper locking

EUVDB-ID: #VU92367

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-38580

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the __ep_eventpoll_poll() function in fs/eventpoll.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

106) Integer underflow

EUVDB-ID: #VU91669

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-27403

CWE-ID: CWE-191 - Integer underflow

Exploit availability: No

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer underflow within the flow_offload_dst_cookie() and nft_flow_dst_release() functions in net/netfilter/nf_flow_table_core.c. A local user can execute arbitrary code.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

107) Race condition within a thread

EUVDB-ID: #VU91431

Risk: Low

CVSSv4.0: 1.9 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-27019

CWE-ID: CWE-366 - Race Condition within a Thread

Exploit availability: No

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to a data race within the __nft_obj_type_get() and nft_obj_type_get() functions in net/netfilter/nf_tables_api.c. A local user can gain access to sensitive information.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

108) Out-of-bounds read

EUVDB-ID: #VU92332

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-36978

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the multiq_tune() function in net/sched/sch_multiq.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

109) NULL pointer dereference

EUVDB-ID: #VU94246

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-40959

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the xfrm6_get_saddr() function in net/ipv6/xfrm6_policy.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

110) Use of uninitialized resource

EUVDB-ID: #VU96171

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42272

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the DEFINE_MUTEX() and offsetof() functions in net/sched/act_ct.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

111) Input validation error

EUVDB-ID: #VU88887

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26581

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in net/netfilter/nft_set_rbtree.c. A locla user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

112) Integer overflow

EUVDB-ID: #VU91180

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26668

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer overflow within the nft_limit_eval() and nft_limit_init() functions in net/netfilter/nft_limit.c. A local user can execute arbitrary code.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

113) Improper locking

EUVDB-ID: #VU91318

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26810

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the vfio_send_intx_eventfd(), vfio_pci_intx_mask(), vfio_pci_intx_unmask_handler(), vfio_pci_set_intx_unmask() and vfio_pci_set_intx_mask() functions in drivers/vfio/pci/vfio_pci_intrs.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

114) Improper locking

EUVDB-ID: #VU92034

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26925

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the __nf_tables_abort() and nf_tables_abort() functions in net/netfilter/nf_tables_api.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

115) Input validation error

EUVDB-ID: #VU94131

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-27016

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the nf_flow_xmit_xfrm(), nf_flow_skb_encap_protocol() and nf_flow_encap_pop() functions in net/netfilter/nf_flow_table_ip.c, within the nf_flow_offload_inet_hook() function in net/netfilter/nf_flow_table_inet.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

116) Use-after-free

EUVDB-ID: #VU80580

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-4206

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the the cls_route component in Linux kernel packet scheduler. A local user can trigger a use-after-free error and execute arbitrary code on the system.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

117) Use-after-free

EUVDB-ID: #VU80586

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-4208

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the the cls_u32 component in Linux kernel packet scheduler. A local user can trigger a use-after-free error and execute arbitrary code with elevated privileges.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

118) Use-after-free

EUVDB-ID: #VU90051

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-47505

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the POLLFREE() function in include/uapi/asm-generic/poll.h, within the aio_poll(), aio_poll_complete_work(), aio_poll_cancel(), aio_poll_wake() and aio_poll_queue_proc() functions in fs/aio.c. A local user can escalate privileges on the system.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

119) Use-after-free

EUVDB-ID: #VU94949

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41040

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the net/sched/act_ct.c. A local user can escalate privileges on the system.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

120) Use-after-free

EUVDB-ID: #VU90165

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-35791

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the svm_register_enc_region() function in arch/x86/kvm/svm/sev.c. A local user can escalate privileges on the system.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

121) Out-of-bounds read

EUVDB-ID: #VU90310

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-35797

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the filemap_cachestat() function in mm/filemap.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

122) Reachable Assertion

EUVDB-ID: #VU90907

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-36000

CWE-ID: CWE-617 - Reachable Assertion

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to reachable assertion within the alloc_huge_page() function in mm/hugetlb.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

123) Out-of-bounds read

EUVDB-ID: #VU90274

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-36019

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the regcache_maple_drop() function in drivers/base/regmap/regcache-maple.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

124) Out-of-bounds read

EUVDB-ID: #VU90272

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-36883

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the net_alloc_generic() and register_pernet_operations() functions in net/core/net_namespace.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

125) Use-after-free

EUVDB-ID: #VU94220

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-40927

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the xhci_invalidate_cancelled_tds() and xhci_handle_cmd_set_deq() functions in drivers/usb/host/xhci-ring.c. A local user can escalate privileges on the system.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

126) Memory leak

EUVDB-ID: #VU94206

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-40936

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the devm_cxl_add_region() and __create_region() functions in drivers/cxl/core/region.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

127) NULL pointer dereference

EUVDB-ID: #VU94979

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41055

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the include/linux/mmzone.h. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

128) Resource management error

EUVDB-ID: #VU93781

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26630

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the filemap_cachestat() function in mm/filemap.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

129) Double free

EUVDB-ID: #VU95011

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41073

CWE-ID: CWE-415 - Double Free

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a double free error within the nvme_cleanup_cmd() function in drivers/nvme/host/core.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

130) Use-after-free

EUVDB-ID: #VU94941

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41096

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the msi_capability_init() function in drivers/pci/msi/msi.c. A local user can escalate privileges on the system.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

131) Integer overflow

EUVDB-ID: #VU95034

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42102

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer overflow within the wb_dirty_limits() function in mm/page-writeback.c. A local user can execute arbitrary code.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

132) Integer overflow

EUVDB-ID: #VU95035

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42131

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer overflow within the domain_dirty_limits(), node_dirty_limit(), dirty_background_bytes_handler() and dirty_bytes_handler() functions in mm/page-writeback.c. A local user can execute arbitrary code.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

133) NULL pointer dereference

EUVDB-ID: #VU90624

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-52490

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the mm/migrate.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

134) Improper locking

EUVDB-ID: #VU91528

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-47185

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the flush_to_ldisc() function in drivers/tty/tty_buffer.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

135) Integer overflow

EUVDB-ID: #VU91179

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-47432

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer overflow within the __genradix_iter_peek() function in lib/generic-radix-tree.c. A local user can execute arbitrary code.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

136) Input validation error

EUVDB-ID: #VU93686

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26946

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the can_probe() function in arch/x86/kernel/kprobes/core.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

137) Use-after-free

EUVDB-ID: #VU90078

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-52801

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the iopt_area_split() function in drivers/iommu/iommufd/io_pagetable.c. A local user can escalate privileges on the system.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

138) NULL pointer dereference

EUVDB-ID: #VU90513

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-35911

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the ice_vsi_rebuild() function in drivers/net/ethernet/intel/ice/ice_lib.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

139) Improper locking

EUVDB-ID: #VU92356

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-47606

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the netlink_sendmsg() function in net/netlink/af_netlink.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

140) Buffer overflow

EUVDB-ID: #VU91198

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-52864

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the wmi_dev_match() function in drivers/platform/x86/wmi.c. A local user can escalate privileges on the system.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

141) Expired pointer dereference

EUVDB-ID: #VU93809

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26808

CWE-ID: CWE-825 - Expired pointer dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a stale reference within the nf_tables_netdev_event() function in net/netfilter/nft_chain_filter.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

142) NULL pointer dereference

EUVDB-ID: #VU90571

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26868

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the ff_layout_cancel_io() function in fs/nfs/flexfilelayout/flexfilelayout.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

143) Resource management error

EUVDB-ID: #VU94105

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-27065

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources within the nf_tables_updtable() function in net/netfilter/nf_tables_api.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

144) Information disclosure

EUVDB-ID: #VU91349

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-27417

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

Exploit availability: No

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to information disclosure within the inet6_rtm_getaddr() function in net/ipv6/addrconf.c. A local user can gain access to sensitive information.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

145) Use-after-free

EUVDB-ID: #VU90160

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-35899

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the nf_tables_module_exit() function in net/netfilter/nf_tables_api.c. A local user can escalate privileges on the system.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0

• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:ibm_datapower_gateway:10.6.3.0:*:*:*:*:*:*:*

https://www.ibm.com/support/pages/node/7236281

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

146) Use-after-free

EUVDB-ID: #VU90143

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-35969

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the ipv6_get_ifaddr() function in net/ipv6/addrconf.c, within the in6_ifa_hold() function in include/net/addrconf.h. A local user can escalate privileges on the system.

Install update from vendor's website.

IBM DataPower Gateway: 10.6.1.0 - 10.6.3.0