CVE-2024-0340

Updated: 2024-01-17 05:17:29.736659

Description:

A vulnerability was found in vhost_new_msg in drivers/vhost/vhost.c in the Linux kernel, which does not properly initialize memory in messages passed between virtual guests and the host operating system in the vhost/vhost.c:vhost_new_msg() function. This issue can allow local privileged users to read some kernel memory contents when reading from the /dev/vhost-net device file.


Links NIST CIRCL RHEL Ubuntu

Severity

Severity Score
CVSS Version 2.x 0
CVSS Version 3.x MEDIUM 5.5

Status

OS name Project name Version Score Severity Status Errata Last updated
AlmaLinux 9.2 ESU kernel 5.14.0 5.5 MEDIUM Ignored 2024-01-23 08:44:28
AlmaLinux 9.2 FIPS kernel 5.14.0 5.5 MEDIUM Ignored 2024-01-23 08:44:28
CentOS 6 ELS kernel 2.6.32 5.5 MEDIUM Ignored 2024-01-23 08:44:28
CentOS 7 ELS kernel 3.10.0 5.5 MEDIUM Ignored 2024-01-23 08:44:28
CentOS 8.4 ELS kernel 4.18.0 5.5 MEDIUM Ignored 2024-01-23 08:44:28
CentOS 8.5 ELS kernel 4.18.0 5.5 MEDIUM Ignored 2024-01-23 08:44:28
CloudLinux 6 ELS kernel 2.6.32 5.5 MEDIUM Ignored 2024-01-23 08:44:28
Oracle Linux 6 ELS kernel 2.6.32 5.5 MEDIUM Ignored 2024-01-23 08:44:28
Ubuntu 16.04 ELS linux-hwe 4.15.0 5.5 MEDIUM Released CLSA-2024:1706624217 2024-01-30 10:09:40
Ubuntu 16.04 ELS linux 4.4.0 5.5 MEDIUM Not Vulnerable 2024-01-17 08:38:10
Total: 11