SB2024060879 - Information disclosure in Linux kernel kvm vmx
Published: June 8, 2024 Updated: May 13, 2025
Security Bulletin ID
SB2024060879
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Information disclosure
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Information disclosure (CVE-ID: CVE-2024-26992)
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to information disclosure within the vmx_get_perf_capabilities() function in arch/x86/kvm/vmx/vmx.c. A local user can gain access to sensitive information.
Remediation
Install update from vendor's website.
References
- https://git.kernel.org/stable/c/0fb74c00d140a66128afc0003785dcc57e69d312
- https://git.kernel.org/stable/c/037e48ceccf163899374b601afb6ae8d0bf1d2ac
- https://git.kernel.org/stable/c/7a7650b3ac23e5fc8c990f00e94f787dc84e3175
- https://git.kernel.org/stable/c/9e985cbf2942a1bb8fcef9adc2a17d90fd7ca8ee
- https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.88
- https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.29