Multiple vulnerabilities in Dell Storage Resource Manager (SRM) and Dell Storage Monitoring and Reporting (SMR)

1) Race condition

EUVDB-ID: #VU74629

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-1582

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a race condition within fs/proc/task_mmu.c. A local user can exploit the race and crash the kernel.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://lore.kernel.org/linux-mm/Yg6ac8WlwtnDH6M0@kroah.com/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Use-after-free

EUVDB-ID: #VU94414

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48851

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the tx_complete() function in drivers/staging/gdm724x/gdm_lte.c. A local user can escalate privileges on the system.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/6dc7b87c62423bfa68139fe95e85028aab584c9a
https://git.kernel.org/stable/c/83a9c886c2b5a0d28c0b37e1736b47f38d61332a
https://git.kernel.org/stable/c/48ecdf3e29a6e514e8196691589c7dfc6c4ac169
https://git.kernel.org/stable/c/403e3afe241b62401de1f8629c9c6b9b3d69dbff
https://git.kernel.org/stable/c/6d9700b445098dbbce0caff4b8cfca214cf1e757
https://git.kernel.org/stable/c/1fb9dd3787495b4deb0efe66c58306b65691a48f
https://git.kernel.org/stable/c/d39dc79513e99147b4c158a8a9e46743e23944f5
https://git.kernel.org/stable/c/fc7f750dc9d102c1ed7bbe4591f991e770c99033

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Memory leak

EUVDB-ID: #VU94397

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48853

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the Documentation/DMA-attributes.txt, include/linux/dma-mapping.h, lib/swiotlb.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/c132f2ba716b5ee6b35f82226a6e5417d013d753
https://git.kernel.org/stable/c/971e5dadffd02beba1063e7dd9c3a82de17cf534
https://git.kernel.org/stable/c/8d9ac1b6665c73f23e963775f85d99679fd8e192
https://git.kernel.org/stable/c/6bfc5377a210dbda2a237f16d94d1bd4f1335026
https://git.kernel.org/stable/c/d4d975e7921079f877f828099bb8260af335508f
https://git.kernel.org/stable/c/7403f4118ab94be837ab9d770507537a8057bc63
https://git.kernel.org/stable/c/270475d6d2410ec66e971bf181afe1958dad565e
https://git.kernel.org/stable/c/ddbd89deb7d32b1fbb879f48d68fda1a8ac58e8e

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Memory leak

EUVDB-ID: #VU94396

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48856

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the gfar_get_ts_info() function in drivers/net/ethernet/freescale/gianfar_ethtool.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/6263f2eb93a85ad7df504daf0c341a7fb6bbe8a6
https://git.kernel.org/stable/c/f7b3b520349193f8a82cca74daf366199e06add9
https://git.kernel.org/stable/c/21044e679ed535345042d2023f7df0ca8e897e2a
https://git.kernel.org/stable/c/f49f646f9ec296fc0afe7ae92c2bb47f23e3846c
https://git.kernel.org/stable/c/0e1b9a2078e07fb1e6e91bf8badfd89ecab1e848
https://git.kernel.org/stable/c/2ac5b58e645c66932438bb021cb5b52097ce70b0

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Use-after-free

EUVDB-ID: #VU94412

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48857

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the nfc_digital_free_device() function in drivers/nfc/port100.c. A local user can escalate privileges on the system.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/205c4ec78e71cbf561794e6043da80e7bae6790f
https://git.kernel.org/stable/c/32e866ae5a7af590597ef4bcff8451bf96d5f980
https://git.kernel.org/stable/c/b1db33d4e54bc35d8db96ce143ea0ef92e23d58e
https://git.kernel.org/stable/c/cd2a5c0da0d1ddf11d1f84e9c9b1949f50f6e161
https://git.kernel.org/stable/c/2b1c85f56512d49e43bc53741fce2f508cd90029
https://git.kernel.org/stable/c/0e721b8f2ee5e11376dd55363f9ccb539d754b8a
https://git.kernel.org/stable/c/7194737e1be8fdc89d2a9382bd2f371f7ee2eda8
https://git.kernel.org/stable/c/f80cfe2f26581f188429c12bd937eb905ad3ac7b

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Use-after-free

EUVDB-ID: #VU94411

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48858

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the cmd_alloc_index() and cmd_ent_get() functions in drivers/net/ethernet/mellanox/mlx5/core/cmd.c. A local user can escalate privileges on the system.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/1a4017926eeea56c7540cc41b42106746ee8a0ee
https://git.kernel.org/stable/c/f3331bc17449f15832c31823f27573f4c0e13e5f
https://git.kernel.org/stable/c/7c519f769f555ff7d9d4ccba3497bbb589df360a
https://git.kernel.org/stable/c/0401bfb27a91d7bdd74b1635c1aae57cbb128da6
https://git.kernel.org/stable/c/063bd355595428750803d8736a9bb7c8db67d42d

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Memory leak

EUVDB-ID: #VU94395

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48859

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the prestera_switch_set_base_mac_addr() function in drivers/net/ethernet/marvell/prestera/prestera_main.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/b7c2fd1d126329340639adfb8dd2938fe4b65df7
https://git.kernel.org/stable/c/4cc66bf17220ff9631f9fa99b02a872e0ad5a08b
https://git.kernel.org/stable/c/c9ffa3e2bc451816ce0295e40063514fabf2bd36

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Memory leak

EUVDB-ID: #VU94394

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48860

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the xemaclite_of_probe() function in drivers/net/ethernet/xilinx/xilinx_emaclite.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/669172ce976608b25a2f76f3c65d47f042d125c9
https://git.kernel.org/stable/c/b7220f8e9d6c6b9594ddfb3125dad938cd478b1f
https://git.kernel.org/stable/c/8609e29611befc4bfbe7a91bb50fc65ae72ff549
https://git.kernel.org/stable/c/8ee065a7a9b6a3976c16340503677efc4d8351f6
https://git.kernel.org/stable/c/979b418b96e35f07136f77962ccfaa54cf3e30e1
https://git.kernel.org/stable/c/5e7c402892e189a7bc152b125e72261154aa585d
https://git.kernel.org/stable/c/1852854ee349881efb78ccdbbb237838975902e4
https://git.kernel.org/stable/c/b19ab4b38b06aae12442b2de95ccf58b5dc53584

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Use-after-free

EUVDB-ID: #VU94410

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48861

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the vp_vdpa_remove() function in drivers/vdpa/virtio_pci/vp_vdpa.c. A local user can escalate privileges on the system.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/4b1743bc715a3691a63ac21b349079b07bf1b19e
https://git.kernel.org/stable/c/dc54ba9932aeaaa1a21fe214af1f446593a78274
https://git.kernel.org/stable/c/eb057b44dbe35ae14527830236a92f51de8f9184

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Infinite loop

EUVDB-ID: #VU94469

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48862

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop within the vhost_chr_write_iter() function in drivers/vhost/vhost.c, within the vhost_iotlb_add_range_ctx() function in drivers/vhost/iotlb.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/f8d88e86e90ea1002226d7ac2430152bfea003d1
https://git.kernel.org/stable/c/d9a747e6b6561280bf1791bb24c5e9e082193dad
https://git.kernel.org/stable/c/e2ae38cf3d91837a493cb2093c87700ff3cbe667

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Memory leak

EUVDB-ID: #VU94393

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48863

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the dsp_pipeline_destroy() and dsp_pipeline_build() functions in drivers/isdn/mISDN/dsp_pipeline.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/a3d5fcc6cf2ecbba5a269631092570aa285a24cb
https://git.kernel.org/stable/c/7777b1f795af1bb43867375d8a776080111aae1b
https://git.kernel.org/stable/c/640445d6fc059d4514ffea79eb4196299e0e2d0f
https://git.kernel.org/stable/c/c6a502c2299941c8326d029cfc8a3bc8a4607ad5

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Out-of-bounds read

EUVDB-ID: #VU94429

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48866

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the thrustmaster_interrupts() function in drivers/hid/hid-thrustmaster.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/3ffbe85cda7f523dad896bae08cecd8db8b555ab
https://git.kernel.org/stable/c/56185434e1e50acecee56d8f5850135009b87947
https://git.kernel.org/stable/c/fc3ef2e3297b3c0e2006b5d7b3d66965e3392036

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Resource exhaustion

EUVDB-ID: #VU75412

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-30608

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-rrm6-wvj7-cwh2
https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS
https://github.com/andialbrecht/sqlparse/commit/c457abd5f097dd13fb21543381e7cfafe7d31cfb
https://github.com/andialbrecht/sqlparse/commit/e75e35869473832a1eb67772b1adfee2db11b85a

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Out-of-bounds read

EUVDB-ID: #VU94428

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48847

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the watch_queue_set_filter() function in kernel/watch_queue.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/648895da69ced90ca770fd941c3d9479a9d72c16
https://git.kernel.org/stable/c/1b09f28f70a5046acd64138075ae3f095238b045
https://git.kernel.org/stable/c/b36588ebbcef74583824c08352e75838d6fb4ff2
https://git.kernel.org/stable/c/c993ee0f9f81caf5767a50d1faeba39a0dc82af2

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU96619

Risk: Low

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-31315

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper validation in a model specific register (MSR). A malicious application with ring0 access can modify SMM configuration while SMI lock is enabled, potentially leading to arbitrary code execution.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7014.html

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) Out-of-bounds read

EUVDB-ID: #VU80795

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-37453

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows an attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary condition within the read_descriptors() function in drivers/usb/core/sysfs.c. An attacker with physical access to the system can attach a malicious USB device, trigger an out-of-bounds read error and crash the kernel.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://syzkaller.appspot.com/bug?extid=18996170f8096c6174d0
https://lore.kernel.org/all/000000000000c0ffe505fe86c9ca@google.com/T/
https://lore.kernel.org/all/000000000000e56434059580f86e@google.com/T/

Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

17) Buffer overflow

EUVDB-ID: #VU93622

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-52762

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the virtblk_probe() function in drivers/block/virtio_blk.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/72775cad7f572bb2501f9ea609e1d20e68f0b38b
https://git.kernel.org/stable/c/472bd4787406bef2e8b41ee4c74d960a06a49a48
https://git.kernel.org/stable/c/017278f141141367f7d14b203e930b45b6ffffb9
https://git.kernel.org/stable/c/d667fe301dcbcb12d1d6494fc4b8abee2cb75d90
https://git.kernel.org/stable/c/fafb51a67fb883eb2dde352539df939a251851be

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

18) Out-of-bounds read

EUVDB-ID: #VU91086

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-52766

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the hci_dma_irq_handler() function in drivers/i3c/master/mipi-i3c-hci/dma.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/d23ad76f240c0f597b7a9eb79905d246f27d40df
https://git.kernel.org/stable/c/8be39f66915b40d26ea2c18ba84b5c3d5da6809b
https://git.kernel.org/stable/c/7c2b91b30d74d7c407118ad72502d4ca28af1af6
https://git.kernel.org/stable/c/4c86cb2321bd9c72d3b945ce7f747961beda8e65
https://git.kernel.org/stable/c/45a832f989e520095429589d5b01b0c65da9b574

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

19) Use-after-free

EUVDB-ID: #VU90071

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-52800

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the ath11k_htt_pktlog() function in drivers/net/wireless/ath/ath11k/dp_rx.c. A local user can escalate privileges on the system.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/03ed26935bebf6b6fd8a656490bf3dcc71b72679
https://git.kernel.org/stable/c/3a51e6b4da71fdfa43ec006d6abc020f3e22d14e
https://git.kernel.org/stable/c/e3199b3fac65c9f103055390b6fd07c5cffa5961
https://git.kernel.org/stable/c/423762f021825b5e57c3d6f01ff96a9ff19cdcd8
https://git.kernel.org/stable/c/69cede2a5a5f60e3f5602b901b52cb64edd2ea6c
https://git.kernel.org/stable/c/3f77c7d605b29df277d77e9ee75d96e7ad145d2d

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

20) Use-after-free

EUVDB-ID: #VU94326

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-52885

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the svc_tcp_listen_data_ready() function in net/sunrpc/svcsock.c. A local user can escalate privileges on the system.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/c7b8c2d06e437639694abe76978e915cfb73f428
https://git.kernel.org/stable/c/dfc896c4a75cb8cd7cb2dfd9b469cf1e3f004254
https://git.kernel.org/stable/c/42725e5c1b181b757ba11d804443922982334d9b
https://git.kernel.org/stable/c/cd5ec3ee52ce4b7e283cc11facfa420c297c8065
https://git.kernel.org/stable/c/fbf4ace39b2e4f3833236afbb2336edbafd75eee
https://git.kernel.org/stable/c/ef047411887ff0845afd642d6a687819308e1a4e
https://git.kernel.org/stable/c/7e1f989055622fd086c5dfb291fc72adf5660b6f
https://git.kernel.org/stable/c/fc80fc2d4e39137869da3150ee169b40bf879287

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

21) Out-of-bounds read

EUVDB-ID: #VU94434

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-52886

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the get_bMaxPacketSize0(), hub_port_init(), hub_port_connect() and usb_reset_and_verify_device() functions in drivers/usb/core/hub.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/9d241c5d9a9b7ad95c90c6520272fe404d5ac88f
https://git.kernel.org/stable/c/7fe9d87996062f5eb0ca476ad0257f79bf43aaf5
https://git.kernel.org/stable/c/8186596a663506b1124bede9fde6f243ef9f37ee
https://git.kernel.org/stable/c/b4a074b1fb222164ed7d5c0b8c922dc4a0840848
https://git.kernel.org/stable/c/b9fbfb349eacc0820f91c797d7f0a3ac7a4935b5
https://git.kernel.org/stable/c/ff33299ec8bb80cdcc073ad9c506bd79bb2ed20b

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

22) Resource management error

EUVDB-ID: #VU94710

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-1737

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources within the application when handling a very large number of RRs. Resolver caches and authoritative zone databases that hold significant numbers of RRs for the same hostname (of any RTYPE) can suffer from degraded performance as content is being added or updated, and also when handling client queries for this name.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://kb.isc.org/docs/cve-2024-1737
https://www.openwall.com/lists/oss-security/2024/07/23/1

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

23) Resource exhaustion

EUVDB-ID: #VU94711

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-1975

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources. If a server hosts a zone containing a "KEY" Resource Record, or a resolver DNSSEC-validates a "KEY" Resource Record from a DNSSEC-signed domain in cache, a client can exhaust resolver CPU resources by sending a stream of SIG(0) signed requests.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://kb.isc.org/docs/cve-2024-1975
https://www.openwall.com/lists/oss-security/2024/07/23/1

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

24) Reachable assertion

EUVDB-ID: #VU94713

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-4076

CWE-ID: CWE-617 - Reachable Assertion

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a reachable assertion when serving both stale cache data and authoritative zone content. A remote attacker can send specially crafted queries to the DNS server to trigger an assertion failure and perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://kb.isc.org/docs/cve-2024-4076
https://www.openwall.com/lists/oss-security/2024/07/23/1

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

25) Out-of-bounds read

EUVDB-ID: #VU93424

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-5535

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary condition within the SSL_select_next_proto() function when using NPN. A remote attacker can send specially crafted data to the application, trigger an out-of-bounds read and perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://www.openssl.org/news/secadv/20240627.txt

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

26) Resource management error

EUVDB-ID: #VU94484

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48849

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the amdgpu_display_framebuffer_init() function in drivers/gpu/drm/amd/amdgpu/amdgpu_display.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/fcd1d79aa943fff4fbaa0cce1d576995a7960699
https://git.kernel.org/stable/c/cb29021be49858059138f75d6311a7c35a9379b2
https://git.kernel.org/stable/c/e2b993302f40c4eb714ecf896dd9e1c5be7d4cd7

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

27) NULL pointer dereference

EUVDB-ID: #VU94436

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48843

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the EXPORT_SYMBOL() function in drivers/gpu/drm/drm_connector.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/941e8bcd2b2ba95490738e33dfeca27168452779
https://git.kernel.org/stable/c/0ba557d330946c23559aaea2d51ea649fdeca98a
https://git.kernel.org/stable/c/3534c5c005ef99a1804ed50b8a72cdae254cabb5
https://git.kernel.org/stable/c/85271e92ae4f13aa679acaa6cf76b3c36bcb7bab
https://git.kernel.org/stable/c/62929726ef0ec72cbbe9440c5d125d4278b99894

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

28) Out-of-bounds read

EUVDB-ID: #VU95131

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-7264

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary condition within the ASN1 parser code in the GTime2str() function. A remote attacker can trigger an out-of-bounds read error and cause a denial of service condition on the system.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://curl.se/docs/CVE-2024-7264.json
https://curl.se/docs/CVE-2024-7264.html
https://hackerone.com/reports/2629968
https://www.openwall.com/lists/oss-security/2024/07/31/1

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

29) Improper locking

EUVDB-ID: #VU94451

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48826

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the vc4_dsi_host_attach() and vc4_dsi_dev_remove() functions in drivers/gpu/drm/vc4/vc4_dsi.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/770d1ba9a8201ce9bee0946eb03746449b6f3b80
https://git.kernel.org/stable/c/dddd832f35096fbc5004e3a7e58fb4d2cefb8deb
https://git.kernel.org/stable/c/0a3d12ab5097b1d045e693412e6b366b7e82031b

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

30) Resource management error

EUVDB-ID: #VU94474

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48814

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the vsc9953_mdio_bus_alloc() and vsc9953_mdio_bus_free() functions in drivers/net/dsa/ocelot/seville_vsc9953.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/1d13e7221035947c62800c9d3d99b4ed570e27e7
https://git.kernel.org/stable/c/0e816362d823cd46c666e64d8bffe329ee22f4cc
https://git.kernel.org/stable/c/bd488afc3b39e045ba71aab472233f2a78726e7b

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

31) Resource management error

EUVDB-ID: #VU94471

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48815

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the bcm_sf2_mdio_register() function in drivers/net/dsa/bcm_sf2.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/2770b795294ed312375c11ef1d0b810499c66b83
https://git.kernel.org/stable/c/caabb5f64f5c32fceed93356bb688ef1ec6c5783
https://git.kernel.org/stable/c/08e1a3554e99a1a5bd2835907381e2383ee85cae
https://git.kernel.org/stable/c/08f1a20822349004bb9cc1b153ecb516e9f2889d

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

32) Improper locking

EUVDB-ID: #VU94452

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48816

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the xs_get_srcport() function in net/sunrpc/xprtsock.c, within the rpc_sysfs_xprt_srcaddr_show() function in net/sunrpc/sysfs.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/9482ab4540f5bcc869b44c067ae99b5fca16bd07
https://git.kernel.org/stable/c/b49ea673e119f59c71645e2f65b3ccad857c90ee

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

33) Resource management error

EUVDB-ID: #VU94473

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48817

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the ar9331_sw_mbus_init() and ar9331_sw_remove() functions in drivers/net/dsa/qca/ar9331.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/475ce5dcf2d88fd4f3c213a0ac944e3e40702970
https://git.kernel.org/stable/c/aae1c6a1d3d696fc33b609fb12fe744a556d1dc5
https://git.kernel.org/stable/c/f1842a8cb71de4d7eb75a86f76e88c7ee739218c
https://git.kernel.org/stable/c/50facd86e9fbc4b93fe02e5fe05776047f45dbfb

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

34) Improper error handling

EUVDB-ID: #VU94461

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48818

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the mv88e6xxx_mdio_register() and mv88e6xxx_mdios_unregister() functions in drivers/net/dsa/mv88e6xxx/chip.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/8ccebe77df6e0d88c72ba5e69cf1835927e53b6c
https://git.kernel.org/stable/c/8b626d45127d6f5ada7d815b83cfdc09e8cb1394
https://git.kernel.org/stable/c/1b451c3994a2d322f8e55032c62c8b47b7d95900
https://git.kernel.org/stable/c/f53a2ce893b2c7884ef94471f170839170a4eba0

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

35) Memory leak

EUVDB-ID: #VU94404

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48820

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the stm32_usbphyc_pll_enable() function in drivers/phy/st/phy-stm32-usbphyc.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/94b16ca86ab688ed6fad4548f70137f93cf1f0a9
https://git.kernel.org/stable/c/0ad1a88fa3eb0ded7798f52b79bc33f75fc9a6d2
https://git.kernel.org/stable/c/cfc826c88a79e22ba5d8001556eb2c7efd8a01b6

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

36) Use-after-free

EUVDB-ID: #VU94417

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48821

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the fastrpc_dmabuf_alloc() function in drivers/misc/fastrpc.c. A local user can escalate privileges on the system.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/4e6fd2b5fcf8e7119305a6042bd92e7f2b9ed215
https://git.kernel.org/stable/c/a5ce7ee5fcc07583159f54ab4af5164de00148f5
https://git.kernel.org/stable/c/e4382d0a39f9a1e260d62fdc079ddae5293c037d
https://git.kernel.org/stable/c/76f85c307ef9f10aa2cef1b1d5ee654c1f3345fc
https://git.kernel.org/stable/c/46963e2e0629cb31c96b1d47ddd89dc3d8990b34

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

37) Memory leak

EUVDB-ID: #VU94403

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48822

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the ffs_data_put(), ffs_data_new(), ffs_epfiles_destroy() and ffs_func_eps_disable() functions in drivers/usb/gadget/function/f_fs.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/32048f4be071f9a6966744243f1786f45bb22dc2
https://git.kernel.org/stable/c/cfe5f6fd335d882bcc829a1c8a7d462a455c626e
https://git.kernel.org/stable/c/c9fc422c9a43e3d58d246334a71f3390401781dc
https://git.kernel.org/stable/c/0042178a69eb77a979e36a50dcce9794a3140ef8
https://git.kernel.org/stable/c/72a8aee863af099d4434314c4536d6c9a61dcf3c
https://git.kernel.org/stable/c/3e078b18753669615301d946297bafd69294ad2c
https://git.kernel.org/stable/c/ebe2b1add1055b903e2acd86b290a85297edc0b3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

38) Incorrect calculation

EUVDB-ID: #VU94488

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48823

CWE-ID: CWE-682 - Incorrect Calculation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to incorrect calculation within the qedf_initiate_cleanup() function in drivers/scsi/qedf/qedf_io.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/7cc32ff0cd6c44a3c26de5faecfe8b5546198fad
https://git.kernel.org/stable/c/87f187e5265bc8e3b38faef8b9db864cdd61dde7
https://git.kernel.org/stable/c/6be8eaad75ca73131e2a697f0270dc8ee73814a8
https://git.kernel.org/stable/c/7fcbed38503bb34c6e6538b6a9482d1c6bead1e8
https://git.kernel.org/stable/c/5239ab63f17cee643bd4bf6addfedebaa7d4f41e

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

39) NULL pointer dereference

EUVDB-ID: #VU94445

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48824

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the myrs_cleanup() function in drivers/scsi/myrs.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/5c5ceea00c8c9df150708e66cb9f2891192c1162
https://git.kernel.org/stable/c/0e42c4a3d732517edc3766dd45a14e60d29dd929
https://git.kernel.org/stable/c/6207f35c213f6cb2fc3f13b5e77f08c710e1de19
https://git.kernel.org/stable/c/1d6cd26605b4d662063a83c15c776b5299a1cb23
https://git.kernel.org/stable/c/4db09593af0b0b4d7d4805ebb3273df51d7cc30d

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

40) Resource management error

EUVDB-ID: #VU94485

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48825

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the qedf_vport_create() function in drivers/scsi/qedf/qedf_main.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/aa7352aa155e19815b41f09f114fe9f110fde4d8
https://git.kernel.org/stable/c/1f53bbf27a876f7e61262bd74c18680ac11d4c31
https://git.kernel.org/stable/c/0be556512cd0dfcf5ec1a140d9f42d88221a5d4e
https://git.kernel.org/stable/c/b70a99fd13282d7885f69bf1372e28b7506a1613

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

41) Buffer overflow

EUVDB-ID: #VU94479

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48827

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the nfsd4_encode_read() and nfsd4_encode_read_plus() functions in fs/nfsd/nfs4xdr.c, within the nfsd4_read() function in fs/nfsd/nfs4proc.c, within the nfsd3_proc_read() function in fs/nfsd/nfs3proc.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/1726a39b0879acfb490b22dca643f26f4f907da9
https://git.kernel.org/stable/c/c6eff5c4277146a78b4fb8c9b668dd64542c41b0
https://git.kernel.org/stable/c/44502aca8e02ab32d6b0eb52e006a5ec9402719b
https://git.kernel.org/stable/c/0cb4d23ae08c48f6bf3c29a8e5c4a74b8388b960

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

42) Improper locking

EUVDB-ID: #VU94446

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48842

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the ice_service_task() function in drivers/net/ethernet/intel/ice/ice_main.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/a9bbacc53d1f5ed8febbfdf31401d20e005f49ef
https://git.kernel.org/stable/c/e1014fc5572375658fa421531cedb6e084f477dc
https://git.kernel.org/stable/c/5cb1ebdbc4342b1c2ce89516e19808d64417bdbc

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

43) Integer underflow

EUVDB-ID: #VU94466

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48828

CWE-ID: CWE-191 - Integer underflow

Exploit availability: No

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer underflow within the nfsd_setattr() function in fs/nfsd/vfs.c. A local user can execute arbitrary code.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/38d02ba22e43b6fc7d291cf724bc6e3b7be6626b
https://git.kernel.org/stable/c/8e0ecaf7a7e57b30284d6b3289cc436100fadc48
https://git.kernel.org/stable/c/da22ca1ad548429d7822011c54cfe210718e0aa7
https://git.kernel.org/stable/c/e6faac3f58c7c4176b66f63def17a34232a17b0e

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

44) Input validation error

EUVDB-ID: #VU94492

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48829

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the svcxdr_decode_sattr3() function in fs/nfsd/nfs3xdr.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/a231ae6bb50e7c0a9e9efd7b0d10687f1d71b3a3
https://git.kernel.org/stable/c/37f2d2cd8eadddbbd9c7bda327a9393399b2f89b
https://git.kernel.org/stable/c/aa9051ddb4b378bd22e72a67bc77b9fc1482c5f0
https://git.kernel.org/stable/c/a648fdeb7c0e17177a2280344d015dba3fbe3314

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

45) Improper locking

EUVDB-ID: #VU94450

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48830

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the LIST_HEAD(), isotp_rcv() and isotp_init() functions in net/can/isotp.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/7b53d2204ce79b27a878074a77d64f40ec21dbca
https://git.kernel.org/stable/c/f90cc68f9f4b5d8585ad5d0a206a9d37ac299ef3
https://git.kernel.org/stable/c/5b068f33bc8acfcfd5ea7992a2dafb30d89bad30
https://git.kernel.org/stable/c/7c759040c1dd03954f650f147ae7175476d51314

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

46) Memory leak

EUVDB-ID: #VU94402

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48831

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the asymmetric_verify() function in security/integrity/digsig_asymmetric.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/0838d6d68182f0b28a5434bc6d50727c4757e35b
https://git.kernel.org/stable/c/89f586d3398f4cc0432ed870949dffb702940754
https://git.kernel.org/stable/c/926fd9f23b27ca6587492c3f58f4c7f4cd01dad5

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

47) Resource management error

EUVDB-ID: #VU94481

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48834

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the usbtmc_ioctl_request() function in drivers/usb/class/usbtmc.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/700a0715854c1e79a73341724ce4f5bb01abc016
https://git.kernel.org/stable/c/10a805334a11acd547602d6c4cf540a0f6ab5c6e
https://git.kernel.org/stable/c/c69aef9db878ab277068a8cc1b4bf0cf309dc2b7
https://git.kernel.org/stable/c/5f6a2d63c68c12cf61259df7c3527a0e05dce952
https://git.kernel.org/stable/c/e9b667a82cdcfe21d590344447d65daed52b353b

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

48) Improper locking

EUVDB-ID: #VU94448

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48835

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the mpt3sas_base_sync_reply_irqs() function in drivers/scsi/mpt3sas/mpt3sas_base.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/98e7a654a5bebaf1a28e987af5e44c002544a413
https://git.kernel.org/stable/c/0cd2dd4bcf4abc812148c4943f966a3c8dccb00f
https://git.kernel.org/stable/c/3916e33b917581e2b2086e856c291cb86ea98a05
https://git.kernel.org/stable/c/69ad4ef868c1fc7609daa235dfa46d28ba7a3ba3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

49) Improper locking

EUVDB-ID: #VU94447

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48836

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the aiptek_probe() function in drivers/input/tablet/aiptek.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/57277a8b5d881e02051ba9d7f6cb3f915c229821
https://git.kernel.org/stable/c/fc8033a55e2796d21e370260a784ac9fbb8305a6
https://git.kernel.org/stable/c/6de20111cd0bb7da9b2294073ba00c7d2a6c1c4f
https://git.kernel.org/stable/c/e732b0412f8c603d1e998f3bff41b5e7d5c3914c
https://git.kernel.org/stable/c/f0d43d22d24182b94d7eb78a2bf6ae7e2b33204a
https://git.kernel.org/stable/c/e762f57ff255af28236cd02ca9fc5c7e5a089d31
https://git.kernel.org/stable/c/35069e654bcab567ff8b9f0e68e1caf82c15dcd7
https://git.kernel.org/stable/c/5600f6986628dde8881734090588474f54a540a8

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

50) Integer overflow

EUVDB-ID: #VU94465

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48837

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer overflow within the rndis_set_response() function in drivers/usb/gadget/function/rndis.c. A local user can execute arbitrary code.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/8b3e4d26bc9cd0f6373d0095b9ffd99e7da8006b
https://git.kernel.org/stable/c/c7953cf03a26876d676145ce5d2ae6d8c9630b90
https://git.kernel.org/stable/c/138d4f739b35dfb40438a0d5d7054965763bfbe7
https://git.kernel.org/stable/c/21829376268397f9fd2c35cfa9135937b6aa3a1e
https://git.kernel.org/stable/c/28bc0267399f42f987916a7174e2e32f0833cc65
https://git.kernel.org/stable/c/56b38e3ca4064041d93c1ca18828c8cedad2e16c
https://git.kernel.org/stable/c/df7e088d51cdf78b1a0bf1f3d405c2593295c7b0
https://git.kernel.org/stable/c/65f3324f4b6fed78b8761c3b74615ecf0ffa81fa

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

51) Use-after-free

EUVDB-ID: #VU94415

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48838

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the usb_gadget_remove_driver(), udc_bind_to_driver() and dev_err() functions in drivers/usb/gadget/udc/core.c. A local user can escalate privileges on the system.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/4325124dde6726267813c736fee61226f1d38f0b
https://git.kernel.org/stable/c/e2d3a7009e505e120805f449c832942660f3f7f3
https://git.kernel.org/stable/c/609a7119bffe3ddd7c93f2fa65be8917e02a0b7e
https://git.kernel.org/stable/c/2282a6eb6d4e118e294e43dcc421e0e0fe4040b5
https://git.kernel.org/stable/c/00bdd9bf1ac6d401ad926d3d8df41b9f1399f646
https://git.kernel.org/stable/c/2015c23610cd0efadaeca4d3a8d1dae9a45aa35a
https://git.kernel.org/stable/c/27d64436984fb8835a8b7e95993193cc478b162e
https://git.kernel.org/stable/c/16b1941eac2bd499f065a6739a40ce0011a3d740

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

52) Memory leak

EUVDB-ID: #VU94392

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48839

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the tpacket_rcv() and packet_recvmsg() functions in net/packet/af_packet.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/b9d5772d60f8e7ef34e290f72fc20e3a4883e7d0
https://git.kernel.org/stable/c/b1e27cda1e3c12b705875bb7e247a97168580e33
https://git.kernel.org/stable/c/a33dd1e6693f80d805155b3f69c18c2f642915da
https://git.kernel.org/stable/c/268dcf1f7b3193bc446ec3d14e08a240e9561e4d
https://git.kernel.org/stable/c/70b7b3c055fd4a464da8da55ff4c1f84269f9b02
https://git.kernel.org/stable/c/a055f5f2841f7522b44a2b1eccb1951b4b03d51a
https://git.kernel.org/stable/c/ef591b35176029fdefea38e8388ffa371e18f4b2
https://git.kernel.org/stable/c/c700525fcc06b05adfea78039de02628af79e07a

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

53) Use of uninitialized resource

EUVDB-ID: #VU94463

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48840

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the iavf_remove() function in drivers/net/ethernet/intel/iavf/iavf_main.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/80974bb730270199c6fcb189af04d5945b87e813
https://git.kernel.org/stable/c/4477b9a4193b35eb3a8afd2adf2d42add2f88d57
https://git.kernel.org/stable/c/b04683ff8f0823b869c219c78ba0d974bddea0b5

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

54) NULL pointer dereference

EUVDB-ID: #VU94435

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48841

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the ice_update_vsi_tx_ring_stats() function in drivers/net/ethernet/intel/ice/ice_main.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/2397270ec97c5e3009a58ac110a25e1869e9d6ff
https://git.kernel.org/stable/c/f153546913bada41a811722f2c6d17c3243a0333

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

55) Code Injection

EUVDB-ID: #VU95339

Risk: High

CVSSv4.0: 7.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2024-6345

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation when processing URL in the package_index module of pypa/setuptools. A remote attacker can send a specially crafted request and execute arbitrary code on the target system via download functions.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://huntr.com/bounties/d6362117-ad57-4e83-951f-b8141c6e7ca5
https://github.com/pypa/setuptools/commit/88807c7062788254f654ea8c03427adc859321f0

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

56) Race condition

EUVDB-ID: #VU87596

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-26583

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a race condition between async notify and socket close in TLS implementation in net/tls/tls_sw.c. A remote attacker can send specially crafted traffic to the system, trigger a race condition and perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/aec7961916f3f9e88766e2688992da6980f11b8d
https://git.kernel.org/stable/c/7a3ca06d04d589deec81f56229a9a9d62352ce01
https://git.kernel.org/stable/c/86dc27ee36f558fe223dbdfbfcb6856247356f4a
https://git.kernel.org/stable/c/6209319b2efdd8524691187ee99c40637558fa33

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

57) Resource management error

EUVDB-ID: #VU94476

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48812

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the gswip_mdio_rd(), gswip_mdio(), gswip_mdio_mask() and gswip_remove() functions in drivers/net/dsa/lantiq_gswip.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/e177d2e85ebcd3008c4b2abc293f4118e04eedef
https://git.kernel.org/stable/c/b5652bc50dde7b84e93dfb25479b64b817e377c1
https://git.kernel.org/stable/c/2443ba2fe396bdde187a2fdfa6a57375643ae93c
https://git.kernel.org/stable/c/0d120dfb5d67edc5bcd1804e167dba2b30809afd

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

58) Improper input validation

EUVDB-ID: #VU94585

Risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-21134

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote authenticated user to perform service disruption.

The vulnerability exists due to improper input validation within the Server: Connection Handling component in MySQL Server. A remote authenticated user can exploit this vulnerability to perform service disruption.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://www.oracle.com/security-alerts/cpujul2024.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

59) Improper input validation

EUVDB-ID: #VU94559

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-21131

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The vulnerability exists due to improper input validation within the Hotspot component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://www.oracle.com/security-alerts/cpujul2024.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

60) Improper input validation

EUVDB-ID: #VU94560

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-21138

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The vulnerability exists due to improper input validation within the Hotspot component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://www.oracle.com/security-alerts/cpujul2024.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

61) Improper input validation

EUVDB-ID: #VU94557

Risk: Medium

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-21140

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Hotspot component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://www.oracle.com/security-alerts/cpujul2024.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

62) Improper input validation

EUVDB-ID: #VU94558

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-21144

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The vulnerability exists due to improper input validation within the Concurrency component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://www.oracle.com/security-alerts/cpujul2024.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

63) Improper input validation

EUVDB-ID: #VU94556

Risk: Medium

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-21145

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the 2D component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://www.oracle.com/security-alerts/cpujul2024.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

64) Improper input validation

EUVDB-ID: #VU94555

Risk: Medium

CVSSv4.0: 6.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-21147

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Hotspot component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://www.oracle.com/security-alerts/cpujul2024.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

65) Improper input validation

EUVDB-ID: #VU94570

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-20996

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the InnoDB component in MySQL Server. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://www.oracle.com/security-alerts/cpujul2024.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

66) Improper input validation

EUVDB-ID: #VU94569

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-21125

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: FTS component in MySQL Server. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://www.oracle.com/security-alerts/cpujul2024.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

67) Improper input validation

EUVDB-ID: #VU94577

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-21127

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: DDL component in MySQL Server. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://www.oracle.com/security-alerts/cpujul2024.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

68) Improper input validation

EUVDB-ID: #VU94578

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-21129

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: DDL component in MySQL Server. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://www.oracle.com/security-alerts/cpujul2024.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

69) Improper input validation

EUVDB-ID: #VU94579

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-21130

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: Optimizer component in MySQL Server. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://www.oracle.com/security-alerts/cpujul2024.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

70) Improper input validation

EUVDB-ID: #VU94584

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-21142

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: Security: Privileges component in MySQL Server. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://www.oracle.com/security-alerts/cpujul2024.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

71) Resource management error

EUVDB-ID: #VU95062

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42230

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the define_machine() function in arch/powerpc/platforms/pseries/setup.c, within the pseries_kexec_cpu_down() function in arch/powerpc/platforms/pseries/kexec.c, within the default_machine_kexec() function in arch/powerpc/kexec/core_64.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/c550679d604798d9fed8a5b2bb5693448a25407c
https://git.kernel.org/stable/c/d10e3c39001e9194b9a1bfd6979bd3fa19dccdc5
https://git.kernel.org/stable/c/8c6506616386ce37e59b2745fc481c6713fae4f3
https://git.kernel.org/stable/c/21a741eb75f80397e5f7d3739e24d7d75e619011

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

72) Improper input validation

EUVDB-ID: #VU94582

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-21162

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: Optimizer component in MySQL Server. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://www.oracle.com/security-alerts/cpujul2024.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

73) Improper input validation

EUVDB-ID: #VU94567

Risk: Medium

CVSSv4.0: 4.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-21163

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote privileged user to damange or delete data.

The vulnerability exists due to improper input validation within the Server: Optimizer component in MySQL Server. A remote privileged user can exploit this vulnerability to damange or delete data.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://www.oracle.com/security-alerts/cpujul2024.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

74) Improper input validation

EUVDB-ID: #VU94564

Risk: Medium

CVSSv4.0: 4.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-21171

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote authenticated user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: Optimizer component in MySQL Server. A remote authenticated user can exploit this vulnerability to perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://www.oracle.com/security-alerts/cpujul2024.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

75) Improper input validation

EUVDB-ID: #VU94574

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-21173

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the InnoDB component in MySQL Server. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://www.oracle.com/security-alerts/cpujul2024.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

76) Improper input validation

EUVDB-ID: #VU94563

Risk: Medium

CVSSv4.0: 4.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-21177

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote authenticated user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: Optimizer component in MySQL Server. A remote authenticated user can exploit this vulnerability to perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://www.oracle.com/security-alerts/cpujul2024.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

77) Improper input validation

EUVDB-ID: #VU94575

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-21179

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the InnoDB component in MySQL Server. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://www.oracle.com/security-alerts/cpujul2024.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

78) Improper input validation

EUVDB-ID: #VU94576

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-21185

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the InnoDB component in MySQL Server. A remote privileged user can exploit this vulnerability to perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://www.oracle.com/security-alerts/cpujul2024.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

79) Improper access control

EUVDB-ID: #VU87607

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-22257

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions when the "AuthenticatedVoter#vote" passing a "null" Authentication parameter. A remote attacker can bypass implemented security restrictions and gain unauthorized access to the application.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://spring.io/security/cve-2024-22257

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

80) Server-Side Request Forgery (SSRF)

EUVDB-ID: #VU89801

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-22262

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

Exploit availability: No

The disclosed vulnerability allows a remote attacker to perform SSRF attacks.

The vulnerability exists due to insufficient validation of user-supplied input when parsing URL with the UriComponentsBuilder component. A remote attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems.

Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.

Note, this vulnerability exists due to incomplete fix for #VU87614 (CVE-2024-22259) and #VU86695 (CVE-2024-22243).

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://spring.io/security/cve-2024-22262

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

81) Insufficient Session Expiration

EUVDB-ID: #VU100042

Risk: Low

CVSSv4.0: 0.1 [CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-47242

CWE-ID: CWE-613 - Insufficient Session Expiration

Exploit availability: No

The vulnerability allows an adjacent user to gain access to sensitive information.

The vulnerability exists due to insufficient session expiration issue. An adjacent user can obtain or guess session token and gain unauthorized access to session that belongs to another user.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000235152/dsa-2024-421-dell-storage-resource-manager-srm-and-dell-storage-monitoring-and-reporting-smr-security-update-for-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the local network (LAN).

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

82) Resource management error

EUVDB-ID: #VU93732

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-34750

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources within the application when handling HTTP/2 stream. A remote attacker can initiate multiple HTTP/2 connections to the server that are remain open and perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.90
https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.25
https://lists.apache.org/thread/hmw3txqzzbc1yp2t5cg4dsws0n92ly0f

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

83) Buffer overflow

EUVDB-ID: #VU95054

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42145

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the MODULE_AUTHOR(), __get_agent(), send_handler(), recv_handler() and ib_umad_read() functions in drivers/infiniband/core/user_mad.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/1288cf1cceb0e6df276e182f5412370fb4169bcb
https://git.kernel.org/stable/c/b4913702419d064ec4c4bbf7270643c95cc89a1b
https://git.kernel.org/stable/c/62349fbf86b5e13b02721bdadf98c29afd1e7b5f
https://git.kernel.org/stable/c/d73cb8862e4d6760ccc94d3b57b9ef6271400607
https://git.kernel.org/stable/c/63d202d948bb6d3a28cd8e8b96b160fa53e18baa
https://git.kernel.org/stable/c/b8c5f635997f49c625178d1a0cb32a80ed33abe6
https://git.kernel.org/stable/c/a6627fba793cc75b7365d9504a0095fb2902dda4
https://git.kernel.org/stable/c/ca0b44e20a6f3032224599f02e7c8fb49525c894

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

84) Error handling

EUVDB-ID: #VU89001

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-26584

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to an error when handling backlogging of crypto requests in net/tls/tls_sw.c. A remote attacker can send specially crafted traffic to the system and perform a denial of service attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/8590541473188741055d27b955db0777569438e3
https://git.kernel.org/stable/c/13eca403876bbea3716e82cdfe6f1e6febb38754
https://git.kernel.org/stable/c/ab6397f072e5097f267abf5cb08a8004e6b17694
https://git.kernel.org/stable/c/cd1bbca03f3c1d845ce274c0d0a66de8e5929f72

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

85) Out-of-bounds read

EUVDB-ID: #VU92328

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-38559

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the qedf_dbg_debug_cmd_write() function in drivers/scsi/qedf/qedf_debugfs.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/1f84a2744ad813be23fc4be99fb74bfb24aadb95
https://git.kernel.org/stable/c/a75001678e1d38aa607d5b898ec7ff8ed0700d59
https://git.kernel.org/stable/c/769b9fd2af02c069451fe9108dba73355d9a021c
https://git.kernel.org/stable/c/dccd97b39ab2f2b1b9a47a1394647a4d65815255
https://git.kernel.org/stable/c/d93318f19d1e1a6d5f04f5d965eaa9055bb7c613
https://git.kernel.org/stable/c/563e609275927c0b75fbfd0d90441543aa7b5e0d
https://git.kernel.org/stable/c/4907f5ad246fa9b51093ed7dfc7da9ebbd3f20b8
https://git.kernel.org/stable/c/177f43c6892e6055de6541fe9391a8a3d1f95fc9
https://git.kernel.org/stable/c/d0184a375ee797eb657d74861ba0935b6e405c62

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

86) Use-after-free

EUVDB-ID: #VU90210

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26800

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the struct_group(), tls_do_decryption() and tls_decrypt_sg() functions in net/tls/tls_sw.c. A local user can escalate privileges on the system.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/81be85353b0f5a7b660635634b655329b429eefe
https://git.kernel.org/stable/c/1ac9fb84bc7ecd4bc6428118301d9d864d2a58d1
https://git.kernel.org/stable/c/f2b85a4cc763841843de693bbd7308fe9a2c4c89
https://git.kernel.org/stable/c/13114dc5543069f7b97991e3b79937b6da05f5b0

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

87) NULL pointer dereference

EUVDB-ID: #VU90588

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26813

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the vfio_platform_set_irq_unmask(), vfio_automasked_irq_handler(), vfio_irq_handler(), vfio_set_trigger(), vfio_platform_set_irq_trigger(), vfio_platform_set_irqs_ioctl(), vfio_platform_irq_init() and vfio_platform_irq_cleanup() functions in drivers/vfio/platform/vfio_platform_irq.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/7932db06c82c5b2f42a4d1a849d97dba9ce4a362
https://git.kernel.org/stable/c/62d4e43a569b67929eb3319780be5359694c8086
https://git.kernel.org/stable/c/d6bedd6acc0bcb1e7e010bc046032e47f08d379f
https://git.kernel.org/stable/c/0f8d8f9c2173a541812dd750529f4a415117eb29
https://git.kernel.org/stable/c/675daf435e9f8e5a5eab140a9864dfad6668b375
https://git.kernel.org/stable/c/cc5838f19d39a5fef04c468199699d2a4578be3a
https://git.kernel.org/stable/c/07afdfd8a68f9eea8db0ddc4626c874f29d2ac5e
https://git.kernel.org/stable/c/09452c8fcbd7817c06e8e3212d99b45917e603a5

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

88) Improper error handling

EUVDB-ID: #VU92058

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26814

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the vfio_fsl_mc_set_irq_trigger() function in drivers/vfio/fsl-mc/vfio_fsl_mc_intr.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/083e750c9f5f4c3bf61161330fb84d7c8e8bb417
https://git.kernel.org/stable/c/ee0bd4ad780dfbb60355b99f25063357ab488267
https://git.kernel.org/stable/c/de87511fb0404d23b6da5f4660383b6ed095e28d
https://git.kernel.org/stable/c/6ec0d88166dac43f29e96801c0927d514f17add9
https://git.kernel.org/stable/c/7447d911af699a15f8d050dfcb7c680a86f87012
https://git.kernel.org/stable/c/250219c6a556f8c69c5910fca05a59037e24147d
https://git.kernel.org/stable/c/a563fc18583ca4f42e2fdd0c70c7c618288e7ede

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

89) Improper locking

EUVDB-ID: #VU90774

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26976

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the async_pf_execute(), kvm_clear_async_pf_completion_queue(), kvm_check_async_pf_completion() and kvm_setup_async_pf() functions in virt/kvm/async_pf.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/ab2c2f5d9576112ad22cfd3798071cb74693b1f5
https://git.kernel.org/stable/c/82e25cc1c2e93c3023da98be282322fc08b61ffb
https://git.kernel.org/stable/c/f8730d6335e5f43d09151fca1f0f41922209a264
https://git.kernel.org/stable/c/83d3c5e309611ef593e2fcb78444fc8ceedf9bac
https://git.kernel.org/stable/c/b54478d20375874aeee257744dedfd3e413432ff
https://git.kernel.org/stable/c/a75afe480d4349c524d9c659b1a5a544dbc39a98
https://git.kernel.org/stable/c/4f3a3bce428fb439c66a578adc447afce7b4a750
https://git.kernel.org/stable/c/caa9af2e27c275e089d702cfbaaece3b42bca31b
https://git.kernel.org/stable/c/3d75b8aa5c29058a512db29da7cbee8052724157

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

90) NULL pointer dereference

EUVDB-ID: #VU90508

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-35878

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the of_modalias() function in drivers/of/module.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/e4a449368a2ce6d57a775d0ead27fc07f5a86e5b
https://git.kernel.org/stable/c/544561dc56f7e69a053c25e11e6170f48bb97898
https://git.kernel.org/stable/c/a1aa5390cc912934fee76ce80af5f940452fa987

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

91) Resource management error

EUVDB-ID: #VU93192

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-35901

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the mana_get_rxbuf_cfg() function in drivers/net/ethernet/microsoft/mana/mana_en.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/ca58927b00385005f488b6a9905ced7a4f719aad
https://git.kernel.org/stable/c/05cb7c41fa1a7a7b2c2a6b81bbe7c67f5c11932b
https://git.kernel.org/stable/c/c0de6ab920aafb56feab56058e46b688e694a246

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

92) Out-of-bounds read

EUVDB-ID: #VU90307

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-35905

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the check_stack_access_within_bounds() function in kernel/bpf/verifier.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/9970e059af471478455f9534e8c3db82f8c5496d
https://git.kernel.org/stable/c/37dc1718dc0c4392dbfcb9adec22a776e745dd69
https://git.kernel.org/stable/c/98cdac206b112bec63852e94802791e316acc2c1
https://git.kernel.org/stable/c/3f0784b2f1eb9147973d8c43ba085c5fdf44ff69
https://git.kernel.org/stable/c/203a68151e8eeb331d4a64ab78303f3a15faf103
https://git.kernel.org/stable/c/ecc6a2101840177e57c925c102d2d29f260d37c8

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

93) NULL pointer dereference

EUVDB-ID: #VU90384

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-36926

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the pci_dma_bus_setup_pSeriesLP() function in arch/powerpc/platforms/pseries/iommu.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/7fb5793c53f8c024e3eae9f0d44eb659aed833c4
https://git.kernel.org/stable/c/802b13b79ab1fef66c6852fc745cf197dca0cb15
https://git.kernel.org/stable/c/2bed905a72485a2b79a001bd7e66c750942d2155
https://git.kernel.org/stable/c/49a940dbdc3107fecd5e6d3063dc07128177e058

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

94) Input validation error

EUVDB-ID: #VU93310

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-36974

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the taprio_parse_mqprio_opt() function in net/sched/sch_taprio.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/f921a58ae20852d188f70842431ce6519c4fdc36
https://git.kernel.org/stable/c/0bf6cc96612bd396048f57d63f1ad454a846e39c
https://git.kernel.org/stable/c/724050ae4b76e4fae05a923cb54101d792cf4404
https://git.kernel.org/stable/c/c37a27a35eadb59286c9092c49c241270c802ae2
https://ssd-disclosure.com/ssd-advisory-linux-kernel-taprio-oob

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

95) Buffer overflow

EUVDB-ID: #VU92376

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-38541

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the of_modalias() function in drivers/of/module.c. A local user can escalate privileges on the system.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/0b0d5701a8bf02f8fee037e81aacf6746558bfd6
https://git.kernel.org/stable/c/ee332023adfd5882808f2dabf037b32d6ce36f9e
https://git.kernel.org/stable/c/e45b69360a63165377b30db4a1dfddd89ca18e9a
https://git.kernel.org/stable/c/cf7385cb26ac4f0ee6c7385960525ad534323252

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

96) Use-after-free

EUVDB-ID: #VU92307

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-38555

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the cmd_comp_notifier() function in drivers/net/ethernet/mellanox/mlx5/core/cmd.c. A local user can escalate privileges on the system.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/f6fbb8535e990f844371086ab2c1221f71f993d3
https://git.kernel.org/stable/c/3cb92b0ad73d3f1734e812054e698d655e9581b0
https://git.kernel.org/stable/c/bf8aaf0ae01c27ae3c06aa8610caf91e50393396
https://git.kernel.org/stable/c/1337ec94bc5a9eed250e33f5f5c89a28a6bfabdb
https://git.kernel.org/stable/c/1d5dce5e92a70274de67a59e1e674c3267f94cd7
https://git.kernel.org/stable/c/7ac4c69c34240c6de820492c0a28a0bd1494265a
https://git.kernel.org/stable/c/db9b31aa9bc56ff0d15b78f7e827d61c4a096e40

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

97) Use-after-free

EUVDB-ID: #VU93322

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-39463

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the v9fs_cached_dentry_delete() function in fs/9p/vfs_dentry.c. A local user can escalate privileges on the system.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/cb299cdba09f46f090b843d78ba26b667d50a456
https://git.kernel.org/stable/c/f0c5c944c6d8614c19e6e9a97fd2011dcd30e8f5
https://git.kernel.org/stable/c/fe17ebf22feb4ad7094d597526d558a49aac92b4
https://git.kernel.org/stable/c/c898afdc15645efb555acb6d85b484eb40a45409
https://www.zerodayinitiative.com/advisories/ZDI-24-1194/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

98) Buffer overflow

EUVDB-ID: #VU95039

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42093

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the dpaa2_eth_xdp_xmit() and update_xps() functions in drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c. A local user can escalate privileges on the system.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/b2262b3be27cee334a2fa175ae3afb53f38fb0b1
https://git.kernel.org/stable/c/763896ab62a672d728f5eb10ac90d98c607a8509
https://git.kernel.org/stable/c/a55afc0f5f20ba30970aaf7271929dc00eee5e7d
https://git.kernel.org/stable/c/48147337d7efdea6ad6e49f5b8eb894b95868ef0
https://git.kernel.org/stable/c/69f49527aea12c23b78fb3d0a421950bf44fb4e2
https://git.kernel.org/stable/c/5e4f25091e6d06e99a23f724c839a58a8776a527
https://git.kernel.org/stable/c/d33fe1714a44ff540629b149d8fab4ac6967585c

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

99) Use-after-free

EUVDB-ID: #VU94223

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-39494

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the ima_eventname_init_common() function in security/integrity/ima/ima_template_lib.c, within the ima_collect_measurement() and ima_d_path() functions in security/integrity/ima/ima_api.c. A local user can escalate privileges on the system.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/7fb374981e31c193b1152ed8d3b0a95b671330d4
https://git.kernel.org/stable/c/dd431c3ac1fc34a9268580dd59ad3e3c76b32a8c
https://git.kernel.org/stable/c/a78a6f0da57d058e2009e9958fdcef66f165208c
https://git.kernel.org/stable/c/be84f32bb2c981ca670922e047cdde1488b233de

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

100) Buffer overflow

EUVDB-ID: #VU94296

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-40902

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the ea_get() function in fs/jfs/xattr.c. A local user can escalate privileges on the system.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/f0dedb5c511ed82cbaff4997a8decf2351ba549f
https://git.kernel.org/stable/c/1e84c9b1838152a87cf453270a5fa75c5037e83a
https://git.kernel.org/stable/c/fc745f6e83cb650f9a5f2c864158e3a5ea76dad0
https://git.kernel.org/stable/c/480e5bc21f2c42d90c2c16045d64d824dcdd5ec7
https://git.kernel.org/stable/c/33aecc5799c93d3ee02f853cb94e201f9731f123
https://git.kernel.org/stable/c/4598233d9748fe4db4e13b9f473588aa25e87d69
https://git.kernel.org/stable/c/b537cb2f4c4a1357479716a9c339c0bda03d873f
https://git.kernel.org/stable/c/7c55b78818cfb732680c4a72ab270cc2d2ee3d0f

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

101) Double free

EUVDB-ID: #VU94289

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-40937

CWE-ID: CWE-415 - Double Free

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a double free error within the gve_rx_skb_hash() and gve_rx_poll_dqo() functions in drivers/net/ethernet/google/gve/gve_rx_dqo.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/75afd8724739ee5ed8165acde5f6ac3988b485cc
https://git.kernel.org/stable/c/d221284991118c0ab16480b53baecd857c0bc442
https://git.kernel.org/stable/c/2ce5341c36993b776012601921d7688693f8c037
https://git.kernel.org/stable/c/a68184d5b420ea4fc7e6b7ceb52bbc66f90d3c50
https://git.kernel.org/stable/c/6f4d93b78ade0a4c2cafd587f7b429ce95abb02e

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

102) Use-after-free

EUVDB-ID: #VU94217

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-40954

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the sk_common_release() function in net/core/sock.c. A local user can escalate privileges on the system.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/78e4aa528a7b1204219d808310524344f627d069
https://git.kernel.org/stable/c/893eeba94c40d513cd0fe6539330ebdaea208c0e
https://git.kernel.org/stable/c/454c454ed645fed051216b79622f7cb69c1638f5
https://git.kernel.org/stable/c/5dfe2408fd7dc4d2e7ac38a116ff0a37b1cfd3b9
https://git.kernel.org/stable/c/6cd4a78d962bebbaf8beb7d2ead3f34120e3f7b2

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

103) Use-after-free

EUVDB-ID: #VU94216

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-40956

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the irq_process_work_list() function in drivers/dma/idxd/irq.c. A local user can escalate privileges on the system.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/1b08bf5a17c66ab7dbb628df5344da53c8e7ab33
https://git.kernel.org/stable/c/83163667d881100a485b6c2daa30301b7f68d9b5
https://git.kernel.org/stable/c/faa35db78b058a2ab6e074ee283f69fa398c36a8
https://git.kernel.org/stable/c/a14968921486793f2a956086895c3793761309dd
https://git.kernel.org/stable/c/e3215deca4520773cd2b155bed164c12365149a7

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

104) Input validation error

EUVDB-ID: #VU94324

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-40989

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the vgic_v3_free_redist_region() and vgic_v3_set_redist_base() functions in arch/arm64/kvm/vgic/vgic-mmio-v3.c, within the kvm_vgic_dist_destroy() function in arch/arm64/kvm/vgic/vgic-init.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/68df4fc449fcc24347209e500ce26d5816705a77
https://git.kernel.org/stable/c/48bb62859d47c5c4197a8c01128d0fa4f46ee58c
https://git.kernel.org/stable/c/152b4123f21e6aff31cea01158176ad96a999c76
https://git.kernel.org/stable/c/0d92e4a7ffd5c42b9fa864692f82476c0bf8bcc8

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

105) Integer overflow

EUVDB-ID: #VU94294

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-40994

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer overflow within the max_vclocks_store() function in drivers/ptp/ptp_sysfs.c. A local user can execute arbitrary code.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/4b03da87d0b7074c93d9662c6e1a8939f9b8b86e
https://git.kernel.org/stable/c/d50d62d5e6ee6aa03c00bddb91745d0b632d3b0f
https://git.kernel.org/stable/c/666e934d749e50a37f3796caaf843a605f115b6f
https://git.kernel.org/stable/c/e1fccfb4638ee6188377867f6015d0ce35764a8e
https://git.kernel.org/stable/c/81d23d2a24012e448f651e007fac2cfd20a45ce0

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

106) Input validation error

EUVDB-ID: #VU94530

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41011

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the kfd_ioctl_alloc_memory_of_gpu(), criu_restore_memory_of_gpu() and kfd_mmio_mmap() functions in drivers/gpu/drm/amd/amdkfd/kfd_chardev.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/89fffbdf535ce659c1a26b51ad62070566e33b28
https://git.kernel.org/stable/c/4b4cff994a27ebf7bd3fb9a798a1cdfa8d01b724
https://git.kernel.org/stable/c/6186c93560889265bfe0914609c274eff40bbeb5
https://git.kernel.org/stable/c/be4a2a81b6b90d1a47eaeaace4cc8e2cb57b96c7

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

107) Use-after-free

EUVDB-ID: #VU94672

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41012

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the fcntl_setlk() function in fs/locks.c. A local user can escalate privileges on the system.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/b6d223942c34057fdfd8f149e763fa823731b224
https://git.kernel.org/stable/c/3cad1bc010416c6dd780643476bc59ed742436b9

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

108) Use of uninitialized resource

EUVDB-ID: #VU95033

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41059

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the hfsplus_listxattr() function in fs/hfsplus/xattr.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/72805debec8f7aa342da194fe0ed7bc8febea335
https://git.kernel.org/stable/c/c733e24a61cbcff10f660041d6d84d32bb7e4cb4
https://git.kernel.org/stable/c/34f8efd2743f2d961e92e8e994de4c7a2f9e74a0
https://git.kernel.org/stable/c/d02d8c1dacafb28930c39e16d48e40bb6e4cbc70
https://git.kernel.org/stable/c/22999936b91ba545ce1fbbecae6895127945e91c
https://git.kernel.org/stable/c/f08956d8e0f80fd0d4ad84ec917302bb2f3a9c6a
https://git.kernel.org/stable/c/ad57dc2caf1e0a3c0a9904400fae7afbc9f74bb2
https://git.kernel.org/stable/c/0570730c16307a72f8241df12363f76600baf57d

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

109) Use-after-free

EUVDB-ID: #VU94943

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41069

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the soc_tplg_dapm_graph_elems_load() function in sound/soc/soc-topology.c. A local user can escalate privileges on the system.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/b188d7f3dfab10e332e3c1066e18857964a520d2
https://git.kernel.org/stable/c/ab5a6208b4d6872b1c6ecea1867940fc668cc76d
https://git.kernel.org/stable/c/ccae5c6a1fab9494c86b7856faf05e296c617702
https://git.kernel.org/stable/c/97ab304ecd95c0b1703ff8c8c3956dc6e2afe8e1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

110) Out-of-bounds read

EUVDB-ID: #VU94840

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41090

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the tap_get_user_xdp() function in drivers/net/tap.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/8be915fc5ff9a5e296f6538be12ea75a1a93bdea
https://git.kernel.org/stable/c/7431144b406ae82807eb87d8c98e518475b0450f
https://git.kernel.org/stable/c/e5e5e63c506b93b89b01f522b6a7343585f784e6
https://git.kernel.org/stable/c/ee93e6da30377cf2a75e16cd32bb9fcd86a61c46
https://git.kernel.org/stable/c/aa6a5704cab861c9b2ae9f475076e1881e87f5aa
https://git.kernel.org/stable/c/73d462a38d5f782b7c872fe9ae8393d9ef5483da
https://git.kernel.org/stable/c/e1a786b9bbb767fd1c922d424aaa8078cc542309
https://git.kernel.org/stable/c/ed7f2afdd0e043a397677e597ced0830b83ba0b3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

111) Resource management error

EUVDB-ID: #VU94475

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48813

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the vsc9959_mdio_bus_alloc() and vsc9959_mdio_bus_free() functions in drivers/net/dsa/ocelot/felix_vsc9959.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/95e5402f9430b3c7d885dd3ec4c8c02c17936923
https://git.kernel.org/stable/c/8cda7577a0b4018572f31e0caadfabd305ea2786
https://git.kernel.org/stable/c/9db6f056efd089e80d81c774c01b639adf30c097
https://git.kernel.org/stable/c/209bdb7ec6a28c7cdf580a0a98afbc9fc3b98932

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

112) NULL pointer dereference

EUVDB-ID: #VU94444

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48811

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the init_crq_queue(), __ibmvnic_open() and ibmvnic_open() functions in drivers/net/ethernet/ibm/ibmvnic.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/960dfaf3b578dd23af012590e809ae2d58ba1827
https://git.kernel.org/stable/c/e08cb9056fb2564d1f6bad789bdf79ab09bf2f81
https://git.kernel.org/stable/c/61772b0908c640d0309c40f7d41d062ca4e979fa

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

113) NULL pointer dereference

EUVDB-ID: #VU92920

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48713

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the pt_handle_status() function in arch/x86/events/intel/pt.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/456f041e035913fcedb275aff6f8a71dfebcd394
https://git.kernel.org/stable/c/e83d941fd3445f660d2f43647c580a320cc384f6
https://git.kernel.org/stable/c/feffb6ae2c80b9a8206450cdef90f5943baced99
https://git.kernel.org/stable/c/1d9093457b243061a9bba23543c38726e864a643

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

114) Use-after-free

EUVDB-ID: #VU92304

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-47616

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the rxe_qp_from_init() function in drivers/infiniband/sw/rxe/rxe_qp.c. A local user can escalate privileges on the system.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/acb53e47db1fbc7cd37ab10b46388f045a76e383
https://git.kernel.org/stable/c/84b01721e8042cdd1e8ffeb648844a09cd4213e0

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

115) Infinite loop

EUVDB-ID: #VU92929

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-47617

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop within the pciehp_ist() function in drivers/pci/hotplug/pciehp_hpc.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/ff27f7d0333cff89ec85c419f431aca1b38fb16a
https://git.kernel.org/stable/c/464da38ba827f670deac6500a1de9a4f0f44c41d
https://git.kernel.org/stable/c/3b4c966fb156ff3e70b2526d964952ff7c1574d9
https://git.kernel.org/stable/c/1db58c6584a72102e98af2e600ea184ddaf2b8af
https://git.kernel.org/stable/c/6d6f1f0dac3e3441ecdb1103d4efb11b9ed24dd5
https://git.kernel.org/stable/c/23584c1ed3e15a6f4bfab8dc5a88d94ab929ee12

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

116) NULL pointer dereference

EUVDB-ID: #VU92918

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-47618

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the obj-$() function in arch/arm/probes/kprobes/Makefile. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/1515e72aae803fc6b466adf918e71c4e4c9d5b3d
https://git.kernel.org/stable/c/ba1863be105b06e10d0e2f6b1b8a0570801cfc71
https://git.kernel.org/stable/c/8b59b0a53c840921b625378f137e88adfa87647e

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

117) NULL pointer dereference

EUVDB-ID: #VU92919

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-47619

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the i40e_get_lump() function in drivers/net/ethernet/intel/i40e/i40e_main.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/d46fa4ea9756ef6cbcf9752d0832cc66e2d7121b
https://git.kernel.org/stable/c/be6998f232b8e4ca8225029e305b8329d89bfd59
https://git.kernel.org/stable/c/768eb705e6381f0c70ca29d4e66f19790d5d19a1
https://git.kernel.org/stable/c/00eddb0e4ea115154581d1049507a996acfc2d3e
https://git.kernel.org/stable/c/4b3aa858268b7b9aeef02e5f9c4cd8f8fac101c8
https://git.kernel.org/stable/c/92947844b8beee988c0ce17082b705c2f75f0742

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

118) Out-of-bounds read

EUVDB-ID: #VU92905

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-47620

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the hci_le_adv_report_evt() function in net/bluetooth/hci_event.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/305e92f525450f3e1b5f5c9dc7eadb152d66a082
https://git.kernel.org/stable/c/7889b38a7f21ed19314f83194622b195d328465c
https://git.kernel.org/stable/c/5a539c08d743d9910631448da78af5e961664c0e
https://git.kernel.org/stable/c/8819f93cd4a443dfe547aa622b21f723757df3fb
https://git.kernel.org/stable/c/835d3706852537bf92eb23eb8635b8dee0c0aa67
https://git.kernel.org/stable/c/83d5196b65d1b29e27d7dd16a3b9b439fb1d2dba
https://git.kernel.org/stable/c/bcea886771c3f22a590c8c8b9139a107bd7f1e1c
https://git.kernel.org/stable/c/5c968affa804ba98c3c603f37ffea6fba618025e
https://git.kernel.org/stable/c/899663be5e75dc0174dc8bda0b5e6826edf0b29a

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

119) Improper locking

EUVDB-ID: #VU94457

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-47622

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the EXPORT_SYMBOL_GPL(), ufshcd_hba_capabilities(), ufshcd_wait_for_dev_cmd(), ufshcd_exec_dev_cmd(), ufshcd_issue_devman_upiu_cmd() and ufshcd_init() functions in drivers/scsi/ufs/ufshcd.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/493c9e850677df8b4eda150c2364b1c1a72ed724
https://git.kernel.org/stable/c/d69d98d8edf90e25e4e09930dd36dd6d09dd6768
https://git.kernel.org/stable/c/945c3cca05d78351bba29fa65d93834cb7934c7b

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

120) Memory leak

EUVDB-ID: #VU94401

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-47624

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the rpc_sysfs_xprt_state_change() function in net/sunrpc/sysfs.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/stable/c/4b22aa42bd4d2d630ef1854c139275c3532937cb
https://git.kernel.org/stable/c/5f6024c05a2c0fdd180b29395aaf686d25af3a0f
https://git.kernel.org/stable/c/776d794f28c95051bc70405a7b1fa40115658a18

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

121) Memory leak

EUVDB-ID: #VU63427

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-0854

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due memory leak in the Linux kernel’s DMA subsystem when processing DMA_FROM_DEVICE calls. A local user can trigger a memory leak error and read random memory from the kernel space.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/kernel/dma/swiotlb.c?h=v5.17-rc8&id=aa6f8dcbab473f3a3c7454b74caa46d36cdc5d13

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

122) Out-of-bounds read

EUVDB-ID: #VU67473

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-20368

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary condition within the packet_recvmsg() function in Linux kernel. A local user can trigger an out-of-bounds read error and potentially escalate privileges on the system.

Install update from vendor's website.

Dell EMC Storage Monitoring and Reporting (SMR): before 5.0.2.0

Storage Resource Manager: before 5.0.2.0

• cpe:2.3:a:dell:dell_emc_storage_monitoring_and_reporting_smr:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:storage_resource_manager:*:*:*:*:*:*:*:*

https://source.android.com/security/bulletin/pixel/2022-08-01
https://android.googlesource.com/kernel/common/+/a0046956bf6fe

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

123) Input validation error

EUVDB-ID: #VU92925

Risk: Low