Dell SmartFabric Manager update for third-party components

1) Buffer overflow

EUVDB-ID: #VU100138

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50188

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the dp83869_configure_fiber() function in drivers/net/phy/dp83869.c. A local user can escalate privileges on the system.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Input validation error

EUVDB-ID: #VU100155

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50181

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the imx7d_clocks_init() function in drivers/clk/imx/clk-imx7d.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Buffer overflow

EUVDB-ID: #VU100147

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50182

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the SYSCALL_DEFINE1() and secretmem_init() functions in mm/secretmem.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Improper locking

EUVDB-ID: #VU100126

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50183

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the lpfc_vport_delete() function in drivers/scsi/lpfc/lpfc_vport.c, within the lpfc_cmpl_ct() function in drivers/scsi/lpfc/lpfc_ct.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Resource management error

EUVDB-ID: #VU100143

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50184

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the virtio_pmem_flush() function in drivers/nvdimm/nd_virtio.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) NULL pointer dereference

EUVDB-ID: #VU100122

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50186

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the __sock_create() function in net/socket.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Input validation error

EUVDB-ID: #VU100156

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50187

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the vc4_perfmon_open_file() and vc4_perfmon_close_file() functions in drivers/gpu/drm/vc4/vc4_perfmon.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Buffer overflow

EUVDB-ID: #VU100145

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50189

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the amd_sfh_hid_client_init() and amd_sfh_hid_client_deinit() functions in drivers/hid/amd-sfh-hid/amd_sfh_client.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Input validation error

EUVDB-ID: #VU100154

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50179

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the ceph_set_page_dirty() function in fs/ceph/addr.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Resource management error

EUVDB-ID: #VU100144

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50192

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the its_build_vmapp_cmd(), its_vpe_set_affinity() and its_vpe_init() functions in drivers/irqchip/irq-gic-v3-its.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Buffer overflow

EUVDB-ID: #VU100146

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50194

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the arch_uprobe_analyze_insn() and arch_uprobe_skip_sstep() functions in arch/arm64/kernel/probes/uprobes.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Resource management error

EUVDB-ID: #VU100150

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50195

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the pc_clock_settime() function in kernel/time/posix-clock.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Infinite loop

EUVDB-ID: #VU100142

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50196

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop within the ocelot_irq_handler() function in drivers/pinctrl/pinctrl-ocelot.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) NULL pointer dereference

EUVDB-ID: #VU100123

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50198

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the in_illuminance_period_available_show() function in drivers/iio/light/veml6030.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) Reachable assertion

EUVDB-ID: #VU100132

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50200

CWE-ID: CWE-617 - Reachable Assertion

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to reachable assertion within the mte_node_or_none(), mas_wr_walk(), mas_wr_walk_index() and mas_wr_spanning_store() functions in lib/maple_tree.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) Resource management error

EUVDB-ID: #VU100151

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50201

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the radeon_encoder_clones() function in drivers/gpu/drm/radeon/radeon_encoders.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

17) Buffer overflow

EUVDB-ID: #VU100137

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50180

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the sisfb_search_mode() function in drivers/video/fbdev/sis/sis_main.c. A local user can escalate privileges on the system.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

18) Out-of-bounds read

EUVDB-ID: #VU100121

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50177

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the dml_core_mode_support() and dml_core_mode_programming() functions in drivers/gpu/drm/amd/display/dc/dml2/dml21/src/dml2_core/dml2_core_dcn4_calcs.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

19) Buffer overflow

EUVDB-ID: #VU100141

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50208

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the bnxt_qplib_alloc_init_hwq() function in drivers/infiniband/hw/bnxt_re/qplib_res.c. A local user can escalate privileges on the system.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

20) Out-of-bounds read

EUVDB-ID: #VU100067

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50158

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the bnxt_re_ib_get_hw_stats() function in drivers/infiniband/hw/bnxt_re/hw_counters.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

21) Resource management error

EUVDB-ID: #VU100087

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50148

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the bnep_init() function in net/bluetooth/bnep/core.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

22) Use-after-free

EUVDB-ID: #VU100059

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50150

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the typec_altmode_release() and typec_register_altmode() functions in drivers/usb/typec/class.c. A local user can escalate privileges on the system.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

23) Use-after-free

EUVDB-ID: #VU100061

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50153

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the target_alloc_device() function in drivers/target/target_core_device.c. A local user can escalate privileges on the system.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

24) Use-after-free

EUVDB-ID: #VU100062

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50154

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the reqsk_queue_unlink() and reqsk_timer_handler() functions in net/ipv4/inet_connection_sock.c. A local user can escalate privileges on the system.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

25) Improper locking

EUVDB-ID: #VU100078

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50155

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the nsim_dev_trap_report_work() and nsim_dev_traps_init() functions in drivers/net/netdevsim/dev.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

26) NULL pointer dereference

EUVDB-ID: #VU100073

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50156

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the msm_disp_state_dump_regs() and msm_disp_state_print() functions in drivers/gpu/drm/msm/disp/msm_disp_snapshot_util.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

27) Improper locking

EUVDB-ID: #VU100079

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50157

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the is_dbr_fifo_full() and __wait_for_fifo_occupancy_below_th() functions in drivers/infiniband/hw/bnxt_re/main.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

28) Use-after-free

EUVDB-ID: #VU100064

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50159

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the scmi_debugfs_common_setup() function in drivers/firmware/arm_scmi/driver.c. A local user can escalate privileges on the system.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

29) Improper error handling

EUVDB-ID: #VU100133

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50176

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the dev_err() and rproc_del() functions in drivers/remoteproc/ti_k3_r5_remoteproc.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

30) NULL pointer dereference

EUVDB-ID: #VU100074

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50160

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the dolphin_fixups() function in sound/pci/hda/patch_cs8409.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

31) Memory leak

EUVDB-ID: #VU100052

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50166

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the mac_probe() and mac_remove() functions in drivers/net/ethernet/freescale/fman/mac.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

32) Memory leak

EUVDB-ID: #VU100053

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50167

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the be_xmit() function in drivers/net/ethernet/emulex/benet/be_main.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

33) Improper locking

EUVDB-ID: #VU100080

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50169

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the virtio_transport_read_skb() function in net/vmw_vsock/virtio_transport_common.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

34) Memory leak

EUVDB-ID: #VU100056

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50171

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the bcm_sysport_xmit() function in drivers/net/ethernet/broadcom/bcmsysport.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

35) Memory leak

EUVDB-ID: #VU100057

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50172

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the bnxt_re_setup_chip_ctx() function in drivers/infiniband/hw/bnxt_re/main.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

36) Improper locking

EUVDB-ID: #VU100125

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50175

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the video_stop_streaming() function in drivers/media/platform/qcom/camss/camss-video.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

37) Use of uninitialized resource

EUVDB-ID: #VU100136

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50205

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the apply_constraint_to_size() function in sound/firewire/amdtp-stream.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

38) Buffer overflow

EUVDB-ID: #VU100148

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50209

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the bnxt_qplib_alloc_init_hwq() function in drivers/infiniband/hw/bnxt_re/qplib_res.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

39) NULL pointer dereference

EUVDB-ID: #VU100071

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50146

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the _mlx5e_remove() function in drivers/net/ethernet/mellanox/mlx5/core/en_main.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

40) Use-after-free

EUVDB-ID: #VU100613

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50267

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the edge_bulk_out_data_callback() and edge_bulk_out_cmd_callback() functions in drivers/usb/serial/io_edgeport.c. A local user can escalate privileges on the system.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

41) Buffer overflow

EUVDB-ID: #VU100198

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50250

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the dax_unshare_iter() function in fs/dax.c. A local user can escalate privileges on the system.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

42) Memory leak

EUVDB-ID: #VU100163

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50252

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the mlxsw_sp_ipip_ol_netdev_change_gre6() function in drivers/net/ethernet/mellanox/mlxsw/spectrum_ipip.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

43) NULL pointer dereference

EUVDB-ID: #VU100180

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50255

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the __hci_cmd_sync_sk() and __hci_cmd_sync_status_sk() functions in net/bluetooth/hci_sync.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

44) Use-after-free

EUVDB-ID: #VU100168

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50257

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the xt_find_table_lock() function in net/netfilter/x_tables.c. A local user can escalate privileges on the system.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

45) Use-after-free

EUVDB-ID: #VU100169

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50261

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the macsec_free_netdev() function in drivers/net/macsec.c. A local user can escalate privileges on the system.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

46) Use-after-free

EUVDB-ID: #VU100612

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50264

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the virtio_transport_destruct() function in net/vmw_vsock/virtio_transport_common.c. A local user can escalate privileges on the system.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

47) Memory leak

EUVDB-ID: #VU100610

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50265

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the ocfs2_xa_remove() function in fs/ocfs2/xattr.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

48) Out-of-bounds read

EUVDB-ID: #VU100618

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50268

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the ucsi_ccg_update_set_new_cam_cmd() function in drivers/usb/typec/ucsi/ucsi_ccg.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

49) Input validation error

EUVDB-ID: #VU100205

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50248

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to boundary error within the mi_enum_attr() function in fs/ntfs3/record.c. A local user can trigger memory corruption and perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

50) Improper resource shutdown or release

EUVDB-ID: #VU100649

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50269

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to failure to properly release resources within the sunxi_musb_exit() function in drivers/usb/musb/sunxi.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

51) Improper locking

EUVDB-ID: #VU100628

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50271

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the dec_rlimit_put_ucounts() and inc_rlimit_get_ucounts() functions in kernel/ucount.c, within the __sigqueue_alloc() function in kernel/signal.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

52) NULL pointer dereference

EUVDB-ID: #VU100623

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50273

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the insert_delayed_ref() function in fs/btrfs/delayed-ref.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

53) Improper locking

EUVDB-ID: #VU100629

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50274

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the idpf_handle_event_link() function in drivers/net/ethernet/intel/idpf/idpf_virtchnl.c, within the idpf_initiate_soft_reset() function in drivers/net/ethernet/intel/idpf/idpf_lib.c, within the idpf_set_msglevel() function in drivers/net/ethernet/intel/idpf/idpf_ethtool.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

54) Resource management error

EUVDB-ID: #VU100644

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50275

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the sve_init_regs() function in arch/arm64/kernel/fpsimd.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

55) Double free

EUVDB-ID: #VU100632

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50276

CWE-ID: CWE-415 - Double Free

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a double free error within the mse102x_tx_frame_spi() function in drivers/net/ethernet/vertexcom/mse102x.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

56) Out-of-bounds read

EUVDB-ID: #VU100620

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50279

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the can_resize() function in drivers/md/dm-cache-target.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

57) Improper locking

EUVDB-ID: #VU100186

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50249

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the acpi_cppc_processor_probe() and cpc_write() functions in drivers/acpi/cppc_acpi.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

58) Buffer overflow

EUVDB-ID: #VU100203

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50246

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the mi_enum_attr() function in fs/ntfs3/record.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

59) Improper locking

EUVDB-ID: #VU100129

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50210

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the pc_clock_settime() function in kernel/time/posix-clock.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

60) Input validation error

EUVDB-ID: #VU100188

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50230

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the nilfs_clear_dirty_page() function in fs/nilfs2/page.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

61) Double free

EUVDB-ID: #VU100190

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50215

CWE-ID: CWE-415 - Double Free

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a double free error within the nvmet_setup_dhgroup() function in drivers/nvme/target/auth.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

62) Use of uninitialized resource

EUVDB-ID: #VU100193

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50216

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the xfs_filestream_pick_ag() and !() functions in fs/xfs/xfs_filestream.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

63) Input validation error

EUVDB-ID: #VU100187

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50218

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the ocfs2_remove_inode_range() function in fs/ocfs2/file.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

64) Out-of-bounds read

EUVDB-ID: #VU100170

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50221

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the vangogh_tables_init() function in drivers/gpu/drm/amd/pm/swsmu/smu11/vangogh_ppt.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

65) NULL pointer dereference

EUVDB-ID: #VU100175

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50224

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the dspi_setup() function in drivers/spi/spi-fsl-dspi.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

66) NULL pointer dereference

EUVDB-ID: #VU100176

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50225

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the btrfs_bio_init() and __btrfs_bio_end_io() functions in fs/btrfs/bio.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

67) Improper locking

EUVDB-ID: #VU100183

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50229

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the nilfs_symlink() function in fs/nilfs2/namei.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

68) Memory leak

EUVDB-ID: #VU100161

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50231

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the iio_gts_build_avail_scale_table() function in drivers/iio/industrialio-gts-helper.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

69) Improper locking

EUVDB-ID: #VU100185

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50245

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the ntfs_lookup() function in fs/ntfs3/namei.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

70) Division by zero

EUVDB-ID: #VU100199

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50232

CWE-ID: CWE-369 - Divide By Zero

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a division by zero error within the ad7124_write_raw() function in drivers/iio/adc/ad7124.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

71) Division by zero

EUVDB-ID: #VU100200

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50233

CWE-ID: CWE-369 - Divide By Zero

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a division by zero error within the ad9832_calc_freqreg() function in drivers/staging/iio/frequency/ad9832.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

72) Improper locking

EUVDB-ID: #VU100184

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50234

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the il_pci_resume() function in drivers/net/wireless/intel/iwlegacy/common.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

73) Double free

EUVDB-ID: #VU100191

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50235

CWE-ID: CWE-415 - Double Free

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a double free error within the _cfg80211_unregister_wdev() function in net/wireless/core.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

74) Memory leak

EUVDB-ID: #VU100162

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50236

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the wmi_process_mgmt_tx_comp() and ath10k_wmi_mgmt_tx_clean_up_pending() functions in drivers/net/wireless/ath/ath10k/wmi.c, within the ath10k_wmi_tlv_op_cleanup_mgmt_tx_send() function in drivers/net/wireless/ath/ath10k/wmi-tlv.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

75) Use of uninitialized resource

EUVDB-ID: #VU100194

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50237

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the ieee80211_get_tx_power() function in net/mac80211/cfg.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

76) NULL pointer dereference

EUVDB-ID: #VU100179

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50240

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the qmp_usb_probe() function in drivers/phy/qualcomm/phy-qcom-qmp-usb.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

77) NULL pointer dereference

EUVDB-ID: #VU100072

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50147

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the mlx5_cmd_comp_handler(), mlx5_cmd_trigger_completions() and mlx5_cmd_enable() functions in drivers/net/ethernet/mellanox/mlx5/core/cmd.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

78) NULL pointer dereference

EUVDB-ID: #VU100070

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50145

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the octep_oq_next_pkt() and __octep_oq_process_rx() functions in drivers/net/ethernet/marvell/octeon_ep/octep_rx.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

79) Division by zero

EUVDB-ID: #VU100639

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50287

CWE-ID: CWE-369 - Divide By Zero

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a division by zero error within the tpg_precalculate_line() function in drivers/media/common/v4l2-tpg/v4l2-tpg-core.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

80) Double free

EUVDB-ID: #VU99057

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50055

CWE-ID: CWE-415 - Double Free

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a double free error within the bus_remove_file() function in drivers/base/bus.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

81) Improper locking

EUVDB-ID: #VU98997

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50044

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the rfcomm_sock_ioctl() function in net/bluetooth/rfcomm/sock.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

82) Input validation error

EUVDB-ID: #VU99038

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50045

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the br_nf_dev_queue_xmit() function in net/bridge/br_netfilter_hooks.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

83) Improper locking

EUVDB-ID: #VU98996

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50046

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the nfs42_complete_copies() function in fs/nfs/nfs4state.c, within the handle_async_copy() function in fs/nfs/nfs42proc.c, within the nfs_alloc_server() function in fs/nfs/client.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

84) Improper locking

EUVDB-ID: #VU98995

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50047

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the SMB2_negotiate() function in fs/smb/client/smb2pdu.c, within the smb2_get_enc_key(), crypt_message(), smb3_init_transform_rq() and decrypt_raw_data() functions in fs/smb/client/smb2ops.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

85) Improper error handling

EUVDB-ID: #VU99061

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50048

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the set_con2fb_map() function in drivers/video/fbdev/core/fbcon.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

86) Input validation error

EUVDB-ID: #VU99203

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50049

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the dc_validate_seamless_boot_timing() function in drivers/gpu/drm/amd/display/dc/core/dc.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

87) Input validation error

EUVDB-ID: #VU99205

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50058

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the uart_shutdown() function in drivers/tty/serial/serial_core.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

88) Improper locking

EUVDB-ID: #VU98999

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50041

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the i40e_vc_get_vf_resources_msg() function in drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c, within the i40e_add_mac_filter() function in drivers/net/ethernet/intel/i40e/i40e_main.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

89) Race condition

EUVDB-ID: #VU99125

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50059

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition within the switchtec_ntb_remove() function in drivers/ntb/hw/mscc/ntb_hw_switchtec.c. A local user can escalate privileges on the system.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

90) Improper locking

EUVDB-ID: #VU98994

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50060

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the __io_cqring_overflow_flush() function in io_uring/io_uring.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

91) Race condition

EUVDB-ID: #VU99126

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50061

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition within the cdns_i3c_master_remove() function in drivers/i3c/master/i3c-master-cdns.c. A local user can escalate privileges on the system.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

92) Input validation error

EUVDB-ID: #VU99039

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50062

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the rtrs_srv_info_req_done() and post_recv_path() functions in drivers/infiniband/ulp/rtrs/rtrs-srv.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

93) Buffer overflow

EUVDB-ID: #VU99190

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50063

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the bpf_prog_map_compatible() function in kernel/bpf/core.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

94) Information disclosure

EUVDB-ID: #VU99117

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50064

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to information disclosure within the zram_destroy_comps() function in drivers/block/zram/zram_drv.c. A local user can gain access to sensitive information.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

95) Use-after-free

EUVDB-ID: #VU99434

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50067

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the uprobe_buffer_init(), prepare_uprobe_buffer() and __uprobe_trace_func() functions in kernel/trace/trace_uprobe.c. A local user can escalate privileges on the system.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

96) Buffer overflow

EUVDB-ID: #VU99155

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50042

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the ice_vf_pre_vsi_rebuild() function in drivers/net/ethernet/intel/ice/ice_vf_lib.c, within the ice_sriov_set_msix_vec_count() function in drivers/net/ethernet/intel/ice/ice_sriov.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

97) Improper error handling

EUVDB-ID: #VU99062

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50040

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the igb_io_resume() function in drivers/net/ethernet/intel/igb/igb_main.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

98) Use-after-free

EUVDB-ID: #VU99442

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50073

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the gsm_cleanup_mux() function in drivers/tty/n_gsm.c. A local user can escalate privileges on the system.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

99) Buffer overflow

EUVDB-ID: #VU99154

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50022

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the dax_set_mapping() function in drivers/dax/device.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

100) Memory leak

EUVDB-ID: #VU98850

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50013

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the exfat_load_bitmap() function in fs/exfat/balloc.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

101) Improper locking

EUVDB-ID: #VU99010

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50014

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the __ext4_fill_super() function in fs/ext4/super.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

102) Buffer overflow

EUVDB-ID: #VU99099

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50015

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the ext4_handle_inode_extension(), ext4_dio_write_iter() and ext4_dax_write_iter() functions in fs/ext4/file.c. A local user can escalate privileges on the system.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

103) Input validation error

EUVDB-ID: #VU99219

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50017

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the ident_pud_init() function in arch/x86/mm/ident_map.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

104) Resource management error

EUVDB-ID: #VU99160

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50019

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the kthread_unpark() function in kernel/kthread.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

105) Improper error handling

EUVDB-ID: #VU99064

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50020

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the ice_sriov_set_msix_vec_count() and ice_sriov_get_irqs() functions in drivers/net/ethernet/intel/ice/ice_sriov.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

106) Incorrect calculation

EUVDB-ID: #VU99183

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50021

CWE-ID: CWE-682 - Incorrect Calculation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to incorrect calculation within the ice_dpll_init_rclk_pins() function in drivers/net/ethernet/intel/ice/ice_dpll.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

107) Input validation error

EUVDB-ID: #VU99196

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50023

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the phy_led_hw_is_supported() function in drivers/net/phy/phy_device.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

108) Use of uninitialized resource

EUVDB-ID: #VU99083

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50035

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the ppp_async_encode() function in drivers/net/ppp/ppp_async.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

109) Infinite loop

EUVDB-ID: #VU99121

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50024

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop within the __netlink_clear_multicast_users() function in net/netlink/af_netlink.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

110) Improper locking

EUVDB-ID: #VU99001

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50025

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the fnic_probe() function in drivers/scsi/fnic/fnic_main.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

111) Improper Initialization

EUVDB-ID: #VU99129

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50026

CWE-ID: CWE-665 - Improper Initialization

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper initialization within the wd33c93_intr() function in drivers/scsi/wd33c93.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

112) Double free

EUVDB-ID: #VU99055

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50027

CWE-ID: CWE-415 - Double Free

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a double free error within the thermal_zone_device_unregister() function in drivers/thermal/thermal_core.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

113) Incorrect calculation

EUVDB-ID: #VU99184

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50028

CWE-ID: CWE-682 - Incorrect Calculation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to incorrect calculation within the thermal_genl_cmd_tz_get_trip(), thermal_genl_cmd_tz_get_temp() and thermal_genl_cmd_tz_get_gov() functions in drivers/thermal/thermal_netlink.c, within the thermal_zone_get_by_id() function in drivers/thermal/thermal_core.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

114) Resource management error

EUVDB-ID: #VU99135

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50031

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the v3d_perfmon_open_file() and v3d_perfmon_idr_del() functions in drivers/gpu/drm/v3d/v3d_perfmon.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

115) Use of uninitialized resource

EUVDB-ID: #VU99082

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50033

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the slhc_remember() function in drivers/net/slip/slhc.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

116) NULL pointer dereference

EUVDB-ID: #VU99446

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50069

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the apple_gpio_pinctrl_probe() function in drivers/pinctrl/pinctrl-apple-gpio.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

117) Out-of-bounds read

EUVDB-ID: #VU99445

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50074

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the do_active_device(), do_autoprobe(), do_hardware_base_addr(), do_hardware_irq(), do_hardware_dma() and do_hardware_modes() functions in drivers/parport/procfs.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

118) Improper locking

EUVDB-ID: #VU100077

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50141

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the efi_pa_va_lookup(), acpi_parse_prmt() and acpi_platformrt_space_handler() functions in drivers/acpi/prmt.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

119) Use-after-free

EUVDB-ID: #VU99808

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50127

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the taprio_change() function in net/sched/sch_taprio.c. A local user can escalate privileges on the system.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

120) Memory leak

EUVDB-ID: #VU99801

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50110

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the copy_to_user_auth() function in net/xfrm/xfrm_user.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

121) Out-of-bounds read

EUVDB-ID: #VU99810

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50115

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the nested_svm_get_tdp_pdptr() function in arch/x86/kvm/svm/nested.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

122) Improper error handling

EUVDB-ID: #VU99831

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50116

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the nilfs_forget_buffer() and nilfs_clear_dirty_page() functions in fs/nilfs2/page.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

123) NULL pointer dereference

EUVDB-ID: #VU99818

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50117

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the amdgpu_atif_call() function in drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

124) Use-after-free

EUVDB-ID: #VU99804

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50121

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the nfs4_state_shutdown_net() function in fs/nfsd/nfs4state.c. A local user can escalate privileges on the system.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

125) Use-after-free

EUVDB-ID: #VU99805

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50124

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the ISO_CONN_TIMEOUT(), iso_sock_timeout() and iso_conn_del() functions in net/bluetooth/iso.c. A local user can escalate privileges on the system.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

126) Use-after-free

EUVDB-ID: #VU99806

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50125

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the SCO_CONN_TIMEOUT(), sco_sock_timeout() and sco_conn_del() functions in net/bluetooth/sco.c, within the bt_sock_unlink() function in net/bluetooth/af_bluetooth.c. A local user can escalate privileges on the system.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

127) Out-of-bounds read

EUVDB-ID: #VU99812

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50128

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the drivers/net/wwan/wwan_core.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

128) NULL pointer dereference

EUVDB-ID: #VU99814

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50103

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the asoc_qcom_lpass_cpu_platform_probe() function in sound/soc/qcom/lpass-cpu.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

129) Use-after-free

EUVDB-ID: #VU99809

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50130

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the nf_hook_run_bpf(), bpf_nf_link_release() and bpf_nf_link_attach() functions in net/netfilter/nf_bpf_link.c. A local user can escalate privileges on the system.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

130) Improper error handling

EUVDB-ID: #VU99833

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50131

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the traceprobe_parse_event_name() function in kernel/trace/trace_probe.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

131) Buffer overflow

EUVDB-ID: #VU99837

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50134

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the hgsmi_update_pointer_shape() function in drivers/gpu/drm/vboxvideo/hgsmi_base.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

132) Improper locking

EUVDB-ID: #VU99826

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50135

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the nvme_pci_nr_maps() and nvme_reset_work() functions in drivers/nvme/host/pci.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

133) Resource management error

EUVDB-ID: #VU99836

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50136

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the mlx5_eswitch_enable_locked() function in drivers/net/ethernet/mellanox/mlx5/core/eswitch.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

134) Improper locking

EUVDB-ID: #VU99827

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50138

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the bpf_ringbuf_alloc() and __bpf_ringbuf_reserve() functions in kernel/bpf/ringbuf.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

135) Out-of-bounds read

EUVDB-ID: #VU100065

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50139

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the reset_clidr() function in arch/arm64/kvm/sys_regs.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

136) Resource management error

EUVDB-ID: #VU99839

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50108

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the is_psr_su_specific_panel() function in drivers/gpu/drm/amd/display/modules/power/power_helpers.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

137) Memory leak

EUVDB-ID: #VU99845

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50102

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the IS_ENABLED() function in arch/x86/lib/getuser.S, within the RUNTIME_CONST() function in arch/x86/kernel/vmlinux.lds.S, within the arch_cpu_finalize_init() function in arch/x86/kernel/cpu/common.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

138) Input validation error

EUVDB-ID: #VU99462

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50075

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the tegra_xusb_enter_elpg() function in drivers/usb/host/xhci-tegra.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

139) Use of uninitialized resource

EUVDB-ID: #VU99455

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50087

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the replay_one_name() and check_item_in_log() functions in fs/btrfs/tree-log.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

140) Buffer overflow

EUVDB-ID: #VU99460

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50076

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the con_font_get() function in drivers/tty/vt/vt.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

141) Improper error handling

EUVDB-ID: #VU99453

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50077

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the iso_init() function in net/bluetooth/iso.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

142) Improper error handling

EUVDB-ID: #VU99454

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50078

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the bt_exit() function in net/bluetooth/af_bluetooth.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Manager: 1.0.0 - 1.1.0

• cpe:2.3:a:dell:smartfabric_manager:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:dell:smartfabric_manager:1.1.0:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000296560/dsa-2025-136-security-update-for-dell-smartfabric-manager-multiple-third-party-component-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

143) Memory leak