Dell SmartFabric Storage Software update for third-party components

1) Improper error handling

EUVDB-ID: #VU95020

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41034

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the nilfs_dotdot() function in fs/nilfs2/dir.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Use-after-free

EUVDB-ID: #VU94218

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-40947

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the smack_post_notification() function in security/smack/smack_lsm.c, within the selinux_audit_rule_free() and selinux_audit_rule_init() functions in security/selinux/ss/services.c, within the security_key_getsecurity() function in security/security.c, within the ima_free_rule(), ima_lsm_copy_rule(), ima_lsm_update_rule() and ima_lsm_rule_init() functions in security/integrity/ima/ima_policy.c, within the aa_audit_rule_free() and aa_audit_rule_init() functions in security/apparmor/audit.c, within the audit_data_to_entry() and audit_dupe_lsm_field() functions in kernel/auditfilter.c. A local user can escalate privileges on the system.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Resource management error

EUVDB-ID: #VU94345

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41007

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the tcp_rtx_probe0_timed_out() function in net/ipv4/tcp_timer.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Input validation error

EUVDB-ID: #VU94508

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41009

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the __aligned(), bpf_ringbuf_alloc(), bpf_ringbuf_restore_from_rec() and __bpf_ringbuf_reserve() functions in kernel/bpf/ringbuf.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Use-after-free

EUVDB-ID: #VU94672

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41012

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the fcntl_setlk() function in fs/locks.c. A local user can escalate privileges on the system.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Input validation error

EUVDB-ID: #VU94842

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41015

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the ocfs2_check_dir_entry(), ocfs2_search_dirblock(), __ocfs2_delete_entry(), __ocfs2_add_entry(), ocfs2_dir_foreach_blk_id(), ocfs2_dir_foreach_blk_el(), ocfs2_find_dir_space_id() and ocfs2_find_dir_space_el() functions in fs/ocfs2/dir.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Input validation error

EUVDB-ID: #VU94843

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41017

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the __jfs_getxattr() and jfs_listxattr() functions in fs/jfs/xattr.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Improper locking

EUVDB-ID: #VU94996

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41020

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the fcntl_setlk64() function in fs/locks.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Improper error handling

EUVDB-ID: #VU95022

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41022

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the sdma_v4_0_process_trap_irq() function in drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Input validation error

EUVDB-ID: #VU95109

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41035

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the usb_parse_endpoint() function in drivers/usb/core/config.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) NULL pointer dereference

EUVDB-ID: #VU90383

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-36938

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the include/linux/skmsg.h. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Use-after-free

EUVDB-ID: #VU94949

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41040

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the net/sched/act_ct.c. A local user can escalate privileges on the system.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Resource management error

EUVDB-ID: #VU95069

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41041

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the sock_set_flag() and spin_unlock() functions in net/ipv4/udp.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Input validation error

EUVDB-ID: #VU95108

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41044

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the ppp_read() and ppp_write() functions in drivers/net/ppp/ppp_generic.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) Double free

EUVDB-ID: #VU95010

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41046

CWE-ID: CWE-415 - Double Free

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a double free error within the ltq_etop_free_channel() function in drivers/net/ethernet/lantiq_etop.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) Use-after-free

EUVDB-ID: #VU94947

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41049

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the posix_lock_inode() function in fs/locks.c. A local user can escalate privileges on the system.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

17) NULL pointer dereference

EUVDB-ID: #VU94979

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41055

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the include/linux/mmzone.h. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

18) Use of uninitialized resource

EUVDB-ID: #VU95033

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41059

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the hfsplus_listxattr() function in fs/hfsplus/xattr.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

19) Improper locking

EUVDB-ID: #VU94992

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41063

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the hci_unregister_dev() function in net/bluetooth/hci_core.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

20) Out-of-bounds read

EUVDB-ID: #VU93889

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-39487

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the bond_option_arp_ip_targets_set() function in drivers/net/bonding/bond_options.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

21) NULL pointer dereference

EUVDB-ID: #VU91224

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-36901

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the ip6_output() function in net/ipv6/ip6_output.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

22) Memory leak

EUVDB-ID: #VU94926

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41065

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the alloc_dispatch_log_kmem_cache() function in arch/powerpc/platforms/pseries/setup.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

23) Resource management error

EUVDB-ID: #VU94105

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-27065

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources within the nf_tables_updtable() function in net/netfilter/nf_tables_api.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

24) NULL pointer dereference

EUVDB-ID: #VU90521

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-27044

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the dcn10_set_output_transfer_func() function in drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

25) Buffer overflow

EUVDB-ID: #VU91310

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-27045

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the dp_dsc_clock_en_read() function in drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c. A local user can escalate privileges on the system.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

26) NULL pointer dereference

EUVDB-ID: #VU90519

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-27046

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the nfp_fl_lag_do_work() function in drivers/net/ethernet/netronome/nfp/flower/lag_conf.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

27) NULL pointer dereference

EUVDB-ID: #VU90520

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-27047

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the phy_get_internal_delay() function in drivers/net/phy/phy_device.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

28) NULL pointer dereference

EUVDB-ID: #VU91501

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-27051

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the brcm_avs_is_firmware_loaded() function in drivers/cpufreq/brcmstb-avs-cpufreq.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

29) Use-after-free

EUVDB-ID: #VU90180

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-27052

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the rtl8xxxu_stop() function in drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c. A local user can escalate privileges on the system.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

30) Improper locking

EUVDB-ID: #VU92029

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-27053

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the wilc_parse_join_bss_param() function in drivers/staging/wilc1000/wilc_hif.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

31) Division by zero

EUVDB-ID: #VU91374

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-27059

CWE-ID: CWE-369 - Divide By Zero

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a division by zero error within the isd200_dump_driveid(), isd200_get_inquiry_data() and isd200_init_info() functions in drivers/usb/storage/isd200.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

32) Memory leak

EUVDB-ID: #VU90455

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-27073

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the budget_av_attach() function in drivers/media/pci/ttpci/budget-av.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

33) Reachable assertion

EUVDB-ID: #VU93039

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-36484

CWE-ID: CWE-617 - Reachable Assertion

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to reachable assertion within the __inet_accept() function in net/ipv4/af_inet.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

34) Memory leak

EUVDB-ID: #VU90453

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-27074

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the go7007_load_encoder() function in drivers/media/usb/go7007/go7007-driver.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

35) Stack-based buffer overflow

EUVDB-ID: #VU91298

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-27075

CWE-ID: CWE-121 - Stack-based buffer overflow

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to stack overflow within the stv0367_writeregs() function in drivers/media/dvb-frontends/stv0367.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

36) Memory leak

EUVDB-ID: #VU89991

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-27076

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the ipu_csc_scaler_release() function in drivers/staging/media/imx/imx-media-csc-scaler.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

37) Memory leak

EUVDB-ID: #VU90451

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-27077

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the v4l2_m2m_register_entity() function in drivers/media/v4l2-core/v4l2-mem2mem.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

38) Memory leak

EUVDB-ID: #VU90450

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-27078

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the tpg_alloc() function in drivers/media/common/v4l2-tpg/v4l2-tpg-core.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

39) Memory leak

EUVDB-ID: #VU90449

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-27388

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the gssx_dec_option_array() function in net/sunrpc/auth_gss/gss_rpc_xdr.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

40) Resource management error

EUVDB-ID: #VU93202

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-27437

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the vfio_intx_set_signal() function in drivers/vfio/pci/vfio_pci_intrs.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

41) Use-after-free

EUVDB-ID: #VU90191

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48666

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the __scsi_remove_device() function in drivers/scsi/scsi_sysfs.c, within the scsi_alloc_sdev() function in drivers/scsi/scsi_scan.c, within the scsi_mq_setup_tags() function in drivers/scsi/scsi_lib.c, within the scsi_remove_host(), scsi_add_host_with_dma() and scsi_host_dev_release() functions in drivers/scsi/hosts.c. A local user can escalate privileges on the system.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

42) Improper locking

EUVDB-ID: #VU94991

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41064

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the eeh_pe_bus_get() function in arch/powerpc/kernel/eeh_pe.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

43) Resource management error

EUVDB-ID: #VU95072

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41068

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the sclp_init() function in drivers/s390/char/sclp.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

44) NULL pointer dereference

EUVDB-ID: #VU91236

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-27038

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the clk_core_get() function in drivers/clk/clk.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

45) Memory leak

EUVDB-ID: #VU95502

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42236

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the usb_string_copy() function in drivers/usb/gadget/configfs.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

46) Improper locking

EUVDB-ID: #VU94983

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42153

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the wait_reset(), i2c_pnx_master_xmit(), i2c_pnx_master_rcv(), i2c_pnx_interrupt(), i2c_pnx_timeout(), i2c_pnx_xfer() and i2c_pnx_probe() functions in drivers/i2c/busses/i2c-pnx.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

47) Input validation error

EUVDB-ID: #VU95093

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42154

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the sizeof() function in net/ipv4/tcp_metrics.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

48) Input validation error

EUVDB-ID: #VU95090

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42157

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the pkey_unlocked_ioctl() function in drivers/s390/crypto/pkey_api.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

49) Use of uninitialized resource

EUVDB-ID: #VU95027

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42161

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the tools/lib/bpf/bpf_core_read.h. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

50) Integer overflow

EUVDB-ID: #VU95037

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42223

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer overflow within the tda10048_set_if() function in drivers/media/dvb-frontends/tda10048.c. A local user can execute arbitrary code.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

51) Improper error handling

EUVDB-ID: #VU95012

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42224

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the mv88e6xxx_default_mdio_bus() function in drivers/net/dsa/mv88e6xxx/chip.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

52) Buffer overflow

EUVDB-ID: #VU95078

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42229

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the setkey_unaligned() function in crypto/cipher.c, within the setkey_unaligned() function in crypto/aead.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

53) Use-after-free

EUVDB-ID: #VU95503

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42232

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the delayed_work() and EXPORT_SYMBOL() functions in net/ceph/mon_client.c. A local user can escalate privileges on the system.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

54) Input validation error

EUVDB-ID: #VU95510

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42244

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the mos7840_port_remove() function in drivers/usb/serial/mos7840.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

55) Out-of-bounds read

EUVDB-ID: #VU94952

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42148

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the drivers/net/ethernet/broadcom/bnx2x/bnx2x.h. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

56) Resource management error

EUVDB-ID: #VU95518

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42247

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the swap_endian() function in drivers/net/wireguard/allowedips.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

57) Resource exhaustion

EUVDB-ID: #VU63911

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-3669

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to measuring usage of the shared memory does not scale with large shared memory segment counts. A local user can trigger resource exhaustion and perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

58) Use-after-free

EUVDB-ID: #VU92895

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48733

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the btrfs_wait_delalloc_flush() and btrfs_commit_transaction() functions in fs/btrfs/transaction.c, within the create_snapshot() function in fs/btrfs/ioctl.c. A local user can escalate privileges on the system.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

59) NULL pointer dereference

EUVDB-ID: #VU79496

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-31083

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error within the hci_uart_tty_ioctl() function in drivers/bluetooth/hci_ldisc.c. A local user can pass specially crafted data to the system and perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

60) NULL pointer dereference

EUVDB-ID: #VU96132

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-52889

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the apparmor_socket_sock_rcv_skb() function in security/apparmor/lsm.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

61) Improper locking

EUVDB-ID: #VU92027

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-27397

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the __nft_rbtree_insert(), nft_rbtree_deactivate() and nft_rbtree_gc() functions in net/netfilter/nft_set_rbtree.c, within the pipapo_get(), nft_pipapo_get(), nft_pipapo_insert(), pipapo_gc() and pipapo_deactivate() functions in net/netfilter/nft_set_pipapo.c, within the nft_rhash_key(), nft_rhash_cmp(), nft_rhash_lookup(), nft_rhash_get(), nft_rhash_update(), nft_rhash_insert() and nft_rhash_deactivate() functions in net/netfilter/nft_set_hash.c, within the nft_trans_gc_catchall_sync() and nf_tables_valid_genid() functions in net/netfilter/nf_tables_api.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

62) Buffer overflow

EUVDB-ID: #VU92378

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-38577

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the kernel/rcu/tasks.h. A local user can escalate privileges on the system.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

63) Input validation error

EUVDB-ID: #VU94530

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41011

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the kfd_ioctl_alloc_memory_of_gpu(), criu_restore_memory_of_gpu() and kfd_mmio_mmap() functions in drivers/gpu/drm/amd/amdkfd/kfd_chardev.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

64) Memory leak

EUVDB-ID: #VU94922

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42152

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the nvmet_sq_destroy() function in drivers/nvme/target/core.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

65) Buffer overflow

EUVDB-ID: #VU95054

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42145

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the MODULE_AUTHOR(), __get_agent(), send_handler(), recv_handler() and ib_umad_read() functions in drivers/infiniband/core/user_mad.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

66) Use-after-free

EUVDB-ID: #VU94942

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41070

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the kvm_spapr_tce_attach_iommu_group() function in arch/powerpc/kvm/book3s_64_vio.c. A local user can escalate privileges on the system.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

67) Use-after-free

EUVDB-ID: #VU94937

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42104

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the nilfs_check_page() and nilfs_error() functions in fs/nilfs2/dir.c. A local user can escalate privileges on the system.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

68) Input validation error

EUVDB-ID: #VU95106

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41072

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the cfg80211_wext_siwscan() function in net/wireless/scan.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

69) NULL pointer dereference

EUVDB-ID: #VU94976

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41077

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the null_validate_conf() function in drivers/block/null_blk/main.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

70) Memory leak

EUVDB-ID: #VU94929

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41078

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the btrfs_quota_disable() function in fs/btrfs/qgroup.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

71) Resource management error

EUVDB-ID: #VU95051

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41081

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the ila_output() function in net/ipv6/ila/ila_lwt.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

72) Out-of-bounds read

EUVDB-ID: #VU94840

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41090

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the tap_get_user_xdp() function in drivers/net/tap.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

73) Out-of-bounds read

EUVDB-ID: #VU94841

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41091

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the tun_xdp_one() function in drivers/net/tun.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

74) NULL pointer dereference

EUVDB-ID: #VU94963

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42101

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the nouveau_connector_get_modes() function in drivers/gpu/drm/nouveau/nouveau_connector.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

75) Integer overflow

EUVDB-ID: #VU95034

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42102

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer overflow within the wb_dirty_limits() function in mm/page-writeback.c. A local user can execute arbitrary code.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

76) Use-after-free

EUVDB-ID: #VU94936

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42105

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the nilfs_store_disk_layout() function in fs/nilfs2/the_nilfs.c. A local user can escalate privileges on the system.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

77) Out-of-bounds read

EUVDB-ID: #VU94951

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42143

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the orangefs_statfs() function in fs/orangefs/super.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

78) Use of uninitialized resource

EUVDB-ID: #VU95024

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42106

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the inet_diag_dump_compat() and inet_diag_get_exact_compat() functions in net/ipv4/inet_diag.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

79) Use-after-free

EUVDB-ID: #VU94932

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42115

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the jffs2_i_init_once() function in fs/jffs2/super.c. A local user can escalate privileges on the system.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

80) Improper error handling

EUVDB-ID: #VU95015

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42119

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the find_first_free_audio() function in drivers/gpu/drm/amd/display/dc/core/dc_resource.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

81) Input validation error

EUVDB-ID: #VU95099

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42120

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the dce110_vblank_set() function in drivers/gpu/drm/amd/display/dc/irq/dce110/irq_service_dce110.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

82) Input validation error

EUVDB-ID: #VU95098

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42121

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the read() and write() functions in drivers/gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

83) Input validation error

EUVDB-ID: #VU95097

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42124

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the qedf_execute_tmf() function in drivers/scsi/qedf/qedf_io.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

84) Improper error handling

EUVDB-ID: #VU95014

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42127

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the lima_pp_init() and lima_pp_bcast_init() functions in drivers/gpu/drm/lima/lima_pp.c, within the lima_mmu_init() function in drivers/gpu/drm/lima/lima_mmu.c, within the lima_gp_init() function in drivers/gpu/drm/lima/lima_gp.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

85) Integer overflow

EUVDB-ID: #VU95035

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42131

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer overflow within the domain_dirty_limits(), node_dirty_limit(), dirty_background_bytes_handler() and dirty_bytes_handler() functions in mm/page-writeback.c. A local user can execute arbitrary code.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

86) Use-after-free

EUVDB-ID: #VU94931

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42137

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the qca_serdev_shutdown() function in drivers/bluetooth/hci_qca.c. A local user can escalate privileges on the system.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

87) Use-after-free

EUVDB-ID: #VU90178

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-27043

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the dvb_register_device() function in drivers/media/dvb-core/dvbdev.c. A local user can escalate privileges on the system.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

88) Race condition

EUVDB-ID: #VU91473

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-27030

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition within the rvu_queue_work(), rvu_mbox_intr_handler() and rvu_register_interrupts() functions in drivers/net/ethernet/marvell/octeontx2/af/rvu.c. A local user can escalate privileges on the system.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

89) NULL pointer dereference

EUVDB-ID: #VU94970

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-41098

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the ata_host_release() function in drivers/ata/libata-core.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

90) Buffer overflow

EUVDB-ID: #VU91604

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26884

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error within the htab_map_alloc() function in kernel/bpf/hashtab.c on 32-bit platforms. A local user can trigger memory corruption and execute arbitrary code with elevated privileges.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

91) Use-after-free

EUVDB-ID: #VU90199

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26872

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the srpt_add_one() function in drivers/infiniband/ulp/srpt/ib_srpt.c. A local user can escalate privileges on the system.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

92) NULL pointer dereference

EUVDB-ID: #VU90575

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26874

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the mtk_drm_crtc_finish_page_flip() function in drivers/gpu/drm/mediatek/mtk_drm_crtc.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

93) Use-after-free

EUVDB-ID: #VU90193

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26875

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the pvr2_context_exit() function in drivers/media/usb/pvrusb2/pvrusb2-context.c. A local user can escalate privileges on the system.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

94) Resource management error

EUVDB-ID: #VU93200

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26877

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the zynqmp_handle_aes_req() function in drivers/crypto/xilinx/zynqmp-aes-gcm.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

95) NULL pointer dereference

EUVDB-ID: #VU90574

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26878

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the dquot_mark_dquot_dirty(), __dquot_alloc_space(), dquot_alloc_inode(), EXPORT_SYMBOL(), dquot_claim_space_nodirty(), dquot_reclaim_space_nodirty(), __dquot_free_space(), dquot_free_inode() and __dquot_transfer() functions in fs/quota/dquot.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

96) Resource management error

EUVDB-ID: #VU92988

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26880

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the __dm_internal_suspend() and __dm_internal_resume() functions in drivers/md/dm.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

97) Use of uninitialized resource

EUVDB-ID: #VU90878

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26882

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to use of uninitialized resource within the ip_tunnel_rcv() function in net/ipv4/ip_tunnel.c. A local user can execute arbitrary code.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

98) Buffer overflow

EUVDB-ID: #VU91602

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26883

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error within the stack_map_alloc() function in kernel/bpf/stackmap.c on a 32-bit platform. A local user can trigger memory corruption and execute arbitrary code with elevated privileges.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

99) Buffer overflow

EUVDB-ID: #VU89840

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26885

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error within the dev_map_init_map() function in kernel/bpf/devmap.c. A local user can trigger memory corruption and execute arbitrary code with elevated privileges.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

100) Use of uninitialized resource

EUVDB-ID: #VU90877

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26863

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the hsr_get_node() function in net/hsr/hsr_framereg.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

101) Buffer overflow

EUVDB-ID: #VU91312

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26889

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the hci_get_dev_info() function in net/bluetooth/hci_core.c. A local user can escalate privileges on the system.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

102) Improper locking

EUVDB-ID: #VU91524

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26891

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the devtlb_invalidation_with_pasid() function in drivers/iommu/intel/pasid.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

103) Memory leak

EUVDB-ID: #VU90002

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26894

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the acpi_processor_power_exit() function in drivers/acpi/processor_idle.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

104) Use-after-free

EUVDB-ID: #VU90202

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26895

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the wilc_netdev_cleanup() function in drivers/net/wireless/microchip/wilc1000/netdev.c. A local user can escalate privileges on the system.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

105) NULL pointer dereference

EUVDB-ID: #VU90580

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26897

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the ath9k_wmi_event_tasklet() function in drivers/net/wireless/ath/ath9k/wmi.c, within the ath9k_tx_init() function in drivers/net/wireless/ath/ath9k/htc_drv_txrx.c, within the ath9k_htc_probe_device() function in drivers/net/wireless/ath/ath9k/htc_drv_init.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

106) Use-after-free

EUVDB-ID: #VU90197

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26898

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the tx() function in drivers/block/aoe/aoenet.c, within the aoecmd_cfg_pkts() function in drivers/block/aoe/aoecmd.c. A local user can escalate privileges on the system.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

107) Information disclosure

EUVDB-ID: #VU91363

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26901

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to information disclosure within the do_sys_name_to_handle() function in fs/fhandle.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

108) NULL pointer dereference

EUVDB-ID: #VU92070

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26903

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the rfcomm_process_rx() function in net/bluetooth/rfcomm/core.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

109) Buffer overflow

EUVDB-ID: #VU92006

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26870

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the nfs4_listxattr() function in fs/nfs/nfs4proc.c. A local user can escalate privileges on the system.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

110) Race condition within a thread

EUVDB-ID: #VU91434

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26862

CWE-ID: CWE-366 - Race Condition within a Thread

Exploit availability: No

The vulnerability allows a local user to manipulate data.

The vulnerability exists due to a data race within the packet_setsockopt() and packet_getsockopt() functions in net/packet/af_packet.c, within the dev_queue_xmit_nit() function in net/core/dev.c. A local user can manipulate data.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

111) Improper locking

EUVDB-ID: #VU92037

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26907

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to improper locking within the set_eth_seg() function in drivers/infiniband/hw/mlx5/wr.c. A local user can execute arbitrary code.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

112) Memory leak

EUVDB-ID: #VU90005

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26840

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the kmem_cache_free() and cachefiles_daemon_unbind() functions in fs/cachefiles/bind.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

113) Improper error handling

EUVDB-ID: #VU92058

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26814

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the vfio_fsl_mc_set_irq_trigger() function in drivers/vfio/fsl-mc/vfio_fsl_mc_intr.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

114) Memory leak

EUVDB-ID: #VU91650

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26816

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the print_absolute_relocs() function in arch/x86/tools/relocs.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

115) Integer overflow

EUVDB-ID: #VU88544

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26817

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to integer overflow within the kfd_ioctl_get_process_apertures_new() function in drivers/gpu/drm/amd/amdkfd/kfd_chardev.c. A local user can trigger an integer overflow and execute arbitrary code with elevated privileges.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

116) Resource management error

EUVDB-ID: #VU93775

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26820

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the netvsc_vf_handle_frame(), netvsc_vf_join(), netvsc_prepare_bonding(), netvsc_register_vf(), netvsc_unregister_vf(), netvsc_probe() and netvsc_netdev_event() functions in drivers/net/hyperv/netvsc_drv.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

117) Memory leak

EUVDB-ID: #VU93765

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26825

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the nci_free_device() function in net/nfc/nci/core.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

118) Memory leak

EUVDB-ID: #VU90004

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26833

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the dm_sw_fini() function in drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

119) Resource management error

EUVDB-ID: #VU93772

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26835

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the nf_tables_updtable() function in net/netfilter/nf_tables_api.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

120) Memory leak

EUVDB-ID: #VU90471

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26839

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the init_credit_return() function in drivers/infiniband/hw/hfi1/pio.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

121) Buffer overflow

EUVDB-ID: #VU93404

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26843

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the riscv_enable_runtime_services() function in drivers/firmware/efi/riscv-runtime.c, within the arm_enable_runtime_services() function in drivers/firmware/efi/arm-runtime.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

122) Race condition within a thread

EUVDB-ID: #VU91433

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26861

CWE-ID: CWE-366 - Race Condition within a Thread

Exploit availability: No

The vulnerability allows a local user to manipulate data.

The vulnerability exists due to a data race within the decrypt_packet(), counter_validate() and wg_packet_rx_poll() functions in drivers/net/wireguard/receive.c. A local user can manipulate data.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

123) Improper locking

EUVDB-ID: #VU93388

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26845

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the transport_generic_handle_tmr() function in drivers/target/target_core_transport.c, within the transport_lookup_tmr_lun() and rcu_dereference_raw() functions in drivers/target/target_core_device.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

124) Double free

EUVDB-ID: #VU90896

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26846

CWE-ID: CWE-415 - Double Free

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a double free error within the LIST_HEAD(), nvme_fc_free_lport(), nvme_fc_init_module(), device_destroy() and nvme_fc_delete_controllers() functions in drivers/nvme/host/fc.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

125) Improper locking

EUVDB-ID: #VU91526

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26848

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the afs_dir_iterate_block() function in fs/afs/dir.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

126) Out-of-bounds read

EUVDB-ID: #VU91096

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26851

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the decode_seq() function in net/netfilter/nf_conntrack_h323_asn1.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

127) Use-after-free

EUVDB-ID: #VU90194

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26852

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the ip6_route_multipath_add() and list_for_each_entry_safe() functions in net/ipv6/route.c. A local user can escalate privileges on the system.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

128) NULL pointer dereference

EUVDB-ID: #VU90576

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26855

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the ice_bridge_setlink() function in drivers/net/ethernet/intel/ice/ice_main.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

129) Use of uninitialized resource

EUVDB-ID: #VU90876

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26857

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the geneve_rx() function in drivers/net/geneve.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

130) NULL pointer dereference

EUVDB-ID: #VU90573

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26859

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

131) Improper error handling

EUVDB-ID: #VU92944

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26906

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the copy_from_kernel_nofault_allowed() function in arch/x86/mm/maccess.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

132) Race condition

EUVDB-ID: #VU91476

Risk: Low

CVSSv4.0: 1.9 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26910

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a race condition within the list_set_destroy() and list_set_same_set() functions in net/netfilter/ipset/ip_set_list_set.c, within the ip_set_destroy_set(), ip_set_destroy(), ip_set_swap() and ip_set_fini() functions in net/netfilter/ipset/ip_set_core.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

133) NULL pointer dereference

EUVDB-ID: #VU90555

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-27028

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the mtk_spi_interrupt() function in drivers/spi/spi-mt65xx.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

134) Input validation error

EUVDB-ID: #VU93871

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26997

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input within the dwc2_cmpl_host_isoc_dma_desc() function in drivers/usb/dwc2/hcd_ddma.c in DDMA completion flow. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

SmartFabric Storage Software: 1.4.0 - 1.4.2

• cpe:2.3:h:dell:smartfabric_storage_software:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:h:dell:smartfabric_storage_software:1.4.2:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/nl-nl/000270413/dsa-2025-032-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

135) Use-after-free

EUVDB-ID: #VU90185

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26974

CWE-ID: CWE-416 - Use After Free

Exploit availability: No