rhev hypervisor Schwachstellen (CVE)

7.1Hoch

CVE-2023-3758 vor 2 Jahren

Sssd: race condition during authorization leads to gpo policies functioning inconsistently

sssd; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support; Red Hat Red Hat Enterprise Linux 8.8 Extended Update Support

A race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated users. This may lead to improper authorization issues, granting or denying access to resources inappropriately.

1.0%EPSS

6.5Mittel

CVE-2023-6536 vor 2 Jahren

Kernel: null pointer dereference in __nvmet_req_complete

Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support; Red Hat Red Hat Enterprise Linux 8.8 Extended Update Support; Red Hat Red Hat Enterprise Linux 9

A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to a NULL pointer dereference in the NVMe driver, causing kerne…

1.5%EPSS

6.5Mittel

CVE-2023-6535 vor 2 Jahren

Kernel: null pointer dereference in nvmet_tcp_execute_request

Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support; Red Hat Red Hat Enterprise Linux 8.8 Extended Update Support; Red Hat Red Hat Enterprise Linux 9

A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to a NULL pointer dereference in the NVMe driver, causing kerne…

1.5%EPSS

6.5Mittel

CVE-2023-6356 vor 2 Jahren

Kernel: null pointer dereference in nvmet_tcp_build_iovec

Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support; Red Hat Red Hat Enterprise Linux 8.8 Extended Update Support; Red Hat Red Hat Enterprise Linux 9

A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to a NULL pointer dereference in the NVMe driver and causing ke…

1.5%EPSS

7.0Hoch

CVE-2024-0646 vor 2 Jahren

Kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as destination

kernel; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support; Red Hat Red Hat Enterprise Linux 8.2 Telecommunications Update Service

An out-of-bounds memory write flaw was found in the Linux kernel’s Transport Layer Security functionality in how a user calls a function splice with a ktls socket as the destination. This flaw allows a local user to crash or potentially escalate their privile…

6.8Mittel

CVE-2024-0565 vor 2 Jahren

Kernel: cifs filesystem decryption improper input validation remote code execution vulnerability in function receive_encrypted_standard of client

Linux kernel; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support; Red Hat Red Hat Enterprise Linux 8.8 Extended Update Support

An out-of-bounds memory read flaw was found in receive_encrypted_standard in fs/smb/client/smb2ops.c in the SMB Client sub-component in the Linux Kernel. This issue occurs due to integer underflow on the memcpy length, leading to a denial of service.

2.0%EPSS

7.8Hoch

CVE-2024-0562 vor 2 Jahren

Kernel: use-after-free after removing device in wb_inode_writeback_end in mm/page-writeback.c

kernel; Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support; Red Hat Red Hat Virtualization 4 for Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 6

A use-after-free flaw was found in the Linux Kernel. When a disk is removed, bdi_unregister is called to stop further write-back and waits for associated delayed work to complete. However, wb_inode_writeback_end() may schedule bandwidth estimation work after …

5.5Mittel

CVE-2023-7192 vor 2 Jahren

Kernel: refcount leak in ctnetlink_create_conntrack()

Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support; Red Hat Red Hat Enterprise Linux 8.2 Telecommunications Update Service; Red Hat Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions; Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support

A memory leak problem was found in ctnetlink_create_conntrack in net/netfilter/nf_conntrack_netlink.c in the Linux Kernel. This issue may allow a local attacker with CAP_NET_ADMIN privileges to cause a denial of service (DoS) attack due to a refcount overflow.

7.0Hoch

CVE-2023-6546 vor 2 Jahren

Kernel: gsm multiplexing race condition leads to privilege escalation

Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support; Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support; Red Hat Red Hat Enterprise Linux 8.4 Telecommunications Update Service

A race condition was found in the GSM 0710 tty multiplexor in the Linux kernel. This issue occurs when two threads execute the GSMIOC_SETCONF ioctl on the same tty file descriptor with the gsm line discipline enabled, and can lead to a use-after-free problem …

7.1Hoch

CVE-2023-6610 vor 2 Jahren

Kernel: oob access in smb2_dump_detail

Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support; Red Hat Red Hat Enterprise Linux 8.8 Extended Update Support; Red Hat Red Hat Enterprise Linux 9

An out-of-bounds read vulnerability was found in smb2_dump_detail in fs/smb/client/smb2ops.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.

7.1Hoch

CVE-2023-6606 vor 2 Jahren

Kernel: out-of-bounds read vulnerability in smbcalcsize

Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support; Red Hat Red Hat Enterprise Linux 8.8 Extended Update Support; Red Hat Red Hat Enterprise Linux 9

An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.

6.5Mittel

CVE-2023-42669 vor 3 Jahren

Samba: "rpcecho" development server allows denial of service via sleep() call on ad dc

samba; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support; Red Hat Red Hat Enterprise Linux 8.8 Extended Update Support

A vulnerability was found in Samba's "rpcecho" development server, a non-Windows RPC server used to test Samba's DCE/RPC stack elements. This vulnerability stems from an RPC function that can be blocked indefinitely. The issue arises because the "rpcecho" ser…

1.9%EPSS

9.1Kritisch

CVE-2023-3961 vor 3 Jahren

Samba: smbd allows client access to unix domain sockets on the file system as root

Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support; Red Hat Red Hat Enterprise Linux 8.8 Extended Update Support; Red Hat Red Hat Enterprise Linux 9

A path traversal vulnerability was identified in Samba when processing client pipe names connecting to Unix domain sockets within a private directory. Samba typically uses this mechanism to connect SMB clients to remote procedure call (RPC) services like SAMR…

2.7%EPSS

6.5Mittel

CVE-2023-4091 vor 3 Jahren

Samba: smb clients can truncate files with read-only permissions

Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support; Red Hat Red Hat Enterprise Linux 8.8 Extended Update Support; Red Hat Red Hat Enterprise Linux 9

A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with read-only permissions when the Samba VFS module "acl_xattr" is configured with "acl_xattr:ignore system acls = yes". The SMB protocol allows opening files …

1.3%EPSS

8.8Hoch

CVE-2023-5178 vor 3 Jahren

Kernel: use after free in nvmet_tcp_free_crypto in nvme

Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support; Red Hat Red Hat Enterprise Linux 8.2 Telecommunications Update Service; Red Hat Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions

A use-after-free vulnerability was found in drivers/nvme/target/tcp.c` in `nvmet_tcp_free_crypto` due to a logical bug in the NVMe/TCP subsystem in the Linux kernel. This issue may allow a malicious user to cause a use-after-free and double-free problem, whic…

10%EPSS

7.8Hoch

CVE-2023-4911 KEV vor 3 Jahren

Glibc: buffer overflow in ld.so leading to privilege escalation

glibc; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support; Red Hat Red Hat Enterprise Linux 9

A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binar…

64%EPSS

4.7Mittel

CVE-2023-4732 vor 3 Jahren

Kernel: race between task migrating pages and another task calling exit_mmap to release those same pages getting invalid opcode bug in include/linux/swapops.h

Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support; Red Hat Red Hat Enterprise Linux 8.8 Extended Update Support; Red Hat Red Hat Virtualization 4 for Red Hat Enterprise Linux 8

A flaw was found in pfn_swap_entry_to_page in memory management subsystem in the Linux Kernel. In this flaw, an attacker with a local user privilege may cause a denial of service problem due to a BUG statement referencing pmd_t x.

7.0Hoch

CVE-2023-42753 vor 3 Jahren

Kernel: netfilter: potential slab-out-of-bound access due to integer underflow

Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 7.7 Advanced Update Support; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support

An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro could lead to a miscalculation of the `h->nets` array offset, providing attackers with the primitive to arbitrarily increment/decrement a memory buffer o…

5.9Mittel

CVE-2023-4806 vor 3 Jahren

Glibc: potential use-after-free in getaddrinfo()

Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support; Red Hat Red Hat Enterprise Linux 9; Red Hat Red Hat Virtualization 4 for Red Hat Enterprise Linux 8

A flaw has been identified in glibc. In an extremely rare situation, the getaddrinfo function may access memory that has been freed, resulting in an application crash. This issue is only exploitable when a NSS module implements only the _nss_*_gethostbyname2_…

1.6%EPSS

5.9Mittel

CVE-2023-4813 vor 3 Jahren

Glibc: potential use-after-free in gaih_inet()

Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support; Red Hat Red Hat Enterprise Linux 9; Red Hat Red Hat Virtualization 4 for Red Hat Enterprise Linux 8

A flaw has been identified in glibc. In an uncommon situation, the gaih_inet function may use memory that has been freed, resulting in an application crash. This issue is only exploitable when the getaddrinfo function is called and the hosts database in /etc/…

1.9%EPSS

5.5Mittel

CVE-2023-4459 vor 3 Jahren

Kernel: vmxnet3: null pointer dereference in vmxnet3_rq_cleanup()

Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support; Red Hat Red Hat Enterprise Linux 8.2 Telecommunications Update Service; Red Hat Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions; Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support

A NULL pointer dereference flaw was found in vmxnet3_rq_cleanup in drivers/net/vmxnet3/vmxnet3_drv.c in the networking sub-component in vmxnet3 in the Linux Kernel. This issue may allow a local attacker with normal user privilege to cause a denial of service …

5.5Mittel

CVE-2023-4132 vor 3 Jahren

Kernel: smsusb: use-after-free caused by do_submit_urb()

Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support; Red Hat Red Hat Enterprise Linux 8.8 Extended Update Support; Red Hat Red Hat Virtualization 4 for Red Hat Enterprise Linux 8

A use-after-free vulnerability was found in the siano smsusb module in the Linux kernel. The bug occurs during device initialization when the siano device is plugged in. This flaw allows a local user to crash the system, causing a denial of service condition.

7.8Hoch

CVE-2023-4004 vor 3 Jahren

Kernel: netfilter: use-after-free due to improper element removal in nft_pipapo_remove()

Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support; Red Hat Red Hat Enterprise Linux 8.2 Telecommunications Update Service; Red Hat Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions

A use-after-free flaw was found in the Linux kernel's netfilter in the way a user triggers the nft_pipapo_remove function with the element, without a NFT_SET_EXT_KEY_END. This issue could allow a local user to crash the system or potentially escalate their pr…

5.5Mittel

CVE-2023-3772 vor 3 Jahren

Kernel: xfrm: null pointer dereference in xfrm_update_ae_params()

Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support; Red Hat Red Hat Enterprise Linux 8.8 Extended Update Support; Red Hat Red Hat Enterprise Linux 9

A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer in xfrm_update_ae_params(), leading to a possible kernel …

7.8Hoch

CVE-2023-3812 vor 3 Jahren

Kernel: tun: bugs for oversize packet when napi frags enabled in tun_napi_alloc_frags

Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions; Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support; Red Hat Red Hat Enterprise Linux 8.2 Telecommunications Update Service

An out-of-bounds memory access flaw was found in the Linux kernel’s TUN/TAP device driver functionality in how a user generates a malicious (too big) networking packet when napi frags is enabled. This flaw allows a local user to crash or potentially escalate …