CVE-2024-36960

HIGH

Linux Kernel < 4.19.314 - Out-of-Bounds Read

Title source: rule
STIX 2.1

Description

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix invalid reads in fence signaled events Correctly set the length of the drm_event to the size of the structure that's actually used. The length of the drm_event was set to the parent structure instead of to the drm_vmw_event_fence which is supposed to be read. drm_read uses the length parameter to copy the event to the user space thus resuling in oob reads.

References (10)

Core 10
Core References

Scores

CVSS v3 7.1
EPSS 0.0001
EPSS Percentile 2.3%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-125
Status published
Products (10)
debian/debian_linux 10.0
linux/Kernel 3.4.0 - 4.19.314linux
linux/Kernel 4.20.0 - 5.4.276linux
linux/Kernel 5.11.0 - 5.15.159linux
linux/Kernel 5.16.0 - 6.1.91linux
linux/Kernel 5.5.0 - 5.10.217linux
linux/Kernel 6.2.0 - 6.6.31linux
linux/Kernel 6.7.0 - 6.8.10linux
linux/linux_kernel 6.9 rc1 (6 CPE variants)
linux/linux_kernel 3.4 - 4.19.314
Published Jun 03, 2024
Tracked Since Feb 18, 2026