Improper Input Validation Affecting kernel-rt-kvm package, versions <0:4.18.0-553.22.1.rt7.363.el8_10
Threat Intelligence
EPSS
0.04% (6th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-CENTOS8-KERNELRTKVM-7600976
- published 5 Aug 2024
- disclosed 29 Jul 2024
Introduced: 29 Jul 2024
CVE-2024-41060 Open this link in a new tabHow to fix?
Upgrade Centos:8 kernel-rt-kvm to version 0:4.18.0-553.22.1.rt7.363.el8_10 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream kernel-rt-kvm package and not the kernel-rt-kvm package as distributed by Centos.
See How to fix? for Centos:8 relevant fixed versions and status.
In the Linux kernel, the following vulnerability has been resolved:
drm/radeon: check bo_va->bo is non-NULL before using it
The call to radeon_vm_clear_freed might clear bo_va->bo, so we have to check it before dereferencing it.
References
- https://access.redhat.com/security/cve/CVE-2024-41060
- https://git.kernel.org/stable/c/6fb15dcbcf4f212930350eaee174bb60ed40a536
- https://git.kernel.org/stable/c/8a500b3a5f0a58c6f99039091fbd715f64f2f8af
- https://git.kernel.org/stable/c/a2b201f83971df03c8e81a480b2f2846ae8ce1a3
- https://git.kernel.org/stable/c/a9100f17428cb733c4f6fbb132d98bed76318342
- https://git.kernel.org/stable/c/f13c96e0e325a057c03f8a47734adb360e112efe
CVSS Scores
version 3.1