INFSA-2024:7481: linux-firmware security update
Information about definition
Identificator: INFSA-2024:7481
Type: security
Release date: 2024-10-10 10:45:09 UTC
Information about package
The linux-firmware packages contain all of the firmware files that are required by various devices to operate.
Vulnerabilities description
- CVE-2023-20584
IOMMU improperly handles certain special address ranges with invalid device table entries (DTEs), which may allow an attacker with privileges and a compromised Hypervisor to induce DTE faults to bypass RMP checks in SEV-SNP, potentially leading to a loss of guest integrity.
- CVE-2023-31356
Incomplete system memory cleanup in SEV firmware could allow a privileged attacker to corrupt guest private memory, potentially resulting in a loss of data integrity.
Severity level
| CVE | Score CVSS 2.0 | Score CVSS 3.x | Score CVSS 4.0 |
|---|---|---|---|
|
NIST — CVE-2023-20584
|
no information | 5.3 | no information |
|
NIST — CVE-2023-31356
|
no information | 4.4 | no information |
Updated packages