Security bulletins and fixes

Stay informed about known security vulnerabilities and fixes for IBM Cloud Pak® for AIOps by subscribing to the security bulletins and by reviewing the list of fixed security-related vulnerabilities.

Security bulletins

Subscribe to IBM Cloud Pak for AIOps notifications by following these steps:

  1. Go to the IBM Support site Opens in a new tab.

  2. Scroll to the Support basics section. Then, click the Notification settings card.

  3. Log in to IBM with your IBM ID and password to continue.

  4. Enter IBM Cloud Pak for AIOps in the Product lookup field. Click Subscribe.

  5. In the Select document types page, select Security bulletin and Fixes > Security Vulnerability (Sec/Int). You can also select any other document types that you need to keep informed about.

  6. Click Submit.

  7. To configure how you receive notifications, click Delivery preferences in the banner at the beginning of the page. Edit your settings as needed.

Fixed security-related vulnerabilities in version 4.6.1

Review the following tables, which lists the fixed reported security-related vulnerabilities with IBM Cloud Pak for AIOps, and any included IBM or third-party software.

Table. Fixed Common Vulnerabilities and Exposures in Version 4.6.1
CVE-ID Issue Description
CVE-2020-26555 Opens in a new tab Bluetooth Core and Mesh Specifications security bypass Bluetooth Core and Mesh Specifications could allow a remote attacker to bypass security restrictions, caused by an impersonation in the BR/EDR PIN Pairing procedure flaw. By spoofing the Bluetooth Device Address (BD_ADDR) of the device, an attacker could exploit this vulnerability to complete pairing with a known link key, encrypt communications with the vulnerable device, and access any profiles permitted.
CVE-2021-46909 Opens in a new tab Linux Kernel denial of service Linux Kernel is vulnerable to a denial of service, caused by an oops when a PCI driver is loaded or bound after the kernel has initialized. By sending a specially crafted request, a local attacker could exploit this vulnerability to cause a denial of service condition.
CVE-2021-46972 Opens in a new tab Linux Kernel denial of service Linux Kernel is vulnerable to a denial of service, caused by a resource leak flaw. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition.
CVE-2021-47069 Opens in a new tab Linux Kernel denial of service Linux Kernel is vulnerable to a denial of service, caused by a race conduction in a do_mq_timedreceive call. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition.
CVE-2021-47073 Opens in a new tab Linux Kernel denial of service Linux Kernel is vulnerable to a denial of service, caused by a oops flaw on rmmod dell_smbios. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition.
CVE-2021-47236 Opens in a new tab Linux Kernel denial of service Linux Kernel is vulnerable to a denial of service, caused by an error related to tx fixup skb leak. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
CVE-2021-47310 Opens in a new tab Linux Kernel denial of service Linux Kernel is vulnerable to a denial of service, caused by a use-after-free in tlan_remove_one. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
CVE-2021-47311 Opens in a new tab Linux Kernel denial of service Linux Kernel is vulnerable to a denial of service, caused by a use-after-free in emac_remove. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
CVE-2021-47353 Opens in a new tab Linux Kernel denial of service Linux Kernel is vulnerable to a denial of service, caused by a NULL pointer dereference in udf_symlink function. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
CVE-2021-47356 Opens in a new tab Linux Kernel code execution Linux Kernel could allow a local authenticated attacker execute arbitrary code on the system, caused by a use-after-free in HFC_cleanup(). By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVE-2021-47456 Opens in a new tab Linux Kernel denial of service Linux Kernel is vulnerable to a denial of service, caused by a use-after-free in peak_pci: peak_pci_remove(). By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
CVE-2021-47495 Opens in a new tab Linux Kernel denial of service Linux Kernel is vulnerable to a denial of service, caused by the lack of a sanity check for maxpacket. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
CVE-2023-5090 Opens in a new tab Linux Kernel denial of service Linux Kernel is vulnerable to a denial of service, caused by improper check in the svm_set_x2apic_msr_interception() function in KVM. By sending a specially crafted request, a local authetnicated attacker could exploit this vulnerability to cause a denial of service condition.
CVE-2023-25613 Opens in a new tab Apache Kerby LDAP injection Apache Kerby could allow a remote attacker to conduct an LDAP injection, caused by a flaw in LdapIdentityBackend. By sending a request with a specially-crafted request, an attacker could exploit this vulnerability to inject unsanitized content into the LDAP filter.
CVE-2023-52464 Opens in a new tab Linux Kernel denial of service Linux Kernel is vulnerable to a denial of service, caused by an out-of-bounds string access. A local attacker could exploit this vulnerability to cause a denial of service.
CVE-2023-52560 Opens in a new tab Linux Kernel denial of service Linux Kernel is vulnerable to a denial of service, caused by a memory leak in damon_do_test_apply_three_regions(). By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
CVE-2023-52615 Opens in a new tab Linux Kernel denial of service Linux Kernel is vulnerable to a denial of service, caused by an error related to page fault dead lock on mmap-ed hwrng. A local authenticated attacker could exploit this vulnerability to cause a denial of service.
CVE-2023-52626 Opens in a new tab Linux Kernel denial of service Linux Kernel is vulnerable to a denial of service, caused by an out-of-bounds read in port timestamping napi_poll context. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to obtain sensitive information or cause a denial of service.
CVE-2023-52667 Opens in a new tab Linux Kernel denial of service Linux Kernel is vulnerable to a denial of service, caused by a double-free in fs_any_create_groups. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
CVE-2023-52669 Opens in a new tab Linux Kernel denial of service Linux Kernel is vulnerable to a denial of service, caused by a buffer overread in CTR mode. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
CVE-2023-52675 Opens in a new tab Linux Kernel denial of service Linux Kernel is vulnerable to a denial of service, caused by the lack of a null pointer check in update_events_in_group(). By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
CVE-2023-52686 Opens in a new tab Linux Kernel denial of service Linux Kernel is vulnerable to a denial of service, caused by the lack of a null pointer check in opal_event_init(). By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
CVE-2023-52700 Opens in a new tab Linux Kernel denial of service Linux Kernel is vulnerable to a denial of service, caused by a kernel warning when sending SYN message. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
CVE-2023-52703 Opens in a new tab Linux Kernel denial of service Linux Kernel is vulnerable to a denial of service, caused by an error related to act_len in usb_bulk_msg error path. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
CVE-2023-52781 Opens in a new tab Linux Kernel denial of service Linux Kernel is vulnerable to a denial of service, caused by an iteration issue in 'usb_get_bos_descriptor()'. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
CVE-2023-52813 Opens in a new tab Linux Kernel denial of service Linux Kernel is vulnerable to a denial of service, caused by an error related to hungtask for PADATA_RESET. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
CVE-2023-52835 Opens in a new tab Linux Kernel denial of service Linux Kernel is vulnerable to a denial of service, caused by an out-of-bounds read. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
CVE-2023-52877 Opens in a new tab Linux Kernel denial of service Linux Kernel is vulnerable to a denial of service, caused by a NULL pointer dereference in tcpm_pd_svdm(). A local authenticated attacker could exploit this vulnerability to cause a denial of service.
CVE-2023-52878 Opens in a new tab Linux Kernel denial of service Linux Kernel is vulnerable to a denial of service, caused by an error related can_put_echo_skb(): don't crash kernel if can_priv::echo_skb is accessed out of bounds. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
CVE-2023-52881 Opens in a new tab Linux Kernel denial of service Linux Kernel is vulnerable to a denial of service, caused by the failure to accept ACK of bytes we never sent. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
CVE-2024-6387 Opens in a new tab FastAPI denial of service FastAPI is vulnerable to a denial of service, caused by a regular expression denial of service (ReDoS) flaw in the Content-Type header. By sending a specially crafted regex input, a remote attacker could exploit this vulnerability to consume CPU resources and stall indefinitely.
CVE-2024-6409 Opens in a new tab OpenSSH code execution OpenSSH could allow a remote attacker to execute arbitrary code on the system, caused by a race condition in the grace_alarm_handler() function, which improperly calls cleanup_exit() from within a signal handler. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVE-2024-24762 Opens in a new tab OpenSSH code execution OpenSSH could allow a remote attacker to execute arbitrary code on the system, caused by a signal handler race condition. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code with root privileges on glibc-based Linux systems.
CVE-2024-26130 Opens in a new tab cryptography denial of service cryptography is vulnerable to a denial of service, caused by a NULL pointer dereference in the pkcs12.serialize_key_and_certificates process. By sending a specially crafted request, a remote attacker could exploit this vulnerability to cause a denial of service.
CVE-2024-26583 Opens in a new tab Linux Kernel denial of service Linux Kernel is vulnerable to a denial of service, caused by a race condition in the tls subsystem. By sending a specially crafted request, a local attacker could exploit this vulnerability to cause a denial of service condition.
CVE-2024-26584 Opens in a new tab Linux Kernel denial of service Linux Kernel is vulnerable to a denial of service, caused by a flaw when setting the CRYPTO_TFM_REQ_MAY_BACKLOG flag on requests to the crypto API in the tls subsystem. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition.
CVE-2024-26585 Opens in a new tab Linux Kernel denial of service Linux Kernel is vulnerable to a denial of service, caused by a race condition when submitting thread in the tls subsystem. By sending a specially crafted request, a local attacker could exploit this vulnerability to cause a denial of service condition.
CVE-2024-26656 Opens in a new tab Linux Kernel denial of service Linux Kernel is vulnerable to a denial of service, caused by a use-after-free error. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
CVE-2024-26675 Opens in a new tab Linux Kernel denial of service Linux Kernel is vulnerable to a denial of service, caused by an error related to ppp_async: limit MRU to 64K. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
CVE-2024-26735 Opens in a new tab Linux Kernel denial of service Linux Kernel is vulnerable to a denial of service, caused by a use-after-free and NULL pointer dereference. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
CVE-2024-26759 Opens in a new tab Linux Kernel denial of service Linux Kernel is vulnerable to a denial of service, caused by a race condition when skipping swapcache. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
CVE-2024-26801 Opens in a new tab Linux Kernel denial of service Linux Kernel is vulnerable to a denial of service, caused by a use-after-free in hci_error_reset. A local authenticated attacker could exploit this vulnerability to cause a denial of service.
CVE-2024-26804 Opens in a new tab Linux Kernel denial of service Linux Kernel is vulnerable to a denial of service, caused by the failure to prevent perpetual headroom growth. A local authenticated attacker could exploit this vulnerability to cause a denial of service.
CVE-2024-26826 Opens in a new tab Linux Kernel denial of service Linux Kernel is vulnerable to a denial of service, caused by an error related to data re-injection from stale subflow. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
CVE-2024-26859 Opens in a new tab Linux Kernel denial of service Linux Kernel is vulnerable to a denial of service, caused by a race condition during EEH error handling. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
CVE-2024-26906 Opens in a new tab Linux Kernel denial of service Linux Kernel is vulnerable to a denial of service, caused by an error related to vsyscall page read for copy_from_kernel_nofault(). By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
CVE-2024-26907 Opens in a new tab Linux Kernel privilege escalation Linux Kernel could allow a local authenticated attacker to gain elevated privileges on the system, caused by an error related to fortifying source warning while accessing Eth segment. An attacker could exploit this vulnerability to gain elevated privileges on the system.
CVE-2024-26974 Opens in a new tab Linux Kernel denial of service Linux Kernel is vulnerable to a denial of service, caused by a race condition during AER recovery. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
CVE-2024-26982 Opens in a new tab Linux Kernel denial of service Linux Kernel is vulnerable to a denial of service, caused by an error related to checking the inode number is not the invalid value of zero. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
CVE-2024-27397 Opens in a new tab Linux Kernel privilege escalation Linux Kernel could allow a local authenticated attacker to gain elevated privileges on the system, caused by a use-after-free flaw in the netfilter subsystem. By sending a specially crafted request, an authenticated attacker could exploit this vulnerability to gain elevated privileges or cause the system to crash.
CVE-2024-27410 Opens in a new tab Linux Kernel denial of service Linux Kernel is vulnerable to a denial of service, caused by a flaw when change the mesh ID and change interface to mesh mode at the same time in the WiFi module. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition.
CVE-2024-32002 Opens in a new tab Microsoft Visual Studio code execution MinGit software which is consumed by Microsoft Visual Studio could allow a remote attacker to execute arbitrary code on the system, caused by a path traversal vulnerability. By persuading a victim to open a specially crafted content, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVE-2024-32004 Opens in a new tab Microsoft Visual Studio code execution MinGit software which is consumed by Microsoft Visual Studio could allow a remote attacker to execute arbitrary code on the system, caused by a path traversal vulnerability. By persuading a victim to open a specially crafted content, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVE-2024-32020 Opens in a new tab Git security bypass Git could allow a local authenticated attacker to bypass security restrictions, caused by a flaw when cloning local repository. By sending a specially crafted request, an attacker could exploit this vulnerability to modify objects in the cloned repository.
CVE-2024-32021 Opens in a new tab Git security bypass Git could allow a local authenticated attacker to bypass security restrictions, caused by a flaw when cloning local repository. By sending a specially crafted request, an attacker could exploit this vulnerability to hardlink arbitrary user-readable files into the new repository's "objects/" directory.
CVE-2024-32465 Opens in a new tab Git security bypass Git could allow a physical attacker to bypass security restrictions, caused by a directory traversal flaw. By sending a specially crafted request, an attacker could exploit this vulnerability to bypass protections for cloning untrusted repositories.
CVE-2024-35235 Opens in a new tab OpenPrinting CUPS privilege escalation OpenPrinting CUPS could allow a local authenticated attacker to gain elevated privileges on the system, caused by a flaw when starting the cupsd server with a Listen configuration item pointing to a symbolic link. An authenticated attacker could exploit this vulnerability to change permission of any user or system files to be world writable and execute arbitrary commands.
CVE-2024-35789 Opens in a new tab Linux Kernel denial of service Linux Kernel is vulnerable to a denial of service, caused by a use-after-free flaw when moving a station out of a VLAN and deleting the VLAN afterwards. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition.
CVE-2024-35835 Opens in a new tab Linux Kernel denial of service Linux Kernel is vulnerable to a denial of service, caused by a double free flaw in arfs_create_groups. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition.
CVE-2024-35838 Opens in a new tab Linux Kernel denial of service Linux Kernel is vulnerable to a denial of service, caused by a sta-link leak due to removing the station without ever marking links valid in the WiFI module. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition.
CVE-2024-35845 Opens in a new tab Linux Kernel denial of service Linux Kernel is vulnerable to a denial of service, caused by not terminate the string in iwl_fw_ini_debug_info_tlv. By sending a specially crafted request, a remote attacker could exploit this vulnerability to cause a denial of service condition.
CVE-2024-35852 Opens in a new tab Linux Kernel denial of service Linux Kernel is vulnerable to a denial of service, caused by a memory leak when canceling rehash work. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
CVE-2024-35853 Opens in a new tab Linux Kernel denial of service Linux Kernel is vulnerable to a denial of service, caused by a memory leak during rehash. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
CVE-2024-35854 Opens in a new tab Linux Kernel denial of service Linux Kernel is vulnerable to a denial of service, caused by a use-after-free during rehash. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
CVE-2024-35855 Opens in a new tab Linux Kernel denial of service Linux Kernel is vulnerable to a denial of service, caused by a use-after-free during activity update. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
CVE-2024-35888 Opens in a new tab Linux Kernel denial of service Linux Kernel is vulnerable to a denial of service, caused by not making sure erspan_base_hdr is present in skb linear part by the ip6erspan_rcv() function. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition.
CVE-2024-35890 Opens in a new tab Linux Kernel denial of service Linux Kernel is vulnerable to a denial of service, caused by a ownership transfer issue if packets are GROed with fraglist. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition.
CVE-2024-35958 Opens in a new tab Linux Kernel denial of service Linux Kernel is vulnerable to a denial of service, caused by an incorrect descriptor free behavior. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition.
CVE-2024-35959 Opens in a new tab Linux Kernel denial of service Linux Kernel is vulnerable to a denial of service, caused by a flaw in the mlx5e_priv_init() cleanup flow. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition.
CVE-2024-35960 Opens in a new tab Linux Kernel denial of service Linux Kernel is vulnerable to a denial of service, caused by incorrectly referencing a just-added rule in the same flow handle. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition.
CVE-2024-36004 Opens in a new tab Linux Kernel denial of service Linux Kernel is vulnerable to a denial of service, caused by the use WQ_MEM_RECLAIM flag for workqueue. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
CVE-2024-36007 Opens in a new tab Linux Kernel denial of service Linux Kernel is vulnerable to a denial of service, caused by an error related to mlxsw: spectrum_acl_tcam. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
CVE-2024-36114 Opens in a new tab airlift aircompressor information disclosure airlift aircompressor could allow a local attacker to obtain sensitive information, caused by an out-of-bounds read/write flaw in the decompressor implementations. By sending a specially crafted request, an attacker could exploit this vulnerability to obtain sensitive information and crash the JVM.
CVE-2024-39936 Opens in a new tab Qt information disclosure Qt could allow a remote attacker to obtain sensitive information, caused by an error in HTTP2. By sending multiple requests in-between the encrypted() signal and the abort() call, an attacker could exploit this vulnerability to obtain sensitive information.

Fixed security-related vulnerabilities in previous versions

Review the following documentation, which includes the list of fixed reported security-related vulnerabilities in previous versions of IBM Cloud Pak for AIOps: