Security Bulletin
Summary
IBM Storage Copy Data Management can be affected by vulnerabilities in Linux Kernel. Vulnerabilities include an authenticated or local attacker or local authenticated attacker could exploit these vulnerabilities to execute arbitrary code on the system, to cause a denial of service condition, to obtain sensitive information or crash the system as described by the CVEs in the "Vulnerability Details" section.
Vulnerability Details
CVEID: CVE-2021-47289
DESCRIPTION: Linux Kernel is vulnerable to a denial of service, caused by a null pointer dereference in ACPI. A local authenticated attacker could exploit this vulnerability to cause a denial of service.
CWE: CWE-476: NULL Pointer Dereference
CVSS Source: IBM X-Force
CVSS Base score: 5.5
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVEID: CVE-2024-40998
DESCRIPTION: Linux Kernel is vulnerable to a denial of service, caused by uninitialized Ratelimit_state->Lock Access in __ext4_fill_super(). By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
CWE: CWE-1287: Improper Validation of Specified Type of Input
CVSS Source: IBM X-Force
CVSS Base score: 5.5
CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVEID: CVE-2024-26645
DESCRIPTION: Linux Kernel is vulnerable to a denial of service, caused by the lack of visibility when inserting an element into tracing_map. A local authenticated attacker could exploit this vulnerability to cause a denial of service.
CWE: CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSS Source: IBM X-Force
CVSS Base score: 4.4
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
CVEID: CVE-2024-42225
DESCRIPTION: Linux Kernel could allow a remote attacker to execute arbitrary code on the system, caused by reusing uninitialized data in 'wifi: mt76'. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system or cause a denial of service condition.
CWE: CWE-908: Use of Uninitialized Resource
CVSS Source: IBM X-Force
CVSS Base score: 8.1
CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVEID: CVE-2024-26649
DESCRIPTION: Linux Kernel is vulnerable to a denial of service, caused by a NULL pointer dereference when load rlc firmware. A local authenticated attacker could exploit this vulnerability to cause a denial of service.
CWE: CWE-476: NULL Pointer Dereference
CVSS Source: IBM X-Force
CVSS Base score: 4.4
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
CVEID: CVE-2024-40901
DESCRIPTION: Linux Kernel is vulnerable to a denial of service, caused by out-of-bounds access when using test_bit() in mpt3sas_base.c. A local authenticated attacker could exploit this vulnerability to cause a denial of service.
CWE: CWE-121: Stack-based Buffer Overflow
CVSS Source: IBM X-Force
CVSS Base score: 5.5
CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVEID: CVE-2024-42228
DESCRIPTION: Linux Kernel could allow a local authenticated attacker to execute arbitrary code on the system, caused by reusing uninitialized data when calling amdgpu_vce_cs_reloc in drm/amdgpu. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system or or cause a denial of service condition..
CWE: CWE-908: Use of Uninitialized Resource
CVSS Source: IBM X-Force
CVSS Base score: 7
CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVEID: CVE-2024-26717
DESCRIPTION: Linux Kernel is vulnerable to a denial of service, caused by a NULL pointer dereference flaw in the i2c-hid-of of HID. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition.
CWE: CWE-476: NULL Pointer Dereference
CVSS Source: IBM X-Force
CVSS Base score: 4.4
CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
CVEID: CVE-2023-52470
DESCRIPTION: Linux Kernel is vulnerable to a denial of service, caused by a NULL pointer dereference in radeon_crtc_init(). A local attacker could exploit this vulnerability to cause a denial of service.
CWE: CWE-476: NULL Pointer Dereference
CVSS Source: IBM X-Force
CVSS Base score: 6.2
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVEID: CVE-2023-52476
DESCRIPTION: Linux Kernel is vulnerable to a denial of service, caused by a panic can occur when a vsyscall is made while LBR sampling is active. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition.
CWE: CWE-404: Improper Resource Shutdown or Release
CVSS Source: IBM X-Force
CVSS Base score: 5.5
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVEID: CVE-2024-42090
DESCRIPTION: Linux Kernel is vulnerable to a denial of service, caused by deadlock in create_pinctrl() when handling -EPROBE_DEFER. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
CWE: CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSS Source: IBM X-Force
CVSS Base score: 6.2
CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVEID: CVE-2021-47321
DESCRIPTION: Linux Kernel is vulnerable to a denial of service, caused by a use-after-free in calling del_timer_sync() of watchdog. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition.
CWE: CWE-416: Use After Free
CVSS Source: IBM X-Force
CVSS Base score: 4.4
CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
CVEID: CVE-2024-42237
DESCRIPTION: Linux Kernel is vulnerable to a denial of service, caused by improperly validating payload length in cs_dsp_load() and cs_dsp_coeff_load(). By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition.
CVSS Source: IBM X-Force
CVSS Base score: 5.5
CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVEID: CVE-2023-52478
DESCRIPTION: Linux Kernel could allow a local authenticated attacker to obtain sensitive information, caused by a race condition in the hidpp_connect_event() function. By sending a specially crafted request, an attacker could exploit this vulnerability to obtain sensitive information or crash the system.
CWE: CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSS Source: IBM X-Force
CVSS Base score: 6
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H)
CVEID: CVE-2024-42240
DESCRIPTION: Linux Kernel is vulnerable to a denial of service, caused by infinite loop in x86/bhi. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition.
CWE: CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
CVSS Source: IBM X-Force
CVSS Base score: 7.5
CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVEID: CVE-2024-26595
DESCRIPTION: Linux Kernel is vulnerable to a denial of service, caused by a NULL pointer dereference in error path. A local attacker could exploit this vulnerability to cause a denial of service.
CWE: CWE-476: NULL Pointer Dereference
CVSS Source: IBM X-Force
CVSS Base score: 6.2
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVEID: CVE-2024-26665
DESCRIPTION: Linux Kernel is vulnerable to a denial of service caused by out-of-bounds access when building IPv6 PMTU. By sending a specially crafted request, a remote attacker could exploit this vulnerability to a denial of service condition.
CWE: CWE-125: Out-of-bounds Read
CVSS Source: IBM X-Force
CVSS Base score: 7.5
CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVEID: CVE-2024-26600
DESCRIPTION: Linux Kernel is vulnerable to a denial of service, caused by a NULL pointer dereference for SRP. A local attacker could exploit this vulnerability to cause a denial of service.
CWE: CWE-476: NULL Pointer Dereference
CVSS Source: IBM X-Force
CVSS Base score: 6.2
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVEID: CVE-2024-26638
DESCRIPTION: Linux Kernel is vulnerable to a denial of service, caused by an error related to the initialization struct msghdr completely. A local authenticated attacker could exploit this vulnerability to cause a denial of service.
CWE: CWE-20: Improper Input Validation
CVSS Source: IBM X-Force
CVSS Base score: 5.5
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVEID: CVE-2024-41060
DESCRIPTION: Linux Kernel is vulnerable to a denial of service, caused by Null pointer dereference in radeon_gem.c. A local authenticated attacker could exploit this vulnerability to cause a denial of service.
CWE: CWE-476: NULL Pointer Dereference
CVSS Source: IBM X-Force
CVSS Base score: 5.5
CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVEID: CVE-2024-26855
DESCRIPTION: Linux Kernel is vulnerable to a denial of service, caused by a NULL pointer dereference in ice_bridge_setlink() of net: ice. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to a denial of service condition.
CWE: CWE-476: NULL Pointer Dereference
CVSS Source: IBM X-Force
CVSS Base score: 4.4
CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
CVEID: CVE-2024-36883
DESCRIPTION: Linux Kernel is vulnerable to a denial of service, caused by an out-of-bounds access in ops_init. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service.
CWE: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CVSS Source: IBM X-Force
CVSS Base score: 5.5
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVEID: CVE-2024-23848
DESCRIPTION: Linux Kernel is vulnerable to a denial of service, caused by a use-after-free in cec_queue_msg_fh. A local attacker could exploit this vulnerability to cause the system to crash.
CWE: CWE-416: Use After Free
CVSS Source: IBM X-Force
CVSS Base score: 6.2
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVEID: CVE-2024-39499
DESCRIPTION: Linux Kernel is vulnerable to a denial of service, caused by speculation leaks by sanitizing event in event_deliver() of vmci_event.c . A local authenticated attacker could exploit this vulnerability to cause a denial of service.
CVSS Source: IBM X-Force
CVSS Base score: 5.5
CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
IBM X-Force ID: 382587
DESCRIPTION: Linux Kernel is vulnerable to a denial of service, caused by a use after free in rmi_unregister_function(). A local authenticated attacker could exploit this vulnerability to cause a denial of service.
CWE: CWE-416: Use After Free
CVSS Source: IBM X-Force
CVSS Base score: 4.4
CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Affected Products and Versions
| Affected Product(s) | Version(s) |
| IBM Storage Copy Data Management | 2.2.0.0 - 2.2.24.1 |
Remediation/Fixes
| Affected Versions | Fixing Level | Platform | Link to Fix and Instructions |
| 2.2.0.0 - 2.2.24.1 | 2.2.25.0 | Linux | https://www.ibm.com/support/pages/node/7172111 |
Workarounds and Mitigations
None
Get Notified about Future Security Bulletins
References
Acknowledgement
Change History
24 Jan 2025: Initial Publication
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY. In addition to other efforts to address potential vulnerabilities, IBM periodically updates the record of components contained in our product offerings. As part of that effort, if IBM identifies previously unidentified packages in a product/service inventory, we address relevant vulnerabilities regardless of CVE date. Inclusion of an older CVEID does not demonstrate that the referenced product has been used by IBM since that date, nor that IBM was aware of a vulnerability as of that date. We are making clients aware of relevant vulnerabilities as we become aware of them. "Affected Products and Versions" referenced in IBM Security Bulletins are intended to be only products and versions that are supported by IBM and have not passed their end-of-support or warranty date. Thus, failure to reference unsupported or extended-support products and versions in this Security Bulletin does not constitute a determination by IBM that they are unaffected by the vulnerability. Reference to one or more unsupported versions in this Security Bulletin shall not create an obligation for IBM to provide fixes for any unsupported or extended-support products or versions.
Document Location
Worldwide
Was this topic helpful?
Document Information
Modified date:
24 January 2025
UID
ibm17177444