CVE Vulnerabilities

CVE-2023-31356

Incomplete Cleanup

Published: Aug 13, 2024 | Modified: Oct 30, 2024
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
RedHat/V2
RedHat/V3
4.4 MODERATE
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Ubuntu
MEDIUM

Incomplete system memory cleanup in SEV firmware could allow a privileged attacker to corrupt guest private memory, potentially resulting in a loss of data integrity.

Weakness

The product does not properly “clean up” and remove temporary or supporting resources after they have been used.

Affected Software

Name Vendor Start Version End Version
Red Hat Enterprise Linux 8 RedHat linux-firmware-0:20240827-124.git3cff7109.el8_10 *
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support RedHat linux-firmware-0:20240827-114.3.git3cff7109.el8_6 *
Red Hat Enterprise Linux 8.6 Telecommunications Update Service RedHat linux-firmware-0:20240827-114.3.git3cff7109.el8_6 *
Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions RedHat linux-firmware-0:20240827-114.3.git3cff7109.el8_6 *
Red Hat Enterprise Linux 8.8 Extended Update Support RedHat linux-firmware-0:20240827-118.3.git3cff7109.el8_8 *
Red Hat Enterprise Linux 9 RedHat linux-firmware-0:20240905-143.3.el9_4 *
Red Hat Enterprise Linux 9.2 Extended Update Support RedHat linux-firmware-0:20240905-138.3.el9_2 *
Amd64-microcode Ubuntu trusty/esm *
Amd64-microcode Ubuntu upstream *

Potential Mitigations

References