CVE-2024-2915
published 2024-03-26CVE-2024-2915: Improper access control in PAM JIT elevation in Devolutions Server 2024.1.6 and earlier allows an attacker with access to the PAM JIT elevation feature to…
PriorityP355high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
0.65%
46.4th percentile
Improper access control in PAM JIT elevation in Devolutions Server 2024.1.6 and earlier allows an attacker with access to the PAM JIT elevation feature to elevate themselves to unauthorized groups via a specially crafted request.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| devolutions | devolutions_server | < 2024.1.8.0 | 2024.1.8.0 |
| devolutions | server | <= 2024.1.6 | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-76jh-m3c4-gxgj: Improper access control in PAM JIT elevation in Devolutions Server 2024
ghsa_unreviewed·2024-03-26
CVE-2024-2915 [HIGH] CWE-284 GHSA-76jh-m3c4-gxgj: Improper access control in PAM JIT elevation in Devolutions Server 2024
Improper access control in PAM JIT elevation in Devolutions Server 2024.1.6 and earlier allows an attacker with access to the PAM JIT elevation feature to elevate themselves to unauthorized groups via a specially crafted request.
Red Hat
kernel: firmware: arm_scmi: Fix the double free in scmi_debugfs_common_setup()
vendor_redhat·2024-11-07·CVSS 7.8
CVE-2024-50159 [HIGH] CWE-415 kernel: firmware: arm_scmi: Fix the double free in scmi_debugfs_common_setup()
kernel: firmware: arm_scmi: Fix the double free in scmi_debugfs_common_setup()
In the Linux kernel, the following vulnerability has been resolved:
firmware: arm_scmi: Fix the double free in scmi_debugfs_common_setup()
Clang static checker(scan-build) throws below warning：
| drivers/firmware/arm_scmi/driver.c:line 2915, column 2
| Attempt to free released memory.
When devm_add_action_or_reset() fails, scmi_debugfs_common_cleanup()
will run twice which causes double free of 'dbg->name'.
Remove the redundant scmi_debugfs_common_cleanup() to fix this problem.
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux 8) - Not
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-03-26
Published