CVE-2024-3646
published 2024-04-19CVE-2024-3646: A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain…
PriorityP349high7.2CVSS 3.1
AVNACLPRHUINSUCHIHAH
EPSS
1.74%
74.9th percentile
A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the instance when configuring the chat integration. Exploitation of this vulnerability required access to the GitHub Enterprise Server instance and access to the Management Console with the editor role. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.12 and was fixed in versions 3.12.2, 3.11.8, 3.10.10, and 3.9.13. This vulnerability was reported via the GitHub Bug Bounty program.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github | enterprise_server | < 3.9.13 | 3.9.13 |
| github | enterprise_server | >= 3.10.0 < 3.10.10 | 3.10.10 |
| github | enterprise_server | >= 3.11.0 < 3.11.8 | 3.11.8 |
| github | enterprise_server | >= 3.12.0 < 3.12.2 | 3.12.2 |
| github | enterprise_server | >= 3.9.0 < 3.9.13 | 3.9.13 |
CVSS provenance
nvdv3.17.2HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-4325-9qm2-3cg2: A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to
ghsa_unreviewed·2024-04-19
CVE-2024-3646 [HIGH] CWE-20 GHSA-4325-9qm2-3cg2: A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to
A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the instance when configuring the chat integration. Exploitation of this vulnerability required access to the GitHub Enterprise Server instance and access to the Management Console with the editor role. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.12 and was fixed in versions 3.12.2, 3.11.8, 3.10.10, and 3.9.13. This vulnerability was reported via the GitHub Bug Bounty program.
Red Hat
kernel: iommu/tegra241-cmdqv: Fix alignment failure at max_n_shift
vendor_redhat·2024-12-27·CVSS 5.5
CVE-2024-53225 [MEDIUM] CWE-20 kernel: iommu/tegra241-cmdqv: Fix alignment failure at max_n_shift
kernel: iommu/tegra241-cmdqv: Fix alignment failure at max_n_shift
In the Linux kernel, the following vulnerability has been resolved:
iommu/tegra241-cmdqv: Fix alignment failure at max_n_shift
When configuring a kernel with PAGE_SIZE=4KB, depending on its setting of
CONFIG_CMA_ALIGNMENT, VCMDQ_LOG2SIZE_MAX=19 could fail the alignment test
and trigger a WARN_ON:
WARNING: at drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c:3646
Call trace:
arm_smmu_init_one_queue+0x15c/0x210
tegra241_cmdqv_init_structures+0x114/0x338
arm_smmu_device_probe+0xb48/0x1d90
Fix it by capping max_n_shift to CMDQ_MAX_SZ_SHIFT as SMMUv3 CMDQ does.
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - No
Red Hat
kernel: scsi: qedf: Make qedf_execute_tmf() non-preemptible
vendor_redhat·2024-07-30·CVSS 5.5
CVE-2024-42124 [MEDIUM] CWE-372 kernel: scsi: qedf: Make qedf_execute_tmf() non-preemptible
kernel: scsi: qedf: Make qedf_execute_tmf() non-preemptible
In the Linux kernel, the following vulnerability has been resolved:
scsi: qedf: Make qedf_execute_tmf() non-preemptible
Stop calling smp_processor_id() from preemptible code in
qedf_execute_tmf90. This results in BUG_ON() when running an RT kernel.
[ 659.343280] BUG: using smp_processor_id() in preemptible [00000000] code: sg_reset/3646
[ 659.343282] caller is qedf_execute_tmf+0x8b/0x360 [qedf]
A vulnerability was found in the Linux kernel's qedf driver function qedf_execute_tmf(), where the function call smp_processor_id() is done from preemptible code (before acquiring a lock) which can result in BUG_ON() when running an RT kernel. This can result in system inconsistencies.
Mitigation: Mitigation for this issue is either not
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://docs.github.com/en/[email protected]/admin/release-notes#3.10.10https://docs.github.com/en/[email protected]/admin/release-notes#3.11.8https://docs.github.com/en/[email protected]/admin/release-notes#3.12.2https://docs.github.com/en/[email protected]/admin/release-notes#3.9.13https://docs.github.com/en/[email protected]/admin/release-notes#3.10.10https://docs.github.com/en/[email protected]/admin/release-notes#3.11.8https://docs.github.com/en/[email protected]/admin/release-notes#3.12.2https://docs.github.com/en/[email protected]/admin/release-notes#3.9.13
2024-04-19
Published