CVE-2024-42488

Cilium agent's race condition may lead to policy bypass for Host Firewall policy

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.14.14 and 1.15.8, a race condition in the Cilium agent can cause the agent to ignore labels that should be applied to a node. This could in turn cause CiliumClusterwideNetworkPolicies intended for nodes with the ignored label to not apply, leading to policy bypass. This issue has been patched in Cilium v1.14.14 and v1.15.8 As the underlying issue depends on a race condition, users unable to upgrade can restart the Cilium agent on affected nodes until the affected policies are confirmed to be working as expected.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Cilium

Products

Cilium

CVE-2024-7627

Bit File Manager 6.0 - 6.5.5 - Unauthenticated Remote Code Execution via Race Condition

The Bit File Manager plugin for WordPress is vulnerable to Remote Code Execution in versions 6.0 to 6.5.5 via the 'checkSyntax' function. This is due to writing a temporary file to a publicly accessible directory before performing file validation. This makes it possible for unauthenticated attackers to execute code on the server if an administrator has allowed Guest User read permissions.

CVSS 3.1 · 8.1 High EPSS 2.8% KEV · Not listed

Vendors

Bitapps

Products

File Manager

CVE-2024-26905

kernel: btrfs: fix data races when accessing the reserved amount of block reserves

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVSS 3.1 · 5.5 Medium EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2024-27430

kernel: netrom: Fix a data-race around sysctl_netrom_default_path_quality

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVSS 3.1 · 5.5 Medium EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2024-27428

kernel: netrom: Fix data-races around sysctl_netrom_network_ttl_initialiser

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVSS 3.1 · 5.5 Medium EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2024-27427

kernel: netrom: Fix a data-race around sysctl_netrom_transport_timeout

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVSS 3.1 · 5.5 Medium EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2024-27426

kernel: netrom: Fix a data-race around sysctl_netrom_transport_maximum_tries

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVSS 3.1 · 5.5 Medium EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2024-27425

kernel: netrom: Fix a data-race around sysctl_netrom_transport_acknowledge_delay

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVSS 3.1 · 5.5 Medium EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2024-27424

kernel: netrom: Fix a data-race around sysctl_netrom_transport_busy_delay

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVSS 3.1 · 5.5 Medium EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2024-27423

kernel: netrom: Fix a data-race around sysctl_netrom_transport_requested_window_size

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVSS 3.1 · 5.5 Medium EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2024-27422

kernel: netrom: Fix a data-race around sysctl_netrom_transport_no_activity_timeout

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVSS 3.1 · 5.5 Medium EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2024-27421

kernel: netrom: Fix a data-race around sysctl_netrom_routing_control

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVSS 3.1 · 5.5 Medium EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2024-27420

kernel: netrom: Fix a data-race around sysctl_netrom_link_fails_count

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVSS 3.1 · 5.5 Medium EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2024-27429

kernel: netrom: Fix a data-race around sysctl_netrom_obsolescence_count_initialiser

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVSS 3.1 · 5.5 Medium EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2024-26904

kernel: btrfs: fix data race at btrfs_use_block_rsv() when accessing block reserve

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVSS 3.1 · 5.5 Medium EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2023-52521

kernel: bpf: Annotate bpf_long_memcpy with data_race

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVSS 3.1 · 5.5 Medium EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2023-35825

kernel: r592: race condition leading to use-after-free in r592_remove()

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-3141. Reason: This candidate is a reservation duplicate of CVE-2023-3141. Notes: All CVE users should reference CVE-2023-3141 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

CVSS 3.1 · 6.4 Medium EPSS n/a KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Rhel Eus Rhev Hypervisor

CVE-2022-3522

kernel: race condition in hugetlb_no_page() in mm/hugetlb.c

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

CVSS 3.1 · 7.0 High EPSS n/a KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Rhel Eus Rhev Hypervisor

CVE-2021-20200

kernel: close race between munmap() and expand_upwards()/downwards()

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

CVSS 3.1 · 0.0 Low EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2016-5616

mysql: race condition while setting stats during MyISAM table repair (CPU Oct 2016)

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-6663. Reason: This candidate is a reservation duplicate of CVE-2016-6663. Notes: All CVE users should reference CVE-2016-6663 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage

CVSS 3.0 · 7.0 High EPSS n/a KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Rhel Software Collections