CVE-2024-35875 (GCVE-0-2024-35875)
Vulnerability from cvelistv5
Published
2024-05-19 08:34
Modified
2026-08-05 11:30
Severity ?
8.4 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: x86/coco: Require seeding RNG with RDRAND on CoCo systems There are few uses of CoCo that don't rely on working cryptography and hence a working RNG. Unfortunately, the CoCo threat model means that the VM host cannot be trusted and may actively work against guests to extract secrets or manipulate computation. Since a malicious host can modify or observe nearly all inputs to guests, the only remaining source of entropy for CoCo guests is RDRAND. If RDRAND is broken -- due to CPU hardware fault -- the RNG as a whole is meant to gracefully continue on gathering entropy from other sources, but since there aren't other sources on CoCo, this is catastrophic. This is mostly a concern at boot time when initially seeding the RNG, as after that the consequences of a broken RDRAND are much more theoretical. So, try at boot to seed the RNG using 256 bits of RDRAND output. If this fails, panic(). This will also trigger if the system is booted without RDRAND, as RDRAND is essential for a safe CoCo boot. Add this deliberately to be "just a CoCo x86 driver feature" and not part of the RNG itself. Many device drivers and platforms have some desire to contribute something to the RNG, and add_device_randomness() is specifically meant for this purpose. Any driver can call it with seed data of any quality, or even garbage quality, and it can only possibly make the quality of the RNG better or have no effect, but can never make it worse. Rather than trying to build something into the core of the RNG, consider the particular CoCo issue just a CoCo issue, and therefore separate it all out into driver (well, arch/platform) code. [ bp: Massage commit message. ]
References
Impacted products
Vendor Product Version
Linux Linux Version: d8aa7eea78a1401cce39b3bb61ead0150044a3df
Version: d8aa7eea78a1401cce39b3bb61ead0150044a3df
Version: d8aa7eea78a1401cce39b3bb61ead0150044a3df
Version: d8aa7eea78a1401cce39b3bb61ead0150044a3df
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-35875",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-17T17:38:48.795160Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-17T17:41:42.620Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:21:49.026Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/22943e4fe4b3a2dcbadc3d38d5bf840bbdbfe374"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/453b5f2dec276c1bb4ea078bf8c0da57ee4627e5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/08044b08b37528b82f70a87576c692b4e4b7716e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/99485c4c026f024e7cb82da84c7951dbe3deb584"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/coco/core.c",
            "arch/x86/include/asm/coco.h",
            "arch/x86/kernel/setup.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "22943e4fe4b3a2dcbadc3d38d5bf840bbdbfe374",
              "status": "affected",
              "version": "d8aa7eea78a1401cce39b3bb61ead0150044a3df",
              "versionType": "git"
            },
            {
              "lessThan": "453b5f2dec276c1bb4ea078bf8c0da57ee4627e5",
              "status": "affected",
              "version": "d8aa7eea78a1401cce39b3bb61ead0150044a3df",
              "versionType": "git"
            },
            {
              "lessThan": "08044b08b37528b82f70a87576c692b4e4b7716e",
              "status": "affected",
              "version": "d8aa7eea78a1401cce39b3bb61ead0150044a3df",
              "versionType": "git"
            },
            {
              "lessThan": "99485c4c026f024e7cb82da84c7951dbe3deb584",
              "status": "affected",
              "version": "d8aa7eea78a1401cce39b3bb61ead0150044a3df",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/coco/core.c",
            "arch/x86/include/asm/coco.h",
            "arch/x86/kernel/setup.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.15"
            },
            {
              "lessThan": "4.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.85",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.26",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.85",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.26",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.5",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/coco: Require seeding RNG with RDRAND on CoCo systems\n\nThere are few uses of CoCo that don\u0027t rely on working cryptography and\nhence a working RNG. Unfortunately, the CoCo threat model means that the\nVM host cannot be trusted and may actively work against guests to\nextract secrets or manipulate computation. Since a malicious host can\nmodify or observe nearly all inputs to guests, the only remaining source\nof entropy for CoCo guests is RDRAND.\n\nIf RDRAND is broken -- due to CPU hardware fault -- the RNG as a whole\nis meant to gracefully continue on gathering entropy from other sources,\nbut since there aren\u0027t other sources on CoCo, this is catastrophic.\nThis is mostly a concern at boot time when initially seeding the RNG, as\nafter that the consequences of a broken RDRAND are much more\ntheoretical.\n\nSo, try at boot to seed the RNG using 256 bits of RDRAND output. If this\nfails, panic(). This will also trigger if the system is booted without\nRDRAND, as RDRAND is essential for a safe CoCo boot.\n\nAdd this deliberately to be \"just a CoCo x86 driver feature\" and not\npart of the RNG itself. Many device drivers and platforms have some\ndesire to contribute something to the RNG, and add_device_randomness()\nis specifically meant for this purpose.\n\nAny driver can call it with seed data of any quality, or even garbage\nquality, and it can only possibly make the quality of the RNG better or\nhave no effect, but can never make it worse.\n\nRather than trying to build something into the core of the RNG, consider\nthe particular CoCo issue just a CoCo issue, and therefore separate it\nall out into driver (well, arch/platform) code.\n\n  [ bp: Massage commit message. ]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The adversary defined by the CoCo threat model is the untrusted hypervisor/host, which attacks the guest through the virtual platform it controls (CPUID, boot cmdline, TSC, interrupt and device inputs) rather than through the guest\u0027s network stack. This is read/write access to the vulnerable component\u0027s platform, i.e. local.\nAC:L - The attacker directly creates the vulnerable condition \u2014 the host supplies guest CPUID and can simply not advertise X86_FEATURE_RDRAND, after which arch_get_random_longs() returns 0 and every remaining entropy input (cmdline, TSC, bootloader seed, interrupt/device timings) is host-supplied or host-observable. No unpredictable precondition is required; the same state also arises unaided when x86_init_rdrand() disables faulty RDRAND.\nPR:N - Privileges are measured against the vulnerable component \u2014 the CoCo guest kernel \u2014 and the host holds no account, credential, or privilege inside the guest at all. The weak seeding happens unconditionally during guest boot with no guest-side authentication.\nUI:N - The defective seeding occurs automatically in setup_arch() on every guest boot; no action by any guest user or administrator is needed.\nS:U - The vulnerable component (guest kernel RNG seeding) and the impacted component (that same guest\u0027s kernel and userspace secrets) sit in the same security authority. No guest-to-host escape or IOMMU boundary is crossed.\nC:H - With RDRAND absent the entire input pool consists of values the host chose or can observe, so the host can reconstruct the CRNG state and predict all get_random_bytes()/getrandom()/urandom output \u2014 disk-encryption keys, TLS/SSH private keys, session keys and IVs generated in the guest. That is a complete, total loss of the confidentiality guarantee CoCo exists to provide.\nI:H - Predictable nonces and keys let the attacker forge signatures, authentication tokens and MACs produced inside the guest, and predictable net_secret/ts_secret enable off-path TCP sequence and syncookie forgery for data injection. Predictable stack canaries (boot_init_stack_canary runs straight off the unseeded pool) and predictable randomization secrets additionally hand the attacker reliable control-flow-hijack primitives.\nA:H - Knowledge of the boot stack canary and other kernel randomization secrets converts otherwise-unreliable memory-corruption bugs into dependable code execution and full guest takeover, and predictable TCP ISN/syncookie secrets permit off-path RST injection that tears down the guest\u0027s connections."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:30:35.909Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/22943e4fe4b3a2dcbadc3d38d5bf840bbdbfe374"
        },
        {
          "url": "https://git.kernel.org/stable/c/453b5f2dec276c1bb4ea078bf8c0da57ee4627e5"
        },
        {
          "url": "https://git.kernel.org/stable/c/08044b08b37528b82f70a87576c692b4e4b7716e"
        },
        {
          "url": "https://git.kernel.org/stable/c/99485c4c026f024e7cb82da84c7951dbe3deb584"
        }
      ],
      "title": "x86/coco: Require seeding RNG with RDRAND on CoCo systems",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-35875",
    "datePublished": "2024-05-19T08:34:32.767Z",
    "dateReserved": "2024-05-17T13:50:33.110Z",
    "dateUpdated": "2026-08-05T11:30:35.909Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/22943e4fe4b3a2dcbadc3d38d5bf840bbdbfe374\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/453b5f2dec276c1bb4ea078bf8c0da57ee4627e5\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/08044b08b37528b82f70a87576c692b4e4b7716e\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/99485c4c026f024e7cb82da84c7951dbe3deb584\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T03:21:49.026Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-35875\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-17T17:38:48.795160Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-17T17:38:49.735Z\"}}], \"cna\": {\"title\": \"x86/coco: Require seeding RNG with RDRAND on CoCo systems\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 8.4, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The adversary defined by the CoCo threat model is the untrusted hypervisor/host, which attacks the guest through the virtual platform it controls (CPUID, boot cmdline, TSC, interrupt and device inputs) rather than through the guest\u0027s network stack. This is read/write access to the vulnerable component\u0027s platform, i.e. local.\\nAC:L - The attacker directly creates the vulnerable condition \\u2014 the host supplies guest CPUID and can simply not advertise X86_FEATURE_RDRAND, after which arch_get_random_longs() returns 0 and every remaining entropy input (cmdline, TSC, bootloader seed, interrupt/device timings) is host-supplied or host-observable. No unpredictable precondition is required; the same state also arises unaided when x86_init_rdrand() disables faulty RDRAND.\\nPR:N - Privileges are measured against the vulnerable component \\u2014 the CoCo guest kernel \\u2014 and the host holds no account, credential, or privilege inside the guest at all. The weak seeding happens unconditionally during guest boot with no guest-side authentication.\\nUI:N - The defective seeding occurs automatically in setup_arch() on every guest boot; no action by any guest user or administrator is needed.\\nS:U - The vulnerable component (guest kernel RNG seeding) and the impacted component (that same guest\u0027s kernel and userspace secrets) sit in the same security authority. No guest-to-host escape or IOMMU boundary is crossed.\\nC:H - With RDRAND absent the entire input pool consists of values the host chose or can observe, so the host can reconstruct the CRNG state and predict all get_random_bytes()/getrandom()/urandom output \\u2014 disk-encryption keys, TLS/SSH private keys, session keys and IVs generated in the guest. That is a complete, total loss of the confidentiality guarantee CoCo exists to provide.\\nI:H - Predictable nonces and keys let the attacker forge signatures, authentication tokens and MACs produced inside the guest, and predictable net_secret/ts_secret enable off-path TCP sequence and syncookie forgery for data injection. Predictable stack canaries (boot_init_stack_canary runs straight off the unseeded pool) and predictable randomization secrets additionally hand the attacker reliable control-flow-hijack primitives.\\nA:H - Knowledge of the boot stack canary and other kernel randomization secrets converts otherwise-unreliable memory-corruption bugs into dependable code execution and full guest takeover, and predictable TCP ISN/syncookie secrets permit off-path RST injection that tears down the guest\u0027s connections.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"d8aa7eea78a1401cce39b3bb61ead0150044a3df\", \"lessThan\": \"22943e4fe4b3a2dcbadc3d38d5bf840bbdbfe374\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d8aa7eea78a1401cce39b3bb61ead0150044a3df\", \"lessThan\": \"453b5f2dec276c1bb4ea078bf8c0da57ee4627e5\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d8aa7eea78a1401cce39b3bb61ead0150044a3df\", \"lessThan\": \"08044b08b37528b82f70a87576c692b4e4b7716e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d8aa7eea78a1401cce39b3bb61ead0150044a3df\", \"lessThan\": \"99485c4c026f024e7cb82da84c7951dbe3deb584\", \"versionType\": \"git\"}], \"programFiles\": [\"arch/x86/coco/core.c\", \"arch/x86/include/asm/coco.h\", \"arch/x86/kernel/setup.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.15\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.15\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.85\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.26\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.5\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"arch/x86/coco/core.c\", \"arch/x86/include/asm/coco.h\", \"arch/x86/kernel/setup.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/22943e4fe4b3a2dcbadc3d38d5bf840bbdbfe374\"}, {\"url\": \"https://git.kernel.org/stable/c/453b5f2dec276c1bb4ea078bf8c0da57ee4627e5\"}, {\"url\": \"https://git.kernel.org/stable/c/08044b08b37528b82f70a87576c692b4e4b7716e\"}, {\"url\": \"https://git.kernel.org/stable/c/99485c4c026f024e7cb82da84c7951dbe3deb584\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nx86/coco: Require seeding RNG with RDRAND on CoCo systems\\n\\nThere are few uses of CoCo that don\u0027t rely on working cryptography and\\nhence a working RNG. Unfortunately, the CoCo threat model means that the\\nVM host cannot be trusted and may actively work against guests to\\nextract secrets or manipulate computation. Since a malicious host can\\nmodify or observe nearly all inputs to guests, the only remaining source\\nof entropy for CoCo guests is RDRAND.\\n\\nIf RDRAND is broken -- due to CPU hardware fault -- the RNG as a whole\\nis meant to gracefully continue on gathering entropy from other sources,\\nbut since there aren\u0027t other sources on CoCo, this is catastrophic.\\nThis is mostly a concern at boot time when initially seeding the RNG, as\\nafter that the consequences of a broken RDRAND are much more\\ntheoretical.\\n\\nSo, try at boot to seed the RNG using 256 bits of RDRAND output. If this\\nfails, panic(). This will also trigger if the system is booted without\\nRDRAND, as RDRAND is essential for a safe CoCo boot.\\n\\nAdd this deliberately to be \\\"just a CoCo x86 driver feature\\\" and not\\npart of the RNG itself. Many device drivers and platforms have some\\ndesire to contribute something to the RNG, and add_device_randomness()\\nis specifically meant for this purpose.\\n\\nAny driver can call it with seed data of any quality, or even garbage\\nquality, and it can only possibly make the quality of the RNG better or\\nhave no effect, but can never make it worse.\\n\\nRather than trying to build something into the core of the RNG, consider\\nthe particular CoCo issue just a CoCo issue, and therefore separate it\\nall out into driver (well, arch/platform) code.\\n\\n  [ bp: Massage commit message. ]\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.85\", \"versionStartIncluding\": \"4.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.26\", \"versionStartIncluding\": \"4.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.5\", \"versionStartIncluding\": \"4.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9\", \"versionStartIncluding\": \"4.15\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:30:35.909Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-35875\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:30:35.909Z\", \"dateReserved\": \"2024-05-17T13:50:33.110Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-19T08:34:32.767Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.