The Federal Office for Information Security (BSI) has updated its IT security warning regarding a known vulnerability in the Linux Kernel. This update, dated June 30, 2024, follows the initial disclosure of the vulnerability on February 4, 2024. The vulnerability affects the Linux operating system, Red Hat Enterprise Linux, Oracle Linux, NetApp ActiveIQ Unified Manager, and Open Source Linux Kernel.
Manufacturer Recommendations and Security Updates
The latest manufacturer recommendations for updates, workarounds, and security patches related to this vulnerability are available. For instance, you can find the latest advisories in the NetApp Security Advisory NTAP-20240628-0002, as of June 28, 2024. Additional useful sources and information are provided later in this article.
Security Notice for Linux Kernel – Risk Level: Medium
- Risk Level: 2 (Medium)
- CVSS Base Score: 6.5
- CVSS Temporal Score: 6.0
- Remote Attack: Yes
The Common Vulnerability Scoring System (CVSS) is used to assess the vulnerability of computer systems. The CVSS standard allows potential or actual security vulnerabilities to be compared based on various criteria, aiding in the prioritization of countermeasures. Vulnerability severity levels are categorized as “none,” “low,” “medium,” “high,” and “critical.” The Base Score evaluates the conditions for an attack (such as authentication, complexity, privileges, user interaction) and its consequences. The Temporal Score incorporates factors that can change over time. The current vulnerability is rated as “medium” with a CVSS Base Score of 6.5.
General Recommendations for Handling IT Vulnerabilities
Users of affected applications should ensure their software is up to date. Manufacturers are expected to address discovered vulnerabilities promptly by developing patches or workarounds. If new security updates are available, they should be installed promptly.
For further information, consult the sources listed in the next section. These often contain additional details on the latest software versions, the availability of security patches, or advice on workarounds. If you have further questions or concerns, contact your system administrator. IT security personnel should regularly check the mentioned sources to see if new security updates are available.
