Security readout for executives and security teams
Plain-English summary
A Linux graphics-driver flaw can let a low-privileged local user read unintended kernel memory and potentially disrupt the system. It is not remotely exploitable under the supplied CVSS assessment. Risk is concentrated on systems using an affected vmwgfx driver, commonly associated with VMware virtual graphics.
Executive priority
Treat as a high-priority local exposure, especially on shared Linux systems or hosts running untrusted workloads. It is less urgent than an internet-exploitable flaw, but possible kernel-memory disclosure and service disruption justify prompt, scheduled kernel patching and reboot validation.
Technical view
The vmwgfx fence-event code reported the parent event structure's length instead of drm_vmw_event_fence's actual size. drm_read then copied excess data to user space, producing an out-of-bounds read. The supplied CVSS 3.1 score is 7.1, reflecting local access, low complexity, required low privileges, high confidentiality impact, and high availability impact.
Likely exposure
Likely exposure is limited to affected Linux kernels where vmwgfx is present and relevant local users can access its DRM interface. The supplied affected-version data spans multiple kernel branches but contains ambiguous entries, so distribution package status and backported fixes must be checked rather than relying only on version strings.
Exploitation context
The supplied record does not identify public exploitation, and the CVE is not marked as CISA KEV. Exploitation requires local, low-privileged access according to the CVSS vector. No evidence in the bundle supports remote exploitation or integrity impact.
Researcher notes
CWE-125 accurately describes the out-of-bounds read. The fix corrects the DRM event length to match drm_vmw_event_fence. The source bundle lists several stable-branch commits and Debian advisories, but its affected-version entries are not sufficiently clear for universal version-only detection. No exploit method or observed exploitation is documented.
Mitigation direction
- Install the distribution-supported kernel update containing the CVE-2024-36960 fix.
- Consult Linux vendor advisories because distributions may backport fixes without changing upstream-style version numbers.
- Prioritize multi-user or untrusted-workload systems where affected vmwgfx interfaces are accessible.
- Reboot into the updated kernel after installation, following vendor operational guidance.
Validation and detection
- Inventory running kernel versions and installed kernel packages across Linux assets.
- Determine whether vmwgfx is present, loaded, and used on each potentially affected system.
- Compare package status with the applicable distribution advisory and upstream stable fix.
- Confirm the running kernel after remediation includes the vendor backport or referenced stable commit.
- Review local-access controls for users and workloads able to reach DRM interfaces.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-125: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-36960 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H1.85.2LinuxVulnerability scoring details
Base CVSS 3.1 score
7.1HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/2f527e3efd37c7c5e85e8aa86308856b619fa59fCVE reference, Linux
- https://git.kernel.org/stable/c/cef0962f2d3e5fd0660c8efb72321083a1b531a9CVE reference, Linux
- https://git.kernel.org/stable/c/3cd682357c6167f636aec8ac0efaa8ba61144d36CVE reference, Linux
- https://git.kernel.org/stable/c/b7bab33c4623c66e3398d5253870d4e88c52dfc0CVE reference, Linux
- https://git.kernel.org/stable/c/0dbfc73670b357456196130551e586345ca48e1bCVE reference, Linux
- https://git.kernel.org/stable/c/7b5fd3af4a250dd0a2a558e07b43478748eb5d22CVE reference, Linux
- https://git.kernel.org/stable/c/deab66596dfad14f1c54eeefdb72428340d72a77CVE reference, Linux
- https://git.kernel.org/stable/c/a37ef7613c00f2d72c8fc08bd83fb6cc76926c8cCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2024/06/msg00020.htmlCVE reference, CVE · x_transferred
- https://lists.debian.org/debian-lts-announce/2024/06/msg00019.htmlCVE reference, CVE · x_transferred
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Read
Out-of-bounds Read represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.