CVE-2024-36960

Q: What is the severity of CVE-2024-36960?

CVE-2024-36960 has a CVSS score of 7.1 (HIGH). This CVE describes an out-of-bounds read vulnerability in the Linux kernel's VMware graphics driver (vmwgfx). The flaw occurs when the kernel incorrectly sets the length parameter for fence signaled events, allowing attackers to read kernel memory beyond the intended buffer. This affects systems running Linux with VMware graphics drivers enabled.

7.1 HIGH

📋 TL;DR

This CVE describes an out-of-bounds read vulnerability in the Linux kernel's VMware graphics driver (vmwgfx). The flaw occurs when the kernel incorrectly sets the length parameter for fence signaled events, allowing attackers to read kernel memory beyond the intended buffer. This affects systems running Linux with VMware graphics drivers enabled.

💻 Affected Systems

Products:

Linux kernel with vmwgfx driver

Versions: Specific affected kernel versions not specified in CVE description; check git commits for exact ranges

Operating Systems: Linux distributions with vulnerable kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems using VMware graphics drivers (vmwgfx). Systems without this driver or with it disabled are not vulnerable.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel memory disclosure leading to information leakage, potential privilege escalation if combined with other vulnerabilities, or system instability/crashes.

🟠

Likely Case

Information disclosure of kernel memory contents, which could reveal sensitive data or aid in further exploitation.

🟢

If Mitigated

Limited impact due to kernel address space layout randomization (KASLR) and other memory protections, but still represents a security boundary violation.

🌐 Internet-Facing: LOW - This requires local access or ability to execute code on the system.

🏢 Internal Only: MEDIUM - Local attackers or compromised user accounts could exploit this to gain kernel memory access.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires local access to trigger the fence event. Exploitation would need to overcome kernel protections.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Patches available in git commits referenced in CVE

Vendor Advisory: https://git.kernel.org/stable/c/0dbfc73670b357456196130551e586345ca48e1b

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version. 2. Rebuild kernel if compiling from source. 3. Reboot system to load new kernel.

🔧 Temporary Workarounds

Disable vmwgfx driver

linux

Remove or blacklist the vulnerable VMware graphics driver

echo 'blacklist vmwgfx' >> /etc/modprobe.d/blacklist-vmwgfx.conf
update-initramfs -u
reboot

🧯 If You Can't Patch

Restrict local user access to systems with vmwgfx driver
Implement strict privilege separation and limit user capabilities

🔍 How to Verify

Check if Vulnerable:

Check if vmwgfx module is loaded: lsmod | grep vmwgfx. If loaded and kernel version is unpatched, system is vulnerable.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes the git commit hashes referenced in the CVE description.

📡 Detection & Monitoring

Log Indicators:

Kernel oops messages
System crashes related to drm/vmwgfx

Network Indicators:

None - local vulnerability only

SIEM Query:

Search for kernel panic logs or vmwgfx-related error messages in system logs

📊 Metadata

CVE ID: CVE-2024-36960

CVSS v3 Score: 7.1 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE: CWE-125

Published: June 3, 2024

Last Updated: April 1, 2025

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Debian Linux by Debian

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable vmwgfx driver

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities