Detections
Analytics

Google: sys-kernel/csql-kernel-6_1, sys-kernel/lakitu-kernel-6_1: security update to 18244.85.5

medium Tenable Cloud Security Plugin ID 450648

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Mark target gfn of emulated
 atomic instruction as dirty When emulating an atomic access on behalf of the guest, mark the target gfn
 dirty if the CMPXCHG by KVM is attempted and doesn't fault. This fixes a bug where KVM effectively
 corrupts guest memory during live migration by writing to guest memory without informing userspace that
 the page is dirty. Marking the page dirty got unintentionally dropped when KVM's emulated CMPXCHG was
 converted to do a user access. Before that, KVM explicitly mapped the guest page into kernel memory, and
 marked the page dirty during the unmap phase. Mark the page dirty even if the CMPXCHG fails, as the old
 data is written back on failure, i.e. the page is still written. The value written is guaranteed to be the
 same because the operation is atomic, but KVM's ABI is that all writes are dirty logged regardless of the
 value written. And more importantly, that's what KVM did before the buggy commit. Huge kudos to the folks
 on the Cc list (and many others), who did all the actual work of triaging and debugging. base-commit:
 6769ea8da8a93ed4630f1ce64df6aafcaabfce64 (CVE-2024-35804)

Solution

Update the sys-kernel/csql-kernel-6_1 library and its related packages to version 18244.85.5 or later.

See Also

https://storage.googleapis.com/cos-oval-vulnerability-feed/cos-113.oval.xml.tar.gz

Plugin Details

Severity: Medium

ID: 450648

Version: Revision 1.2

Type: Local

Published: 10/1/2026

Updated: 10/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

Vendor

Vendor Severity: MEDIUM

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2024-35804

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Reference Information

CVE: CVE-2024-35804