Google: sys-kernel/csql-kernel-6_6: security update to 19165.0.0

medium Tenable Cloud Security Plugin ID 452295

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: x86: fix user address masking non-
canonical speculation issue It turns out that AMD has a "Meltdown Lite(tm)" issue with non-canonical
accesses in kernel space. And so using just the high bit to decide whether an access is in user space or
kernel space ends up with the good old "leak speculative data" if you have the right gadget using the
result: CVE-2020-12965 “Transient Execution of Non-Canonical Accesses“ Now, the kernel surrounds the
access with a STAC/CLAC pair, and those instructions end up serializing execution on older Zen
architectures, which closes the speculation window. But that was true only up until Zen 5, which renames
the AC bit [1]. That improves performance of STAC/CLAC a lot, but also means that the speculation window
is now open. Note that this affects not just the new address masking, but also the regular
valid_user_address() check used by access_ok(), and the asm version of the sign bit check in the
get_user() helpers. It does not affect put_user() or clear_user() variants, since there's no speculative
result to be used in a gadget for those operations. (CVE-2024-50102)

Solution

Update the sys-kernel/csql-kernel-6_6 library and its related packages to version 19165.0.0 or later.

Plugin Details

Severity: Medium

ID: 452295

Version: Revision 1.1

Type: Local

Family: Google COS Security Checks

Published: 10/1/2026

Updated: 10/1/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

Vendor

Vendor Severity: MEDIUM

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:N/A:N

CVSS Score Source: CVE-2024-50102

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 11/5/2024

Reference Information

CVE: CVE-2024-50102

Detections

Analytics