Google: sys-kernel/csql-kernel-6_6, sys-kernel/lakitu-kernel-6_6, sys-kernel/lakitu-nc-kernel-6_6, sys-kernel/lakitu-vgpu-kernel-6_6, sys-kernel/tpusev-kernel-6_6: security update to 18613.164.4

medium Tenable Self-Hosted Container Security Plugin ID 466012

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: x86/fred: Clear WFE in missing-
ENDBRANCH #CPs An indirect branch instruction sets the CPU indirect branch tracker (IBT) into
WAIT_FOR_ENDBRANCH (WFE) state and WFE stays asserted across the instruction boundary. When the decoder
finds an inappropriate instruction while WFE is set ENDBR, the CPU raises a #CP fault. For the "kernel IBT
no ENDBR" selftest where #CPs are deliberately triggered, the WFE state of the interrupted context needs
to be cleared to let execution continue. Otherwise when the CPU resumes from the instruction that just
caused the previous #CP, another missing-ENDBRANCH #CP is raised and the CPU enters a dead loop. This is
not a problem with IDT because it doesn't preserve WFE and IRET doesn't set WFE. But FRED provides space
on the entry stack (in an expanded CS area) to save and restore the WFE state, thus the WFE state is no
longer clobbered, so software must clear it. Clear WFE to avoid dead looping in ibt_clear_fred_wfe() and
the !ibt_fatal code path when execution is allowed to continue. Clobbering WFE in any other circumstance
is a security-relevant bug. [ dhansen: changelog rewording ] (CVE-2024-56761)

Solution

Update the sys-kernel/csql-kernel-6_6 library and its related packages to version 18613.164.4 or later.

Plugin Details

Severity: Medium

ID: 466012

Version: Revision 1.3

Type: Local

Family: Google COS Security Checks

Published: 10/2/2026

Updated: 10/3/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

Vendor

Vendor Severity: MEDIUM

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2024-56761

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 1/6/2025

Reference Information

CVE: CVE-2024-56761

Detections

Analytics