CVE-2024-0340 MEDIUM

CVE-2024-0340: Kernel: information disclosure in vhost/vhost.c:vhost_new_msg()

Vendor Red Hat
Product Red Hat Enterprise Linux 6
Weakness CWE-200 · Info exposure
Published January 9, 2024
Last update November 7, 2025

CVSS base score

4.4/10
Attack vector Local
Attack complexity Low
Privileges required High
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

A vulnerability was found in vhost_new_msg in drivers/vhost/vhost.c in the Linux kernel, which does not properly initialize memory in messages passed between virtual guests and the host operating system in the vhost/vhost.c:vhost_new_msg() function. This issue can allow local privileged users to read some kernel memory contents when reading from the /dev/vhost-net device file.

Key dates

02Disclosure timeline

January 9, 2024 CVE published
November 7, 2025 Record updated