Risk | Low |
Patch available | YES |
Number of vulnerabilities | 1 |
CVE-ID | CVE-2024-26926 |
CWE-ID | CWE-823 |
Exploitation vector | Local |
Public exploit | N/A |
Vulnerable software Subscribe |
Linux kernel Operating systems & Components / Operating system |
Vendor | Linux Foundation |
Security Bulletin
This security bulletin contains one low risk vulnerability.
EUVDB-ID: #VU91119
Risk: Low
CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2024-26926
CWE-ID:
CWE-823 - Use of Out-of-range Pointer Offset
Exploit availability: No
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error within the binder_get_object() function in drivers/android/binder.c. A local user can influence the pointer offset and potentially execute arbitrary code.
Install updates from vendor's website.
Vulnerable software versionsLinux kernel: All versions
External linkshttp://git.kernel.org/stable/c/aaef73821a3b0194a01bd23ca77774f704a04d40
http://git.kernel.org/stable/c/a2fd6dbc98be1105a1d8e9e31575da8873ef115c
http://git.kernel.org/stable/c/a6d2a8b211c874971ee4cf3ddd167408177f6e76
http://git.kernel.org/stable/c/1d7f1049035b2060342f11eff957cf567d810bdc
http://git.kernel.org/stable/c/f01d6619045704d78613b14e2e0420bfdb7f1c15
http://git.kernel.org/stable/c/68a28f551e4690db2b27b3db716c7395f6fada12
http://git.kernel.org/stable/c/48a1f83ca9c68518b1a783c62e6a8223144fa9fc
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.