NULL pointer dereference in Linux kernel net wireguard driver

1) NULL pointer dereference

EUVDB-ID: #VU91460

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26950

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the get_peer() function in drivers/net/wireguard/netlink.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

External links

http://git.kernel.org/stable/c/493aa6bdcffd90a4f82aa614fe4f4db0641b4068
http://git.kernel.org/stable/c/4be453271a882c8ebc28df3dbf9e4d95e6ac42f5
http://git.kernel.org/stable/c/09c3fa70f65175861ca948cb2f0f791e666c90e5
http://git.kernel.org/stable/c/c991567e6c638079304cc15dff28748e4a3c4a37
http://git.kernel.org/stable/c/93bcc1752c69bb309f4d8cfaf960ef1faeb34996
http://git.kernel.org/stable/c/d44bd323d8bb8031eef4bdc44547925998a11e47
http://git.kernel.org/stable/c/71cbd32e3db82ea4a74e3ef9aeeaa6971969c86f

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.