Improper locking in Linux kernel powerpc kernel

1) Improper locking

EUVDB-ID: #VU94991

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41064

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the eeh_pe_bus_get() function in arch/powerpc/kernel/eeh_pe.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

External links

http://git.kernel.org/stable/c/8836e1bf5838ac6c08760e0a2dd7cf6410aa7ff3
http://git.kernel.org/stable/c/033c51dfdbb6b79ab43fb3587276fa82d0a329e1
http://git.kernel.org/stable/c/4fad7fef847b6028475dd7b4c14fcb82b3e51274
http://git.kernel.org/stable/c/4bc246d2d60d071314842fa448faa4ed39082aff
http://git.kernel.org/stable/c/f23c3d1ca9c4b2d626242a4e7e1ec1770447f7b5
http://git.kernel.org/stable/c/428d940a8b6b3350b282c14d3f63350bde65c48b
http://git.kernel.org/stable/c/a1216e62d039bf63a539bbe718536ec789a853dd

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.