Buffer overflow in Linux kernel trace



Published: 2024-08-26
Risk Low
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2024-43890
CWE-ID CWE-119
Exploitation vector Local
Public exploit N/A
Vulnerable software
Subscribe
Linux kernel
Operating systems & Components / Operating system

Vendor Linux Foundation

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) Buffer overflow

EUVDB-ID: #VU96544

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-43890

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the get_free_elt(), tracing_map_clear() and tracing_map_create() functions in kernel/trace/tracing_map.c. A local user can escalate privileges on the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

CPE2.3
External links

http://git.kernel.org/stable/c/302ceb625d7b990db205a15e371f9a71238de91c
http://git.kernel.org/stable/c/d3e4dbc2858fe85d1dbd2e72a9fc5dea988b5c18
http://git.kernel.org/stable/c/eb223bf01e688dfe37e813c8988ee11c8c9f8d0a
http://git.kernel.org/stable/c/cd10d186a5409a1fe6e976df82858e9773a698da
http://git.kernel.org/stable/c/788ea62499b3c18541fd6d621964d8fafbc4aec5
http://git.kernel.org/stable/c/a172c7b22bc2feaf489cfc6d6865f7237134fdf8
http://git.kernel.org/stable/c/236bb4690773ab6869b40bedc7bc8d889e36f9d6
http://git.kernel.org/stable/c/bcf86c01ca4676316557dd482c8416ece8c2e143


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###