NULL pointer dereference in Linux kernel pci hotplug driver

1) NULL pointer dereference

EUVDB-ID: #VU97513

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-46761

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the pnv_php_disable_irq() function in drivers/pci/hotplug/pnv_php.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

CPE2.3

External links

http://git.kernel.org/stable/c/4eb4085c1346d19d4a05c55246eb93e74e671048
http://git.kernel.org/stable/c/c4c681999d385e28f84808bbf3a85ea8e982da55
http://git.kernel.org/stable/c/bc1faed19db95abf0933b104910a3fb01b138f59
http://git.kernel.org/stable/c/c0d8094dc740cfacf3775bbc6a1c4720459e8de4
http://git.kernel.org/stable/c/438d522227374042b5c8798f8ce83bbe479dca4d
http://git.kernel.org/stable/c/b82d4d5c736f4fd2ed224c35f554f50d1953d21e
http://git.kernel.org/stable/c/bfc44075b19740d372f989f21dd03168bfda0689
http://git.kernel.org/stable/c/335e35b748527f0c06ded9eebb65387f60647fda

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.