Use of uninitialized resource in Linux kernel ipv4



| Updated: 2025-05-12
Risk Low
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2024-46865
CWE-ID CWE-908
Exploitation vector Local
Public exploit N/A
Vulnerable software
 Linux kernel
Operating systems & Components / Operating system

Vendor Linux Foundation

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) Use of uninitialized resource

EUVDB-ID: #VU97817

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-46865

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the gue_gro_receive() function in net/ipv4/fou.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: 5.10 - 6.10.10

CPE2.3 External links

https://git.kernel.org/stable/c/5d537b8d900514509622ce92330b70d2e581d409
https://git.kernel.org/stable/c/7ae890ee19479eeeb87724cca8430b5cb3660c74
https://git.kernel.org/stable/c/aca06c617c83295f0caa486ad608fbef7bdc11e8
https://git.kernel.org/stable/c/4c8002277167125078e6b9b90137bdf443ebaa08
https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.227
https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.168
https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.111
https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.10.11
https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.11
https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.52


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###