Improper locking in Linux kernel quota

1) Improper locking

EUVDB-ID: #VU102489

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-56780

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the dquot_writeback_dquots() function in fs/quota/dquot.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

CPE2.3

• cpe:2.3:o:linux_foundation:linux_kernel:*:*:*:*:*:*:*:*

External links

http://git.kernel.org/stable/c/3e6ff207cd5bd924ad94cd1a7c633bcdac0ba1cb
http://git.kernel.org/stable/c/6f3821acd7c3143145999248087de5fb4b48cf26
http://git.kernel.org/stable/c/8ea87e34792258825d290f4dc5216276e91cb224
http://git.kernel.org/stable/c/a5abba5e0e586e258ded3e798fe5f69c66fec198
http://git.kernel.org/stable/c/ab6cfcf8ed2c7496f55d020b65b1d8cd55d9a2cb
http://git.kernel.org/stable/c/ac6f420291b3fee1113f21d612fa88b628afab5b
http://git.kernel.org/stable/c/bcacb52a985f1b6d280f698a470b873dfe52728a

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.