#VU100133 Improper error handling in Linux kernel - CVE-2024-50176

Vulnerability identifier: #VU100133

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50176

CWE-ID: CWE-388

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the dev_err() and rproc_del() functions in drivers/remoteproc/ti_k3_r5_remoteproc.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/87ab3af7447791d0c619610fd560bd804549e187
https://git.kernel.org/stable/c/fc71c23958931713b5e76f317b76be37189f2516
https://git.kernel.org/stable/c/afd102bde99d90ef41e043c846ea34b04433eb7b
https://git.kernel.org/stable/c/7afb5e3aa989c479979faeb18768a67889a7a9c6
https://git.kernel.org/stable/c/9ab27eb5866ccbf57715cfdba4b03d57776092fb

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.