#VU100146 Buffer overflow in Linux kernel - CVE-2024-50194

Vulnerability identifier: #VU100146

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50194

CWE-ID: CWE-119

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the arch_uprobe_analyze_insn() and arch_uprobe_skip_sstep() functions in arch/arm64/kernel/probes/uprobes.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
http://git.kernel.org/stable/c/cf60d19d40184e43d9a624e55a0da73be09e938d
http://git.kernel.org/stable/c/14841bb7a531b96e2dde37423a3b33e75147c60d
http://git.kernel.org/stable/c/8165bf83b8a64be801d59cd2532b0d1ffed74d00
http://git.kernel.org/stable/c/3d2530c65be04e93720e30f191a7cf1a3aa8b51c
http://git.kernel.org/stable/c/13f8f1e05f1dc36dbba6cba0ae03354c0dafcde7

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.