#VU100186 Improper locking in Linux kernel - CVE-2024-50249

Vulnerability identifier: #VU100186

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50249

CWE-ID: CWE-667

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the acpi_cppc_processor_probe() and cpc_write() functions in drivers/acpi/cppc_acpi.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/c46d6b02588000c27b7b869388c2c0278bd0d173
https://git.kernel.org/stable/c/23039b4aaf1e82e0feea1060834d4ec34262e453
https://git.kernel.org/stable/c/0eb2b767c42fac61ab23c4063eb456baa4c2c262
https://git.kernel.org/stable/c/43b1df48d1e7000a214acd1a81b8012ca8a929c8
https://git.kernel.org/stable/c/1c10941e34c5fdc0357e46a25bd130d9cf40b925

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.