#VU100187 Input validation error in Linux kernel - CVE-2024-50218

Vulnerability identifier: #VU100187

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50218

CWE-ID: CWE-20

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the ocfs2_remove_inode_range() function in fs/ocfs2/file.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/27d95867bee806cdc448d122bd99f1d8b0544035
https://git.kernel.org/stable/c/95fbed8ae8c32c0977e6be1721c190d8fea23f2f
https://git.kernel.org/stable/c/70767689ec6ee5f05fb0a2c17d7ec1927946e486
https://git.kernel.org/stable/c/ecd62f684386fa64f9c0cea92eea361f4e6444c2
https://git.kernel.org/stable/c/2fe5d62e122b040ce7fc4d31aa7fa96ae328cefc
https://git.kernel.org/stable/c/88f97a4b5843ce21c1286e082c02a5fb4d8eb473
https://git.kernel.org/stable/c/0b6b8c2055784261de3fb641c5d0d63964318e8f
https://git.kernel.org/stable/c/bc0a2f3a73fcdac651fca64df39306d1e5ebe3b0

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.