#VU100204 Input validation error in Linux kernel - CVE-2024-50259

Vulnerability identifier: #VU100204

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50259

CWE-ID: CWE-20

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the nsim_nexthop_bucket_activity_write() function in drivers/net/netdevsim/fib.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/c2150f666c6fc301d5d1643ed0f92251f1a0ff0d
https://git.kernel.org/stable/c/bcba86e03b3aac361ea671672cf48eed11f9011c
https://git.kernel.org/stable/c/6a604877160fe5ab2e1985d5ce1ba6a61abe0693
https://git.kernel.org/stable/c/27bd7a742e171362c9eb52ad5d1d71d3321f949f
https://git.kernel.org/stable/c/4ce1f56a1eaced2523329bef800d004e30f2f76c

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.