#VU100649 Improper resource shutdown or release in Linux kernel - CVE-2024-50269

Vulnerability identifier: #VU100649

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50269

CWE-ID: CWE-404

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to failure to properly release resources within the sunxi_musb_exit() function in drivers/usb/musb/sunxi.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/721ddad945596220c123eb6f7126729fe277ee4f
https://git.kernel.org/stable/c/4aa77d5ea9944468e16c3eed15e858fd5de44de1
https://git.kernel.org/stable/c/6e2848d1c8c0139161e69ac0a94133e90e9988e8
https://git.kernel.org/stable/c/63559ba8077cbadae1c92a65b73ea522bf377dd9
https://git.kernel.org/stable/c/ccd811c304d2ee56189bfbc49302cb3c44361893
https://git.kernel.org/stable/c/8a30da5aa9609663b3e05bcc91a916537f66a4cd
https://git.kernel.org/stable/c/b08baa75b989cf779cbfa0969681f8ba2dc46569
https://git.kernel.org/stable/c/498dbd9aea205db9da674994b74c7bf8e18448bd

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.