#VU101111 Division by zero in Linux kernel - CVE-2024-53122

Vulnerability identifier: #VU101111

Vulnerability risk: Low

CVSSv4.0: [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53122

CWE-ID: CWE-369

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a division by zero error within the mptcp_rcv_space_adjust() function in net/mptcp/protocol.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
http://git.kernel.org/stable/c/24995851d58c4a205ad0ffa7b2f21e479a9c8527
http://git.kernel.org/stable/c/aad6412c63baa39dd813e81f16a14d976b3de2e8
http://git.kernel.org/stable/c/ce7356ae35943cc6494cc692e62d51a734062b7d
http://git.kernel.org/stable/c/ff825ab2f455299c0c7287550915a8878e2a66e0

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.