#VU102133 NULL pointer dereference in Linux kernel - CVE-2024-53217

Vulnerability identifier: #VU102133

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53217

CWE-ID: CWE-476

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the nfsd4_process_cb_update() function in fs/nfsd/nfs4callback.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/03178cd8f67227015debb700123987fe96275cd1
https://git.kernel.org/stable/c/0c3b0e326f838787d229314d4de83af9c53347e8
https://git.kernel.org/stable/c/1e02c641c3a43c88cecc08402000418e15578d38
https://git.kernel.org/stable/c/4a4ffc1aa9d618e41ad9151f40966e402e58a5a2
https://git.kernel.org/stable/c/752a75811f27300fe8131b0a1efc91960f6f88e7
https://git.kernel.org/stable/c/c5d90f9302742985a5078e42ac38de42c364c44a
https://git.kernel.org/stable/c/cac1405e3ff6685a438e910ad719e0cf06af90ee
https://git.kernel.org/stable/c/d9a0d1f6e15859ea7a86a327f28491e23deaaa62
https://git.kernel.org/stable/c/eb51733ae5fc73d95bd857d5da26f9f65b202a79

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.