#VU102152 Improper locking in Linux kernel - CVE-2024-56751

Vulnerability identifier: #VU102152

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56751

CWE-ID: CWE-667

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the ip6_dst_ifdown(), DEFINE_SPINLOCK() and rt6_remove_exception() functions in net/ipv6/route.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/0e4c6faaef8a24b762a24ffb767280e263ef8e10
https://git.kernel.org/stable/c/43e25adc80269f917d2a195f0d59f74cdd182955
https://git.kernel.org/stable/c/a3c3f8a4d025acc8c857246ec2b812c59102487a
https://git.kernel.org/stable/c/b2f26a27ea3f72f75d18330f76f5d1007c791848
https://git.kernel.org/stable/c/eb02688c5c45c3e7af7e71f036a7144f5639cbfe

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.