#VU102249 Resource management error in Linux kernel - CVE-2024-53172

Vulnerability identifier: #VU102249

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-53172

CWE-ID: CWE-399

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the alloc_ai(), scan_fast() and ubi_attach() functions in drivers/mtd/ubi/attach.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/04c0b0f37617099479c34e207c5550d081f585a6
https://git.kernel.org/stable/c/3d8558135cd56a2a8052024be4073e160f36658c
https://git.kernel.org/stable/c/612824dd0c9465ef365ace38b056c663d110956d
https://git.kernel.org/stable/c/6afdcb285794e75d2c8995e3a44f523c176cc2de
https://git.kernel.org/stable/c/7402c4bcb8a3f0d2ef4e687cd45c76be489cf509
https://git.kernel.org/stable/c/871c148f8e0c32e505df9393ba4a303c3c3fe988
https://git.kernel.org/stable/c/b1ee0aa4945c49cbbd779da81040fcec4de80fd1
https://git.kernel.org/stable/c/bcddf52b7a17adcebc768d26f4e27cf79adb424c
https://git.kernel.org/stable/c/ef52b7191ac41e68b1bf070d00c5b04ed16e4920

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.