#VU102272 Input validation error in Linux kernel - CVE-2024-56728

Vulnerability identifier: #VU102272

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56728

CWE-ID: CWE-20

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the otx2_get_pauseparam() and otx2_set_fecparam() functions in drivers/net/ethernet/marvell/octeontx2/nic/otx2_ethtool.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/05a6ce174c0c724e5914e1e5efd826bab8f382b4
https://git.kernel.org/stable/c/2db2194727b1f49a5096c1c3981adef1b7638733
https://git.kernel.org/stable/c/55c41b97001a09bb490ffa2e667e251d75d15ab1
https://git.kernel.org/stable/c/5ff9de1f2712cbca53da2e37d831eea7ffcb43b6
https://git.kernel.org/stable/c/6cda142cee032b8fe65ee11f78721721c3988feb
https://git.kernel.org/stable/c/c0f64fd73b60aee85f88c270c9d714ead27a7b7a
https://git.kernel.org/stable/c/e26f8eac6bb20b20fdb8f7dc695711ebce4c7c5c

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.