#VU102928 NULL pointer dereference in Linux kernel - CVE-2024-53680
Vulnerability identifier: #VU102928
Vulnerability risk: Low
CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2024-53680
CWE-ID:
CWE-476
Exploitation vector: Local
Exploit availability: No
Vulnerable software:
Linux kernel
Operating systems & Components /
Operating system
Vendor: Linux Foundation
Description
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to NULL pointer dereference within the ip_vs_protocol_net_cleanup() and ip_vs_protocol_init() functions in net/netfilter/ipvs/ip_vs_proto.c. A local user can perform a denial of service (DoS) attack.
Mitigation
Install update from vendor's website.
Vulnerable software versions
Linux kernel: All versions
External links
https://git.kernel.org/stable/c/0b2cbed82b7c6504a8a0fbd181f92dd56b432c12
https://git.kernel.org/stable/c/124834133b32f9386bb2d8581d9ab92f65e951e4
https://git.kernel.org/stable/c/146b6f1112eb30a19776d6c323c994e9d67790db
https://git.kernel.org/stable/c/31d1ddc1ce8e8d3f101a679243abb42a313ee88a
https://git.kernel.org/stable/c/48130002e64fd191b7d18efeb4d253fcc23e4688
https://git.kernel.org/stable/c/664d0feab92495b6a27edc3d1119e232c0fe8b2b
https://git.kernel.org/stable/c/d6e1776f51c95827142f1d7064118e255e2deec1
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
