#VU102952 Input validation error in Linux kernel - CVE-2024-49571

Vulnerability identifier: #VU102952

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-49571

CWE-ID: CWE-20

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the smc_clc_msg_prop_valid() function in net/smc/smc_clc.c, within the smc_listen_prfx_check() and smc_find_ism_v1_device_serv() functions in net/smc/af_smc.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/47ce46349672a7e0c361bfe39ed0b22e824ef4fb
https://git.kernel.org/stable/c/62056d1592e63d85e82357ee2ae6a6a294f440b0
https://git.kernel.org/stable/c/846bada23bfcdeb83621b045ed85dc06c7833ff0
https://git.kernel.org/stable/c/91a7c27c1444ed4677b83fd5308d2cf03f5f0851
https://git.kernel.org/stable/c/a29e220d3c8edbf0e1beb0f028878a4a85966556
https://git.kernel.org/stable/c/f10635268a0a49ee902a3b63b5dbb76f4fed498e

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.