#VU105048 Integer overflow in Linux kernel - CVE-2024-58017

Vulnerability identifier: #VU105048

Vulnerability risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-58017

CWE-ID: CWE-190

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer overflow within the __alignof__() function in kernel/printk/printk.c. A local user can execute arbitrary code.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/3d6f83df8ff2d5de84b50377e4f0d45e25311c7a
https://git.kernel.org/stable/c/404e5fd918a0b14abec06c7eca128f04c9b98e41
https://git.kernel.org/stable/c/4a2c4e7265b8eed83c25d86d702cea06493cab18
https://git.kernel.org/stable/c/4acf6bab775dbd22a9a799030a808a7305e01d63
https://git.kernel.org/stable/c/9a6d43844de2479a3ff8d674c3e2a16172e01598

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.