#VU105434 Input validation error in Linux kernel - CVE-2024-58061

Vulnerability identifier: #VU105434

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-58061

CWE-ID: CWE-20

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the ieee80211_if_parse_active_links() function in net/mac80211/debugfs_netdev.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/18100796c11dfdea9101fdc95d2428b2093477ee
https://git.kernel.org/stable/c/270ad6776e7cf1be3b769e0447070f9d0e8269db
https://git.kernel.org/stable/c/7553477cbfd784b128297f9ed43751688415bbaa
https://git.kernel.org/stable/c/d36e48a4d81c647df8a76cc58fd4d2442ba10744
https://git.kernel.org/stable/c/dfe9a043300261afe5eadc07b867a6810c4e999a

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.