Vulnerability identifier: #VU87682

Vulnerability risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26597

CWE-ID: CWE-125

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary condition in drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c when parsing the netlink attributes. A local user can trigger an out-of-bounds read error and perform a denial of service (DoS) attack.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
http://git.kernel.org/stable/c/093dab655808207f7a9f54cf156240aeafc70590
http://git.kernel.org/stable/c/02467ab8b404d80429107588e0f3425cf5fcd2e5
http://git.kernel.org/stable/c/2295c22348faf795e1ccdf618f6eb7afdb2f7447
http://git.kernel.org/stable/c/3b5254862258b595662a0ccca6e9eeb88d6e7468
http://git.kernel.org/stable/c/ee1dc3bf86f2df777038506b139371a9add02534
http://git.kernel.org/stable/c/c4734535034672f59f2652e1e0058c490da62a5c
http://git.kernel.org/stable/c/17d06a5c44d8fd2e8e61bac295b09153496f87e1
http://git.kernel.org/stable/c/b33fb5b801c6db408b774a68e7c8722796b59ecc

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.