#VU87682 Out-of-bounds read in Linux kernel - CVE-2024-26597

Vulnerability identifier: #VU87682

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26597

CWE-ID: CWE-125

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary condition in drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c when parsing the netlink attributes. A local user can trigger an out-of-bounds read error and perform a denial of service (DoS) attack.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/093dab655808207f7a9f54cf156240aeafc70590
https://git.kernel.org/stable/c/02467ab8b404d80429107588e0f3425cf5fcd2e5
https://git.kernel.org/stable/c/2295c22348faf795e1ccdf618f6eb7afdb2f7447
https://git.kernel.org/stable/c/3b5254862258b595662a0ccca6e9eeb88d6e7468
https://git.kernel.org/stable/c/ee1dc3bf86f2df777038506b139371a9add02534
https://git.kernel.org/stable/c/c4734535034672f59f2652e1e0058c490da62a5c
https://git.kernel.org/stable/c/17d06a5c44d8fd2e8e61bac295b09153496f87e1
https://git.kernel.org/stable/c/b33fb5b801c6db408b774a68e7c8722796b59ecc

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.