Vulnerability identifier: #VU89976

Vulnerability risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35930

CWE-ID: CWE-401

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the lpfc_rcv_padisc() function in drivers/scsi/lpfc/lpfc_nportdisc.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel:

---

External links
http://git.kernel.org/stable/c/edf82aa7e9eb864a09229392054d131b34a5c9e8
http://git.kernel.org/stable/c/e2cd32435b1dff3d63759476a3abc878e02fb6c8
http://git.kernel.org/stable/c/c473288f27d15014447de5a891bdf22a0695847a
http://git.kernel.org/stable/c/7849e6f8410da96384e3d1f6b6d730f095142dc7
http://git.kernel.org/stable/c/ee0b5f96b6d66a1e6698228dcb41df11ec7f352f
http://git.kernel.org/stable/c/07a2aa674fca679316b8ac51440adb895b53a7cf
http://git.kernel.org/stable/c/3320126ed3afbc11934502319b340f91a4d61c8f
http://git.kernel.org/stable/c/2ae917d4bcab80ab304b774d492e2fcd6c52c06b

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.