#VU90304 Out-of-bounds read in Linux kernel - CVE-2024-35970

Vulnerability identifier: #VU90304

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-35970

CWE-ID: CWE-125

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the manage_oob() function in net/unix/af_unix.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
http://git.kernel.org/stable/c/b4bc99d04c689b5652665394ae8d3e02fb754153
http://git.kernel.org/stable/c/84a352b7eba1142a95441380058985ff19f25ec9
http://git.kernel.org/stable/c/601a89ea24d05089debfa2dc896ea9f5937ac7a6
http://git.kernel.org/stable/c/698a95ade1a00e6494482046902b986dfffd1caf
http://git.kernel.org/stable/c/b46f4eaa4f0ec38909fb0072eea3aeddb32f954e

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.