#VU90431 Memory leak in Linux kernel - CVE-2024-36954

Vulnerability identifier: #VU90431

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-36954

CWE-ID: CWE-401

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the tipc_buf_append() function in net/tipc/msg.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/01cd1b7b685751ee422d00d050292a3d277652d6
https://git.kernel.org/stable/c/2f87fd9476cf9725d774e6dcb7d17859c6a6d1ae
https://git.kernel.org/stable/c/adbce6d20da6254c86425a8d4359b221b5ccbccd
https://git.kernel.org/stable/c/42c8471b0566c7539e7dd584b4d0ebd3cec8cb2c
https://git.kernel.org/stable/c/d03a82f4f8144befdc10518e732e2a60b34c870e
https://git.kernel.org/stable/c/614c5a5ae45a921595952117b2e2bd4d4bf9b574
https://git.kernel.org/stable/c/3210d34fda4caff212cb53729e6bd46de604d565
https://git.kernel.org/stable/c/97bf6f81b29a8efaf5d0983251a7450e5794370d

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.