Vulnerability identifier: #VU90578

Vulnerability risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26881

CWE-ID: CWE-476

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the hclge_ptp_get_rx_hwts() function in drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel:

---

External links
http://git.kernel.org/stable/c/23ec1cec24293f9799c725941677d4e167997265
http://git.kernel.org/stable/c/b3cf70472a600bcb2efe24906bc9bc6014d4c6f6
http://git.kernel.org/stable/c/f0b5225a7dfc1bf53c98215db8c2f0b4efd3f108
http://git.kernel.org/stable/c/b2bb19114c079dcfec1ea46e761f510e30505e70
http://git.kernel.org/stable/c/11b998360d96f6c76f04a95f54b49f24d3c858e4
http://git.kernel.org/stable/c/0fbcf2366ba9888cf02eda23e35fde7f7fcc07c3

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.