Vulnerability identifier: #VU90752

Vulnerability risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35895

CWE-ID: CWE-667

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the __sock_map_delete() and sock_hash_delete_elem() functions in net/core/sock_map.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
http://git.kernel.org/stable/c/f7990498b05ac41f7d6a190dc0418ef1d21bf058
http://git.kernel.org/stable/c/dd54b48db0c822ae7b520bc80751f0a0a173ef75
http://git.kernel.org/stable/c/d1e73fb19a4c872d7a399ad3c66e8ca30e0875ec
http://git.kernel.org/stable/c/a44770fed86515eedb5a7c00b787f847ebb134a5
http://git.kernel.org/stable/c/668b3074aa14829e2ac2759799537a93b60fef86
http://git.kernel.org/stable/c/6af057ccdd8e7619960aca1f0428339f213b31cd
http://git.kernel.org/stable/c/ff91059932401894e6c86341915615c5eb0eca48

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.