Vulnerability identifier: #VU91463

Vulnerability risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36952

CWE-ID: CWE-362

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition within the lpfc_vport_delete() function in drivers/scsi/lpfc/lpfc_vport.c. A local user can escalate privileges on the system.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
http://git.kernel.org/stable/c/f2c7f029051edc4b394bb48edbe2297575abefe0
http://git.kernel.org/stable/c/0936809d968ecf81e0726fbd02ff2a5732d960c3
http://git.kernel.org/stable/c/76337eb8daee32bcc67742efab3168ed4ca299d0
http://git.kernel.org/stable/c/718602cd15f4c5710850090ea3066a89eeb46278
http://git.kernel.org/stable/c/4ddf01f2f1504fa08b766e8cfeec558e9f8eef6c

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.