Vulnerability identifier: #VU91474

Vulnerability risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-27009

CWE-ID: CWE-362

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition within the ccw_device_set_online() function in drivers/s390/cio/device.c. A local user can escalate privileges on the system.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel:

---

External links
http://git.kernel.org/stable/c/3076b3c38a704e10df5e143c213653309d532538
http://git.kernel.org/stable/c/559f3a6333397ab6cd4a696edd65a70b6be62c6e
http://git.kernel.org/stable/c/2df56f4ea769ff81e51bbb05699989603bde9c49
http://git.kernel.org/stable/c/a4234decd0fe429832ca81c4637be7248b88b49e
http://git.kernel.org/stable/c/2d8527f2f911fab84aec04df4788c0c23af3df48

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.