Vulnerability identifier: #VU91638

Vulnerability risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35877

CWE-ID: CWE-401

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the follow_phys() function in mm/memory.c, within the is_cow_mapping(), free_pfn_range() and untrack_pfn() functions in arch/x86/mm/pat.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel:

---

External links
http://git.kernel.org/stable/c/f18681daaec9665a15c5e7e0f591aad5d0ac622b
http://git.kernel.org/stable/c/09e6bb53217bf388a0d2fd7fb21e74ab9dffc173
http://git.kernel.org/stable/c/c2b2430b48f3c9eaccd2c3d2ad75bb540d4952f4
http://git.kernel.org/stable/c/7cfee26d1950250b14c5cb0a37b142f3fcc6396a
http://git.kernel.org/stable/c/97e93367e82752e475a33839a80b33bdbef1209f
http://git.kernel.org/stable/c/51b7841f3fe84606ec0bd8da859d22e05e5419ec
http://git.kernel.org/stable/c/1341e4b32e1fb1b0acd002ccd56f07bd32f2abc6
http://git.kernel.org/stable/c/04c35ab3bdae7fefbd7c7a7355f29fa03a035221

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.