Vulnerability identifier: #VU92068

Vulnerability risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36008

CWE-ID: CWE-476

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the ip_route_use_hint() function in net/ipv4/route.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel:

---

External links
http://git.kernel.org/stable/c/7da0f91681c4902bc5c210356fdd963b04d5d1d4
http://git.kernel.org/stable/c/03b5a9b2b526862b21bcc31976e393a6e63785d1
http://git.kernel.org/stable/c/7a25bfd12733a8f38f8ca47c581f876c3d481ac0
http://git.kernel.org/stable/c/8240c7308c941db4d9a0a91b54eca843c616a655
http://git.kernel.org/stable/c/c71ea3534ec0936fc57e6fb271c7cc6a2f68c295
http://git.kernel.org/stable/c/58a4c9b1e5a3e53c9148e80b90e1e43897ce77d1

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.