Vulnerability identifier: #VU93027

Vulnerability risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-38635

CWE-ID: CWE-125

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the sdw_cdns_alloc_pdi() function in drivers/soundwire/cadence_master.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel:

---

External links
http://git.kernel.org/stable/c/002364b2d594a9afc0385c09e00994c510b1d089
http://git.kernel.org/stable/c/fd4bcb991ebaf0d1813d81d9983cfa99f9ef5328
http://git.kernel.org/stable/c/902f6d656441a511ac25c6cffce74496db10a078
http://git.kernel.org/stable/c/2ebcaa0e5db9b6044bb487ae1cf41bc601761567
http://git.kernel.org/stable/c/7eeef1e935d23db5265233d92395bd5c648a4021
http://git.kernel.org/stable/c/4e99103f757cdf636c6ee860994a19a346a11785
http://git.kernel.org/stable/c/8ee1b439b1540ae543149b15a2a61b9dff937d91

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.