Vulnerability identifier: #VU93033

Vulnerability risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-38662

CWE-ID: CWE-667

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the may_update_sockmap() and check_map_func_compatibility() functions in kernel/bpf/verifier.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel:

---

External links
http://git.kernel.org/stable/c/29467edc23818dc5a33042ffb4920b49b090e63d
http://git.kernel.org/stable/c/11e8ecc5b86037fec43d07b1c162e233e131b1d9
http://git.kernel.org/stable/c/6693b172f008846811f48a099f33effc26068e1e
http://git.kernel.org/stable/c/000a65bf1dc04fb2b65e2abf116f0bc0fc2ee7b1
http://git.kernel.org/stable/c/b81e1c5a3c70398cf76631ede63a03616ed1ba3c
http://git.kernel.org/stable/c/98e948fb60d41447fd8d2d0c3b8637fc6b6dc26d

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.