#VU93154 Buffer overflow in Linux kernel - CVE-2024-27405

Vulnerability identifier: #VU93154

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-27405

CWE-ID: CWE-119

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the drivers/usb/gadget/function/f_ncm.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/059285e04ebb273d32323fbad5431c5b94f77e48
https://git.kernel.org/stable/c/a31cf46d108dabce3df80b3e5c07661e24912151
https://git.kernel.org/stable/c/57ca0e16f393bb21d69734e536e383a3a4c665fd
https://git.kernel.org/stable/c/2cb66b62a5d64ccf09b0591ab86fb085fa491fc5
https://git.kernel.org/stable/c/35b604a37ec70d68b19dafd10bbacf1db505c9ca
https://git.kernel.org/stable/c/2b7ec68869d50ea998908af43b643bca7e54577e
https://git.kernel.org/stable/c/c7f43900bc723203d7554d299a2ce844054fab8e
https://git.kernel.org/stable/c/76c51146820c5dac629f21deafab0a7039bc3ccd

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.