#VU93200 Resource management error in Linux kernel - CVE-2024-26877

Vulnerability identifier: #VU93200

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-26877

CWE-ID: CWE-399

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the zynqmp_handle_aes_req() function in drivers/crypto/xilinx/zynqmp-aes-gcm.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/8a01335aedc50a66d04dd39203c89f4bc8042596
https://git.kernel.org/stable/c/03e6d4e948432a61b35783323b6ab2be071d2619
https://git.kernel.org/stable/c/a71f66bd5f7b9b35a8aaa49e29565eca66299399
https://git.kernel.org/stable/c/23bc89fdce71124cd2126fc919c7076e7cb489cf
https://git.kernel.org/stable/c/9db89b1fb85557892e6681724b367287de5f9f20
https://git.kernel.org/stable/c/dbf291d8ffffb70f48286176a15c6c54f0bb0743
https://git.kernel.org/stable/c/a853450bf4c752e664abab0b2fad395b7ad7701c

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.