Vulnerability identifier: #VU93200

Vulnerability risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26877

CWE-ID: CWE-399

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the zynqmp_handle_aes_req() function in drivers/crypto/xilinx/zynqmp-aes-gcm.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel:

---

External links
http://git.kernel.org/stable/c/8a01335aedc50a66d04dd39203c89f4bc8042596
http://git.kernel.org/stable/c/03e6d4e948432a61b35783323b6ab2be071d2619
http://git.kernel.org/stable/c/a71f66bd5f7b9b35a8aaa49e29565eca66299399
http://git.kernel.org/stable/c/23bc89fdce71124cd2126fc919c7076e7cb489cf
http://git.kernel.org/stable/c/9db89b1fb85557892e6681724b367287de5f9f20
http://git.kernel.org/stable/c/dbf291d8ffffb70f48286176a15c6c54f0bb0743
http://git.kernel.org/stable/c/a853450bf4c752e664abab0b2fad395b7ad7701c

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.