#VU93202 Resource management error in Linux kernel - CVE-2024-27437

Vulnerability identifier: #VU93202

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-27437

CWE-ID: CWE-399

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the vfio_intx_set_signal() function in drivers/vfio/pci/vfio_pci_intrs.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/139dfcc4d723ab13469881200c7d80f49d776060
https://git.kernel.org/stable/c/2a4a666c45107206605b7b5bc20545f8aabc4fa2
https://git.kernel.org/stable/c/3b3491ad0f80d913e7d255941d4470f4a4d9bfda
https://git.kernel.org/stable/c/bf0bc84a20e6109ab07d5dc072067bd01eb931ec
https://git.kernel.org/stable/c/fe9a7082684eb059b925c535682e68c34d487d43
https://git.kernel.org/stable/c/b7a2f0955ffceffadfe098b40b50307431f45438
https://git.kernel.org/stable/c/26389925d6c2126fb777821a0a983adca7ee6351
https://git.kernel.org/stable/c/561d5e1998d58b54ce2bbbb3e843b669aa0b3db5

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.