Vulnerability identifier: #VU93240

Vulnerability risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35938

CWE-ID: CWE-119

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the ARRAY_SIZE() function in drivers/net/wireless/ath/ath11k/mhi.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel:

---

External links
http://git.kernel.org/stable/c/805a1cdde82fec00c7471a393f4bb437b2741559
http://git.kernel.org/stable/c/6597a6687af54e2cb58371cf8f6ee4dd85c537de
http://git.kernel.org/stable/c/138fdeac75fb7512a7f9f1c3b236cd2e754af793
http://git.kernel.org/stable/c/ae5876b3b7b2243d874e2afa099e7926122087a1
http://git.kernel.org/stable/c/1cca1bddf9ef080503c15378cecf4877f7510015

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.