#VU93256 Resource management error in Linux kernel - CVE-2024-35872

Vulnerability identifier: #VU93256

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-35872

CWE-ID: CWE-399

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the include/linux/secretmem.h. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/6564b014af92b677c1f07c44d7f5b595d589cf6e
https://git.kernel.org/stable/c/9c2b4b657739ecda38e3b383354a29566955ac48
https://git.kernel.org/stable/c/43fad1d0284de30159661d0badfc3cbaf7e6f8f8
https://git.kernel.org/stable/c/201e4aaf405dfd1308da54448654053004c579b5
https://git.kernel.org/stable/c/65291dcfcf8936e1b23cfd7718fdfde7cfaf7706

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.