Vulnerability identifier: #VU93337

Vulnerability risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-39301

CWE-ID: CWE-908

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the p9_fcall_init() function in net/9p/client.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel:

---

External links
http://git.kernel.org/stable/c/72c5d8e416ecc46af370a1340b3db5ff0b0cc867
http://git.kernel.org/stable/c/2101901dd58c6da4924bc5efb217a1d83436290b
http://git.kernel.org/stable/c/124947855564572713d705a13be7d0c9dae16a17
http://git.kernel.org/stable/c/89969ffbeb948ffc159d19252e7469490103011b
http://git.kernel.org/stable/c/ca71f204711ad24113e8b344dc5bb8b0385f5672
http://git.kernel.org/stable/c/6c1791130b781c843572fb6391c4a4c5d857ab17
http://git.kernel.org/stable/c/fe5c604053c36c62af24eee8a76407d026ea5163
http://git.kernel.org/stable/c/25460d6f39024cc3b8241b14c7ccf0d6f11a736a

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.