Vulnerability identifier: #VU93468

Vulnerability risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35947

CWE-ID: CWE-388

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an error within the ddebug_tokenize() function in lib/dynamic_debug.c. A local user can crash the OS kernel.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Linux kernel:

---

External links
http://git.kernel.org/stable/c/3c718bddddca9cbef177ac475b94c5c91147fb38
http://git.kernel.org/stable/c/343081c21e56bd6690d342e2f5ae8c00183bf081
http://git.kernel.org/stable/c/41d8ac238ab1cab01a8c71798d61903304f4e79b
http://git.kernel.org/stable/c/ba3c118cff7bcb0fe6aa84ae1f9080d50e31c561
http://git.kernel.org/stable/c/a66c869b17c4c4dcf81d273b02cb0efe88e127ab
http://git.kernel.org/stable/c/a69e1bdd777ce51061111dc419801e8a2fd241cc
http://git.kernel.org/stable/c/529e1852785599160415e964ca322ee7add7aef0
http://git.kernel.org/stable/c/00e7d3bea2ce7dac7bee1cf501fb071fd0ea8f6c
http://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OTB4HWU2PTVW5NEYHHLOCXDKG3PYA534/
http://lists.debian.org/debian-lts-announce/2024/06/msg00020.html
http://lists.debian.org/debian-lts-announce/2024/06/msg00019.html

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.