#VU93676 Input validation error in Linux kernel - CVE-2024-35983

Vulnerability identifier: #VU93676

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-35983

CWE-ID: CWE-20

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the main() function in kernel/bounds.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/d34a516f2635090d36a306f84573e8de3d7374ce
https://git.kernel.org/stable/c/66297b2ceda841f809637731d287bda3a93b49d8
https://git.kernel.org/stable/c/93ba36238db6a74a82feb3dc476e25ea424ad630
https://git.kernel.org/stable/c/9b7c5004d7c5ae062134052a85290869a015814c
https://git.kernel.org/stable/c/15aa09d6d84629eb5296de30ac0aa19a33512f16
https://git.kernel.org/stable/c/ebfe41889b762f1933c6762f6624b9724a25bee0
https://git.kernel.org/stable/c/5af385f5f4cddf908f663974847a4083b2ff2c79
https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.