#VU94207 Memory leak in Linux kernel - CVE-2024-40942

Vulnerability identifier: #VU94207

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-40942

CWE-ID: CWE-401

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the mesh_path_discard_frame() function in net/mac80211/mesh_pathtbl.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/377dbb220edc8421b7960691876c5b3bef62f89b
https://git.kernel.org/stable/c/ec79670eae430b3ffb7e0a6417ad7657728b8f95
https://git.kernel.org/stable/c/7518e20a189f8659b8b83969db4d33a4068fcfc3
https://git.kernel.org/stable/c/c4c865f971fd4a255208f57ef04d814c2ae9e0dc
https://git.kernel.org/stable/c/617dadbfb2d3e152c5753e28356d189c9d6f33c0
https://git.kernel.org/stable/c/63d5f89bb5664d60edbf8cf0df911aaae8ed96a4
https://git.kernel.org/stable/c/d81e244af521de63ad2883e17571b789c39b6549
https://git.kernel.org/stable/c/b7d7f11a291830fdf69d3301075dd0fb347ced84

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.