#VU94261 NULL pointer dereference in Linux kernel - CVE-2024-39502

Vulnerability identifier: #VU94261

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-39502

CWE-ID: CWE-476

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the ionic_qcq_enable() function in drivers/net/ethernet/pensando/ionic/ionic_lif.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/0d19267cb150e8f76ade210e16ee820a77f684e7
https://git.kernel.org/stable/c/ff9c2a9426ecf5b9631e9fd74993b357262387d6
https://git.kernel.org/stable/c/8edd18dab443863e9e48f084e7f123fca3065e4e
https://git.kernel.org/stable/c/60cd714871cd5a683353a355cbb17a685245cf84
https://git.kernel.org/stable/c/183ebc167a8a19e916b885d4bb61a3491991bfa5
https://git.kernel.org/stable/c/a87d72b37b9ec2c1e18fe36b09241d8b30334a2e
https://git.kernel.org/stable/c/79f18a41dd056115d685f3b0a419c7cd40055e13

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.