#VU94277 Improper locking in Linux kernel - CVE-2024-39501

Vulnerability identifier: #VU94277

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-39501

CWE-ID: CWE-667

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the uevent_show() function in drivers/base/core.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/bb3641a5831789d83a58a39ed4a928bcbece7080
https://git.kernel.org/stable/c/13d25e82b6d00d743c7961dcb260329f86bedf7c
https://git.kernel.org/stable/c/760603e30bf19d7b4c28e9d81f18b54fa3b745ad
https://git.kernel.org/stable/c/ec772ed7cb21b46fb132f89241682553efd0b721
https://git.kernel.org/stable/c/08891eeaa97c079b7f95d60b62dcf0e3ce034b69
https://git.kernel.org/stable/c/a42b0060d6ff2f7e59290a26d5f162a3c6329b90
https://git.kernel.org/stable/c/95d03d369ea647b89e950667f1c3363ea6f564e6
https://git.kernel.org/stable/c/c0a40097f0bc81deafc15f9195d1fb54595cd6d0

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.