#VU94277 Improper locking in Linux kernel - CVE-2024-39501

Vulnerability identifier: #VU94277

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-39501

CWE-ID: CWE-667

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the uevent_show() function in drivers/base/core.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
http://git.kernel.org/stable/c/bb3641a5831789d83a58a39ed4a928bcbece7080
http://git.kernel.org/stable/c/13d25e82b6d00d743c7961dcb260329f86bedf7c
http://git.kernel.org/stable/c/760603e30bf19d7b4c28e9d81f18b54fa3b745ad
http://git.kernel.org/stable/c/ec772ed7cb21b46fb132f89241682553efd0b721
http://git.kernel.org/stable/c/08891eeaa97c079b7f95d60b62dcf0e3ce034b69
http://git.kernel.org/stable/c/a42b0060d6ff2f7e59290a26d5f162a3c6329b90
http://git.kernel.org/stable/c/95d03d369ea647b89e950667f1c3363ea6f564e6
http://git.kernel.org/stable/c/c0a40097f0bc81deafc15f9195d1fb54595cd6d0

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.