Vulnerability identifier: #VU94323

Vulnerability risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-40971

CWE-ID: CWE-20

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the default_options() function in fs/f2fs/super.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel:

---

External links
http://git.kernel.org/stable/c/38a82c8d00638bb642bef787eb1d5e0e4d3b7d71
http://git.kernel.org/stable/c/724429db09e21ee153fef35e34342279d33df6ae
http://git.kernel.org/stable/c/a9cea0489c562c97cd56bb345e78939f9909e7f4
http://git.kernel.org/stable/c/eddeb8d941d5be11a9da5637dbe81ac37e8449a2
http://git.kernel.org/stable/c/ae39c8ec4250d2a35ddaab1c40faacfec306ff66
http://git.kernel.org/stable/c/ac5eecf481c29942eb9a862e758c0c8b68090c33

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.