Vulnerability identifier: #VU94325

Vulnerability risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-40990

CWE-ID: CWE-20

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the mlx5_ib_create_srq() function in drivers/infiniband/hw/mlx5/srq.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
http://git.kernel.org/stable/c/7186b81c1f15e39069b1af172c6a951728ed3511
http://git.kernel.org/stable/c/1e692244bf7dd827dd72edc6c4a3b36ae572f03c
http://git.kernel.org/stable/c/999586418600b4b3b93c2a0edd3a4ca71ee759bf
http://git.kernel.org/stable/c/e0deb0e9c967b61420235f7f17a4450b4b4d6ce2
http://git.kernel.org/stable/c/4ab99e3613139f026d2d8ba954819e2876120ab3
http://git.kernel.org/stable/c/36ab7ada64caf08f10ee5a114d39964d1f91e81d

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.