#VU94976 NULL pointer dereference in Linux kernel - CVE-2024-41077
Vulnerability identifier: #VU94976
Vulnerability risk: Low
CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2024-41077
CWE-ID:
CWE-476
Exploitation vector: Local
Exploit availability: No
Vulnerable software:
Linux kernel
Operating systems & Components /
Operating system
Vendor: Linux Foundation
Description
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to NULL pointer dereference within the null_validate_conf() function in drivers/block/null_blk/main.c. A local user can perform a denial of service (DoS) attack.
Mitigation
Install update from vendor's website.
Vulnerable software versions
Linux kernel: All versions
External links
https://git.kernel.org/stable/c/9625afe1dd4a158a14bb50f81af9e2dac634c0b1
https://git.kernel.org/stable/c/9b873bdaae64bddade9d8c6df23c8a31948d47d0
https://git.kernel.org/stable/c/2772ed2fc075eef7df3789906fc9dae01e4e132e
https://git.kernel.org/stable/c/08f03186b96e25e3154916a2e70732557c770ea7
https://git.kernel.org/stable/c/f92409a9da02f27d05d713bff5f865e386cef9b3
https://git.kernel.org/stable/c/c462ecd659b5fce731f1d592285832fd6ad54053
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
