#VU94988 Improper locking in Linux kernel - CVE-2024-42090

Vulnerability identifier: #VU94988

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42090

CWE-ID: CWE-667

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the create_pinctrl() function in drivers/pinctrl/core.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
http://git.kernel.org/stable/c/e65a0dc2e85efb28e182aca50218e8a056d0ce04
http://git.kernel.org/stable/c/420ce1261907e5dbeda1e4daffd5b6c76f8188c0
http://git.kernel.org/stable/c/b813e3fd102a959c5b208ed68afe27e0137a561b
http://git.kernel.org/stable/c/01fe2f885f7813f8aed5d3704b384a97b1116a9e
http://git.kernel.org/stable/c/b36efd2e3e22a329444b6b24fa48df6d20ae66e6
http://git.kernel.org/stable/c/4038c57bf61631219b31f1bd6e92106ec7f084dc
http://git.kernel.org/stable/c/48a7a7c9571c3e62f17012dd7f2063e926179ddd
http://git.kernel.org/stable/c/adec57ff8e66aee632f3dd1f93787c13d112b7a1

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.