Vulnerability identifier: #VU95054

Vulnerability risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42145

CWE-ID: CWE-119

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the MODULE_AUTHOR(), __get_agent(), send_handler(), recv_handler() and ib_umad_read() functions in drivers/infiniband/core/user_mad.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
http://git.kernel.org/stable/c/1288cf1cceb0e6df276e182f5412370fb4169bcb
http://git.kernel.org/stable/c/b4913702419d064ec4c4bbf7270643c95cc89a1b
http://git.kernel.org/stable/c/62349fbf86b5e13b02721bdadf98c29afd1e7b5f
http://git.kernel.org/stable/c/d73cb8862e4d6760ccc94d3b57b9ef6271400607
http://git.kernel.org/stable/c/63d202d948bb6d3a28cd8e8b96b160fa53e18baa
http://git.kernel.org/stable/c/b8c5f635997f49c625178d1a0cb32a80ed33abe6
http://git.kernel.org/stable/c/a6627fba793cc75b7365d9504a0095fb2902dda4
http://git.kernel.org/stable/c/ca0b44e20a6f3032224599f02e7c8fb49525c894

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.