Vulnerability identifier: #VU95068

Vulnerability risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42077

CWE-ID: CWE-399

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the ocfs2_extend_trans() function in fs/ocfs2/journal.c, within the ocfs2_dio_end_io_write() function in fs/ocfs2/aops.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel:

---

External links
http://git.kernel.org/stable/c/a68b896aa56e435506453ec8835bc991ec3ae687
http://git.kernel.org/stable/c/320273b5649bbcee87f9e65343077189699d2a7a
http://git.kernel.org/stable/c/9ea2d1c6789722d58ec191f14f9a02518d55b6b4
http://git.kernel.org/stable/c/c05ffb693bfb42a48ef3ee88a55b57392984e111
http://git.kernel.org/stable/c/331d1079d58206ff7dc5518185f800b412f89bc6
http://git.kernel.org/stable/c/be346c1a6eeb49d8fda827d2a9522124c2f72f36

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.