#VU95100 Input validation error in Linux kernel - CVE-2024-42098

Vulnerability identifier: #VU95100

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-42098

CWE-ID: CWE-20

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the ecdh_set_secret() function in crypto/ecdh.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/39173b04abda87872b43c331468a4a14f8f05ce8
https://git.kernel.org/stable/c/fd7ef325911eba1b7191b83cb580463242f2090d
https://git.kernel.org/stable/c/80575b252ab0358b7e93895b2a510beb3cb3f975
https://git.kernel.org/stable/c/d96187eb8e59b572a8e6a68b6a9837a867ea29df
https://git.kernel.org/stable/c/73e5984e540a76a2ee1868b91590c922da8c24c9

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.