Vulnerability identifier: #VU95502

Vulnerability risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-42236

CWE-ID: CWE-401

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the usb_string_copy() function in drivers/usb/gadget/configfs.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel:

---

External links
http://git.kernel.org/stable/c/a444c3fc264119801575ab086e03fb4952f23fd0
http://git.kernel.org/stable/c/c95fbdde87e39e5e0ae27f28bf6711edfb985caa
http://git.kernel.org/stable/c/e8474a10c535e6a2024c3b06e37e4a3a23beb490
http://git.kernel.org/stable/c/72b8ee0d9826e8ed00e0bdfce3e46b98419b37ce
http://git.kernel.org/stable/c/2d16f63d8030903e5031853e79d731ee5d474e70
http://git.kernel.org/stable/c/d1205033e912f9332c1dbefa812e6ceb0575ce0a
http://git.kernel.org/stable/c/eecfefad0953b2f31aaefa058f7f348ff39c4bba
http://git.kernel.org/stable/c/6d3c721e686ea6c59e18289b400cc95c76e927e0

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.