#VU96154 Improper locking in Linux kernel - CVE-2024-42296
Vulnerability identifier: #VU96154
Vulnerability risk: Low
CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2024-42296
CWE-ID:
CWE-667
Exploitation vector: Local
Exploit availability: No
Vulnerable software:
Linux kernel
Operating systems & Components /
Operating system
Vendor: Linux Foundation
Description
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to improper locking within the f2fs_convert_inline_inode() function in fs/f2fs/inline.c. A local user can perform a denial of service (DoS) attack.
Mitigation
Install update from vendor's website.
Vulnerable software versions
Linux kernel: All versions
External links
https://git.kernel.org/stable/c/47a8ddcdcaccd9b891db4574795e46a33a121ac2
https://git.kernel.org/stable/c/077f0e24b27c4b44841593c7edbd1993be9eecb5
https://git.kernel.org/stable/c/1e7725814361c8c008d131db195cef8274ff26b8
https://git.kernel.org/stable/c/a8eb3de28e7a365690c61161e7a07a4fc7c60bbf
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
