Vulnerability identifier: #VU97256

Vulnerability risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-46707

CWE-ID: CWE-476

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the access_gic_sgi() function in arch/arm64/kvm/sys_regs.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel:

---

External links
http://git.kernel.org/stable/c/15818af2f7aa55eff375333cb7689df15d3f24ef
http://git.kernel.org/stable/c/96b076e8ee5bc3a1126848c8add0f74bd30dc9d1
http://git.kernel.org/stable/c/94d4fbad01b19ec5eab3d6b50aaec4f9db8b2d8d
http://git.kernel.org/stable/c/9d7629bec5c3f80bd0e3bf8103c06a2f7046bd92
http://git.kernel.org/stable/c/2073132f6ed3079369e857a8deb33d11bdd983bc
http://git.kernel.org/stable/c/3e6245ebe7ef341639e9a7e402b3ade8ad45a19f

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.