#VU97287 Buffer overflow in Linux kernel - CVE-2024-46675

Vulnerability identifier: #VU97287

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-46675

CWE-ID: CWE-119

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the dwc3_event_buffers_setup() function in drivers/usb/dwc3/core.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/eca3f543f817da87c00d1a5697b473efb548204f
https://git.kernel.org/stable/c/d2afc2bffec77316b90d530b07695e3f534df914
https://git.kernel.org/stable/c/b72da4d89b97da71e056cc4d1429b2bc426a9c2f
https://git.kernel.org/stable/c/111277b881def3153335acfe0d1f43e6cd83ac93
https://git.kernel.org/stable/c/2189fd13c577d7881f94affc09c950a795064c4b
https://git.kernel.org/stable/c/7bb11a75dd4d3612378b90e2a4aa49bdccea28ab
https://git.kernel.org/stable/c/e23f6ad8d110bf632f7471482e10b43dc174fb72
https://git.kernel.org/stable/c/14e497183df28c006603cc67fd3797a537eef7b9

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.