#VU98380 Input validation error in Linux kernel - CVE-2024-47667

Vulnerability identifier: #VU98380

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-47667

CWE-ID: CWE-20

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the RTL GENMASK(), to_keystone_pcie(), ks_pcie_start_link() and ks_pcie_quirk() functions in drivers/pci/controller/dwc/pci-keystone.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
http://git.kernel.org/stable/c/cfb006e185f64edbbdf7869eac352442bc76b8f6
http://git.kernel.org/stable/c/ebbdbbc580c1695dec283d0ba6448729dc993246
http://git.kernel.org/stable/c/135843c351c08df72bdd4b4ebea53c8052a76881
http://git.kernel.org/stable/c/af218c803fe298ddf00abef331aa526b20d7ea61
http://git.kernel.org/stable/c/576d0fb6f8d4bd4695e70eee173a1b9c7bae9572
http://git.kernel.org/stable/c/dd47051c76c8acd8cb983f01b4d1265da29cb66a
http://git.kernel.org/stable/c/86f271f22bbb6391410a07e08d6ca3757fda01fa

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.