#VU98916 Out-of-bounds read in Linux kernel - CVE-2024-47682
Vulnerability identifier: #VU98916
Vulnerability risk: Low
CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2024-47682
CWE-ID:
CWE-125
Exploitation vector: Local
Exploit availability: No
Vulnerable software:
Linux kernel
Operating systems & Components /
Operating system
Vendor: Linux Foundation
Description
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to an out-of-bounds read error within the sd_read_block_characteristics() function in drivers/scsi/sd.c. A local user can perform a denial of service (DoS) attack.
Mitigation
Install update from vendor's website.
Vulnerable software versions
Linux kernel: All versions
External links
https://git.kernel.org/stable/c/60312ae7392f9c75c6591a52fc359cf7f810d48f
https://git.kernel.org/stable/c/568c7c4c77eee6df7677bb861b7cee7398a3255d
https://git.kernel.org/stable/c/a776050373893e4c847a49abeae2ccb581153df0
https://git.kernel.org/stable/c/413df704f149dec585df07466d2401bbd1f490a0
https://git.kernel.org/stable/c/f81eaf08385ddd474a2f41595a7757502870c0eb
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
