#VU98976 NULL pointer dereference in Linux kernel - CVE-2024-47756

Vulnerability identifier: #VU98976

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-47756

CWE-ID: CWE-476

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the ks_pcie_quirk() function in drivers/pci/controller/dwc/pci-keystone.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/c289903b7a216df5ea6e1850ddf1b958eea9921d
https://git.kernel.org/stable/c/dc5aeba07395c8dfa29bb878c8ce4d5180427221
https://git.kernel.org/stable/c/23838bef2adb714ec37b2d6141dccf4a3a70bdef
https://git.kernel.org/stable/c/e85ab507882db165c10a858d7f685a0a38f0312e
https://git.kernel.org/stable/c/72210e52e19a27f615e0b5273d2bf012d0dc318d
https://git.kernel.org/stable/c/2171c5cb2fbc3e03af7e8116cd58736c09328655
https://git.kernel.org/stable/c/6188a1c762eb9bbd444f47696eda77a5eae6207a

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.