#VU98985 NULL pointer dereference in Linux kernel - CVE-2024-47699

Vulnerability identifier: #VU98985

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-47699

CWE-ID: CWE-476

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the nilfs_btree_root_broken() function in fs/nilfs2/btree.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
http://git.kernel.org/stable/c/24bf40740a3da6b4056721da34997ae6938f3da1
http://git.kernel.org/stable/c/73d23ecf234b7a6d47fb883f2dabe10e3230b31d
http://git.kernel.org/stable/c/f68523e0f26faade18833fbef577a4295d8e2c94
http://git.kernel.org/stable/c/21839b6fbc3c41b3e374ecbdb0cabbbb2c53cf34
http://git.kernel.org/stable/c/db73500d3f0e558eb642aae1d4782e7726b4a03f
http://git.kernel.org/stable/c/3644554d308ddf2669e459a1551a7edf60b2d62b
http://git.kernel.org/stable/c/9403001ad65ae4f4c5de368bdda3a0636b51d51a

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.