#VU99038 Input validation error in Linux kernel - CVE-2024-50045

Vulnerability identifier: #VU99038

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-50045

CWE-ID: CWE-20

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the br_nf_dev_queue_xmit() function in net/bridge/br_netfilter_hooks.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
http://git.kernel.org/stable/c/cce8419b8168f6e7eb637103a47f916f3de8bc81
http://git.kernel.org/stable/c/95c0cff5a1a5d28bf623b92eb5d1a8f56ed30803
http://git.kernel.org/stable/c/78ed917133b118661e1fe62d4a85d5d428ee9568
http://git.kernel.org/stable/c/3453f5839420bfbb85c86c61e49f49ffd0f041c4
http://git.kernel.org/stable/c/915717e0bb9837cc5c101bc545af487bd787239e
http://git.kernel.org/stable/c/f9ff7665cd128012868098bbd07e28993e314fdb

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.