#VU99192 Buffer overflow in Linux kernel - CVE-2024-49995

Vulnerability identifier: #VU99192

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-49995

CWE-ID: CWE-119

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the bearer_name_validate() function in net/tipc/bearer.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
http://git.kernel.org/stable/c/e2b2558971e02ca33eb637a8350d68a48b3e8e46
http://git.kernel.org/stable/c/54dae0e9063ed23c9acf8d5ab9b18d3426a8ac18
http://git.kernel.org/stable/c/80c0be7bcf940ce9308311575c3aff8983c9b97a
http://git.kernel.org/stable/c/12d26aa7fd3cbdbc5149b6e516563478d575026e
http://git.kernel.org/stable/c/2ed7f42dfd3edb387034128ca5b0f639836d4ddd
http://git.kernel.org/stable/c/a18c7b239d02aafb791ae2c45226f6bb40641792
http://git.kernel.org/stable/c/6555a2a9212be6983d2319d65276484f7c5f431a

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.