#VU99193 Buffer overflow in Linux kernel - CVE-2024-49997

Vulnerability identifier: #VU99193

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-49997

CWE-ID: CWE-119

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the ltq_etop_tx() function in drivers/net/ethernet/lantiq_etop.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/185df159843d30fb71f821e7ea4368c2a3bfcd36
https://git.kernel.org/stable/c/469856f76f4802c5d7e3d20e343185188de1e2db
https://git.kernel.org/stable/c/2bf4c101d7c99483b8b15a0c8f881e3f399f7e18
https://git.kernel.org/stable/c/e66e38d07b31e177ca430758ed97fbc79f27d966
https://git.kernel.org/stable/c/1097bf16501ed5e35358d848b0a94ad2830b0f65
https://git.kernel.org/stable/c/431b122933b197820d319eb3987a67d04346ce9e
https://git.kernel.org/stable/c/45c0de18ff2dc9af01236380404bbd6a46502c69

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.