#VU99221 Input validation error in Linux kernel - CVE-2024-49977

Vulnerability identifier: #VU99221

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-49977

CWE-ID: CWE-20

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the tc_setup_cbs() function in drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/e33fe25b1efe4f2e6a5858786dbc82ae4c44ed4c
https://git.kernel.org/stable/c/b0da9504a528f05f97d926b4db74ff21917a33e9
https://git.kernel.org/stable/c/5d43e1ad4567d67af2b42d3ab7c14152ffed25c6
https://git.kernel.org/stable/c/03582f4752427f60817d896f1a827aff772bd31e
https://git.kernel.org/stable/c/e297a2bf56d12fd7f91a0c209eb6ea84361f3368
https://git.kernel.org/stable/c/837d9df9c0792902710149d1a5e0991520af0f93
https://git.kernel.org/stable/c/675faf5a14c14a2be0b870db30a70764df81e2df

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.