Use of uninitialized resource in Linux kernel 9p



| Updated: 2025-05-13
Risk Low
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2024-39301
CWE-ID CWE-908
Exploitation vector Local
Public exploit N/A
Vulnerable software
 Linux kernel
Operating systems & Components / Operating system

Vendor Linux Foundation

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) Use of uninitialized resource

EUVDB-ID: #VU93337

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-39301

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the p9_fcall_init() function in net/9p/client.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: 4.19 - 6.6.33

CPE2.3 External links

https://git.kernel.org/stable/c/72c5d8e416ecc46af370a1340b3db5ff0b0cc867
https://git.kernel.org/stable/c/2101901dd58c6da4924bc5efb217a1d83436290b
https://git.kernel.org/stable/c/124947855564572713d705a13be7d0c9dae16a17
https://git.kernel.org/stable/c/89969ffbeb948ffc159d19252e7469490103011b
https://git.kernel.org/stable/c/ca71f204711ad24113e8b344dc5bb8b0385f5672
https://git.kernel.org/stable/c/6c1791130b781c843572fb6391c4a4c5d857ab17
https://git.kernel.org/stable/c/fe5c604053c36c62af24eee8a76407d026ea5163
https://git.kernel.org/stable/c/25460d6f39024cc3b8241b14c7ccf0d6f11a736a
https://mirrors.edge.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.316
https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.219
https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.161
https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.278
https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.94
https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.10
https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.34


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###