#VU93449 Improper error handling in Linux kernel - CVE-2024-36929
Published: June 27, 2024 / Updated: May 13, 2025
Vulnerability identifier: #VU93449
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2024-36929
CWE-ID: CWE-388
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerable software:
Linux kernel
Linux kernel
Software vendor:
Linux Foundation
Linux Foundation
Description
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to improper error handling within the skb_alloc_rx_flag() and skb_copy_expand() functions in net/core/skbuff.c. A local user can perform a denial of service (DoS) attack.
Remediation
Install update from vendor's website.
External links
- https://git.kernel.org/stable/c/faa83a7797f06cefed86731ba4baa3b4dfdc06c1
- https://git.kernel.org/stable/c/c7af99cc21923a9650533c9d77265c8dd683a533
- https://git.kernel.org/stable/c/989bf6fd1e1d058e73a364dce1a0c53d33373f62
- https://git.kernel.org/stable/c/cfe34d86ef9765c388f145039006bb79b6c81ac6
- https://git.kernel.org/stable/c/aea5e2669c2863fdd8679c40ee310b3bcaa85aec
- https://git.kernel.org/stable/c/d091e579b864fa790dd6a0cd537a22c383126681
- https://lists.debian.org/debian-lts-announce/2024/06/msg00019.html
- https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.217
- https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.159
- https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.91
- https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.31
- https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.8.10