#VU102492 Resource management error in Linux kernel - CVE-2024-56781

Vulnerability identifier: #VU102492

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-56781

CWE-ID: CWE-399

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the fixup_device_tree_chrp(), fixup_device_tree_pmac() and fixup_device_tree() functions in arch/powerpc/kernel/prom_init.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: 5.15 - 5.15.173

---

External links
https://git.kernel.org/stable/c/0b94d838018fb0a824e0cd3149034928c99fb1b7
https://git.kernel.org/stable/c/296a109fa77110ba5267fe0e90a26005eecc2726
https://git.kernel.org/stable/c/691284c2cd33ffaa0b35ce53b3286b90621e9dc9
https://git.kernel.org/stable/c/6d5f0453a2228607333bff0c85238a3cb495d194
https://git.kernel.org/stable/c/a79a7e3c03ae2a07f68b5f24d5ed549f9799ec89
https://git.kernel.org/stable/c/cf89c9434af122f28a3552e6f9cc5158c33ce50a
https://git.kernel.org/stable/c/ee68554d2c03e32077f7b984e5289fdb005036d2
https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.174

---

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?