CVE-2024-0639: linux linux_kernel Deadlock

Vulnerability summary

CVE-2024-0639 is a medium (CVSS 5.5) Deadlock vulnerability in linux linux_kernel. EPSS estimates a 0.18% chance of exploitation in the next 30 days, higher than 6.7% of scored vulnerabilities.

Timeline

1. 17-01-2024
   PublishedVulnerability first disclosed.
2. 21-07-2026
   Last modifiedVulnerability information updated.

Description

A denial of service vulnerability due to a deadlock was found in sctp_auto_asconf_init in net/sctp/socket.c in the Linux kernel’s SCTP subsystem. This flaw allows guests with local user privileges to trigger a deadlock and potentially crash the system.

• CWE-833DeadlockThe product contains multiple threads or executable segments that are waiting for each other to release a necessary lock, resulting in deadlock.
• CWE-667Improper LockingThe product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.