CVE-2024-42272

CVE Details

Release Date:

2024-08-17

Description

In the Linux kernel, the following vulnerability has been resolved:\nsched: act_ct: take care of padding in struct zones_ht_key\nBlamed commit increased lookup key size from 2 bytes to 16 bytes,\nbecause zones_ht_key got a struct net pointer.\nMake sure rhashtable_lookup() is not using the padding bytes\nwhich are not initialized.\nBUG: KMSAN: uninit-value in rht_ptr_rcu include/linux/rhashtable.h:376 [inline]\nBUG: KMSAN: uninit-value in __rhashtable_lookup include/linux/rhashtable.h:607 [inline]\nBUG: KMSAN: uninit-value in rhashtable_lookup include/linux/rhashtable.h:646 [inline]\nBUG: KMSAN: uninit-value in rhashtable_lookup_fast include/linux/rhashtable.h:672 [inline]\nBUG: KMSAN: uninit-value in tcf_ct_flow_table_get+0x611/0x2260 net/sched/act_ct.c:329\nrht_ptr_rcu include/linux/rhashtable.h:376 [inline]\n__rhashtable_lookup include/linux/rhashtable.h:607 [inline]\nrhashtable_lookup include/linux/rhashtable.h:646 [inline]\nrhashtable_lookup_fast include/linux/rhashtable.h:672 [inline]\ntcf_ct_flow_table_get+0x611/0x2260 net/sched/act_ct.c:329\ntcf_ct_init+0xa67/0x2890 net/sched/act_ct.c:1408\ntcf_action_init_1+0x6cc/0xb30 net/sched/act_api.c:1425\ntcf_action_init+0x458/0xf00 net/sched/act_api.c:1488\ntcf_action_add net/sched/act_api.c:2061 [inline]\ntc_ctl_action+0x4be/0x19d0 net/sched/act_api.c:2118\nrtnetlink_rcv_msg+0x12fc/0x1410 net/core/rtnetlink.c:6647\nnetlink_rcv_skb+0x375/0x650 net/netlink/af_netlink.c:2550\nrtnetlink_rcv+0x34/0x40 net/core/rtnetlink.c:6665\nnetlink_unicast_kernel net/netlink/af_netlink.c:1331 [inline]\nnetlink_unicast+0xf52/0x1260 net/netlink/af_netlink.c:1357\nnetlink_sendmsg+0x10da/0x11e0 net/netlink/af_netlink.c:1901\nsock_sendmsg_nosec net/socket.c:730 [inline]\n__sock_sendmsg+0x30f/0x380 net/socket.c:745\n____sys_sendmsg+0x877/0xb60 net/socket.c:2597\n___sys_sendmsg+0x28d/0x3c0 net/socket.c:2651\n__sys_sendmsg net/socket.c:2680 [inline]\n__do_sys_sendmsg net/socket.c:2689 [inline]\n__se_sys_sendmsg net/socket.c:2687 [inline]\n__x64_sys_sendmsg+0x307/0x4a0 net/socket.c:2687\nx64_sys_call+0x2dd6/0x3c10 arch/x86/include/generated/asm/syscalls_64.h:47\ndo_syscall_x64 arch/x86/entry/common.c:52 [inline]\ndo_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83\nentry_SYSCALL_64_after_hwframe+0x77/0x7f\nLocal variable key created at:\ntcf_ct_flow_table_get+0x4a/0x2260 net/sched/act_ct.c:324\ntcf_ct_init+0xa67/0x2890 net/sched/act_ct.c:1408

See more information about CVE-2024-42272 from MITRE CVE dictionary and NIST NVD

CVSS Scoring

NOTE: The following CVSS v3.1 metrics and score provided are preliminary and subject to review.

Base Score:	5.5	CVSS Vector:	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector:	Local network	Attack Complexity:	Low
Privileges Required:	Low	User Interaction:	None
Scope:	Unchanged	Confidentiality Impact:	None
Integrity Impact:	None	Availability Impact:	High

Errata information

Platform	Errata	Release Date
Oracle Linux version 8 (kernel-uek)	ELSA-2024-12682	2024-09-23
Oracle Linux version 9 (kernel)	ELSA-2024-8162	2024-10-16
Oracle Linux version 9 (kernel-uek)	ELSA-2024-12682	2024-09-23