Lucene search

LinuxCVE-2024-42161

HistoryJul 30, 2024 - 8:15 a.m.

CVE-2024-42161

2024-07-3008:15:07

CWE-908

Linux

web.nvd.nist.gov

linux kernel

bpf vulnerability

uninitialized value

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

6.5

Confidence

Low

EPSS

Percentile

5.0%

JSON

In the Linux kernel, the following vulnerability has been resolved:

bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD

[Changes from V1:

Use a default branch in the switch statement to initialize `val’.]

GCC warns that `val’ may be used uninitialized in the
BPF_CRE_READ_BITFIELD macro, defined in bpf_core_read.h as:

[...]
unsigned long long val;						      \
[...]								      \
switch (__CORE_RELO(s, field, BYTE_SIZE)) {			      \
case 1: val = *(const unsigned char *)p; break;			      \
case 2: val = *(const unsigned short *)p; break;		      \
case 4: val = *(const unsigned int *)p; break;			      \
case 8: val = *(const unsigned long long *)p; break;		      \
    }       							      \
[...]
val;								      \
}								      \

This patch adds a default entry in the switch statement that sets
`val’ to zero in order to avoid the warning, and random values to be
used in case __builtin_preserve_field_info returns unexpected values
for BPF_FIELD_BYTE_SIZE.

Tested in bpf-next master.
No regressions.

Affected configurations

Nvd

Vulners

Node

linuxlinux_kernelRange<5.10.222

linuxlinux_kernelRange5.11–5.15.163

linuxlinux_kernelRange5.16–6.1.98

linuxlinux_kernelRange6.2–6.6.39

linuxlinux_kernelRange6.7–6.9.9

VendorProductVersionCPE
linuxlinux_kernel*cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
linux	linux_kernel	*	cpe:2.3:o:linux:linux_kernel::::::::

CNA Affected

[
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "unaffected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "tools/lib/bpf/bpf_core_read.h"
    ],
    "versions": [
      {
        "version": "1da177e4c3f4",
        "lessThan": "b694989bb13e",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "1da177e4c3f4",
        "lessThan": "3364c2ed1c24",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "1da177e4c3f4",
        "lessThan": "a21d76bd0b0d",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "1da177e4c3f4",
        "lessThan": "7e5471b5efeb",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "1da177e4c3f4",
        "lessThan": "ff941a8449e7",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "1da177e4c3f4",
        "lessThan": "009367099eb6",
        "status": "affected",
        "versionType": "git"
      }
    ]
  },
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "affected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "tools/lib/bpf/bpf_core_read.h"
    ],
    "versions": [
      {
        "version": "5.10.222",
        "lessThanOrEqual": "5.10.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "5.15.163",
        "lessThanOrEqual": "5.15.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "6.1.98",
        "lessThanOrEqual": "6.1.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "6.6.39",
        "lessThanOrEqual": "6.6.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "6.9.9",
        "lessThanOrEqual": "6.9.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "6.10",
        "lessThanOrEqual": "*",
        "status": "unaffected",
        "versionType": "original_commit_for_fix"
      }
    ]
  }
]