Junglewise Threat Intelligence

CVE-2024-42082: Linux Kernel denial of service in XDP memory registration

CVE-2024-42082 · Severity: medium · CVSS 5.5 · Published 2024-07-29

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's networking component could allow a local user to trigger a system warning or kernel panic under specific low-memory conditions. This affects the eXpress Data Path (XDP) subsystem, which is used for high-performance packet processing. While primarily a stability issue, it could be used to disrupt system operations or cause a denial of service.

Technical details

A vulnerability in the Linux kernel's XDP (eXpress Data Path) subsystem was identified where the __xdp_reg_mem_model() function contained a WARN() macro that triggered upon memory allocation failures. Specifically, if __mem_id_init_hash_table() failed due to insufficient memory, the kernel would issue a warning. While the code correctly handled the error by returning ERR_PTR, the inclusion of WARN() is inappropriate for recoverable resource exhaustion events and can be exploited by local attackers to trigger kernel warnings or panics (if panic_on_warn is set), leading to a Denial of Service (DoS). The fix involves removing the WARN() call and relying on standard error return codes.

Affected products

  • Linux Linux Kernel up to (excluding) 4.18, 4.19 up to (excluding) 5.10.221, 5.11 up to (excluding) 5.15.162, 5.16 up to (excluding) 6.1.97, 6.2 up to (excluding) 6.6.37, 6.7 up to (excluding) 6.9.8

Timeline

  • 2024-07-29: advisory: NVD publication date
  • 2024-07-05: patched: Fix committed to stable kernel trees

References

Related threats