Junglewise Threat Intelligence

CVE-2024-42272: Linux Kernel uninitialized memory use in act_ct connection tracking

CVE-2024-42272 · Severity: medium · CVSS 5.5 · Published 2024-08-17

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's networking subsystem could allow a local user to cause a system crash. The issue occurs in the connection tracking component, which is responsible for managing network sessions. An attacker could exploit this to disrupt system availability, potentially leading to a denial-of-service condition.

Technical details

A vulnerability exists in the Linux kernel's 'act_ct' scheduler action due to the use of uninitialized memory in 'struct zones_ht_key'. A previous commit increased the lookup key size from 2 bytes to 16 bytes to include a network namespace pointer, but failed to account for compiler-inserted padding bytes. When 'rhashtable_lookup' is called, it may read these uninitialized padding bytes, leading to non-deterministic behavior or kernel panics (as detected by KMSAN). The fix involves explicitly defining the key length to exclude padding or ensuring the padding is zeroed. This is reachable via local netlink messages.

Affected products

  • Linux Linux Kernel 5.10.221 to 5.10.224, 5.15.162 to 5.15.165, 6.1.96 to 6.1.104, 6.6.36 to 6.6.45, 6.9.7 to 6.10.4

Timeline

  • 2024-07-25: patched: Initial fix by Eric Dumazet
  • 2024-08-17: advisory: CVE-2024-42272 published

References

Related threats