Executive brief
A vulnerability in the Linux kernel's networking component could allow a local user to view sensitive information from the system's memory. The issue occurs when the system provides details about network 'nexthops' (routing paths), failing to clear out old data in certain memory fields before sending them to a user. While this specific bug is primarily a memory leak, it can expose fragments of kernel data that should remain private.
Technical details
An information leak exists in the Linux kernel's net/ipv4/nexthop.c component. The function nla_put_nh_group() fails to initialize two reserved fields (resvd1 and resvd2) within the nexthop_grp structure before copying it to userspace via Netlink. A local attacker with low privileges can observe these uninitialized fields—which contain 'garbage' data from previous kernel operations—by monitoring nexthop dump messages (e.g., using strace on 'ip nexthop get'). This results in a leak of kernel stack or heap memory. The issue has been resolved by ensuring the full structure is initialized before being sent to userspace.
Affected products
- Linux Linux Kernel 5.3 to 5.4.282, 5.5 to 5.10.224, 5.11 to 5.15.165, 5.16 to 6.1.103, 6.2 to 6.6.44, 6.7 to 6.10.3
Timeline
- 2024-07-23: patched: Initial patch authored by Petr Machata
- 2024-08-17: disclosed: CVE-2024-42283 published
References
- https://git.kernel.org/stable/c/1377de719652d868f5317ba8398b7e74c5f0430b
- https://git.kernel.org/stable/c/5cc4d71dda2dd4f1520f40e634a527022e48ccd8
- https://git.kernel.org/stable/c/6d745cd0e9720282cd291d36b9db528aea18add2
- https://git.kernel.org/stable/c/7704460acd7f5d35eb07c52500987dc9b95313fb
- https://git.kernel.org/stable/c/9e8f558a3afe99ce51a642ce0d3637ddc2b5d5d0
- https://git.kernel.org/stable/c/a13d3864b76ac87085ec530b2ff8e37482a63a96
- https://git.kernel.org/stable/c/fd06cb4a5fc7bda3dea31712618a62af72a1c6cb