Junglewise Threat Intelligence

CVE-2024-42312: Linux Kernel uninitialized resource in sysctl

CVE-2024-42312 · Severity: medium · CVSS 5.5 · Published 2024-08-17

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's system control (sysctl) interface could allow a local user to cause a system crash. The issue stems from certain internal file identifiers not being properly initialized, which can lead to unpredictable behavior when the system attempts to manage file ownership. This primarily impacts system availability, potentially leading to a denial-of-service condition.

Technical details

A vulnerability exists in the Linux kernel's sysctl implementation (specifically within fs/proc/proc_sysctl.c) where i_uid and i_gid were not consistently initialized. While a previous commit added defaults when set_ownership() was unimplemented, it failed to account for cases like net_ctl_set_ownership() where the computation of a specific value might fail. This results in the use of uninitialized resources (CWE-908). A local attacker can exploit this to trigger a kernel panic or denial-of-service. The fix ensures these values are always initialized to GLOBAL_ROOT_UID/GID within the sysfs core before any ownership overrides are attempted.

Affected products

  • Linux Linux Kernel 4.9.187 to 4.10, 4.14.135 to 4.15, 4.19.61 to 4.20, 5.1.20 to 5.2, 5.2.3 to 5.10.224, 5.11 to 5.15.165, 5.16 to 6.1.104, 6.2 to 6.6.45, 6.7 to 6.10.3

Timeline

  • 2024-08-17: advisory: Initial publication of the CVE record.
  • 2024-06-03: patched: Mainline kernel patch committed.

References

Related threats