CVE-2024-42161

MEDIUM EPSS 12.5%
Published Jul 30, 20241y ago · Modified Jun 17, 20261w ago
6.3 CVSS 3.1
Medium
Find Similar
Published Jul 30, 2024 1y ago
Last Modified Jun 17, 2026 1w ago

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD [Changes from V1: - Use a default branch in the switch statement to initialize `val'.] GCC warns that `val' may be used uninitialized in the BPF_CRE_READ_BITFIELD macro, defined in bpf_core_read.h as: [...] unsigned long long val; \ [...] \ switch (__CORE_RELO(s, field, BYTE_SIZE)) { \ case 1: val = *(const unsigned char *)p; break; \ case 2: val = *(const unsigned short *)p; break; \ case 4: val = *(const unsigned int *)p; break; \ case 8: val = *(const unsigned long long *)p; break; \ } \ [...] val; \ } \ This patch adds a default entry in the switch statement that sets `val' to zero in order to avoid the warning, and random values to be used in case __builtin_preserve_field_info returns unexpected values for BPF_FIELD_BYTE_SIZE. Tested in bpf-next master. No regressions.

CVSS Details

Base Score
6.3
Exploitability
0.8
Impact
5.5
Vector string
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required High
User Interaction None
Scope Unchanged
Confidentiality Low
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
12.5% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-908

Affected Products 5

VendorProductVersionRange
linuxlinux_kernel* <5.10.222
linuxlinux_kernel*≥5.11  –  <5.15.163
linuxlinux_kernel*≥5.16  –  <6.1.98
linuxlinux_kernel*≥6.2  –  <6.6.39
linuxlinux_kernel*≥6.7  –  <6.9.9

References 7

  • git.kernel.org https://git.kernel.org/stable/c/009367099eb61a4fc2af44d4eb06b6b4de7de6db
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/3364c2ed1c241989847f19cf83e3db903ce689e3
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/7e5471b5efebc30dd0bc035cda86693a5c73d45f
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/a21d76bd0b0d39518e9a4c19f6cf7c042a974aff
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/b694989bb13ed5f166e633faa1eb0f21c6d261a6
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/ff941a8449e712eaf7efca1a13bfb9afd3d99fc2
    Patch
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html

Remediation

  • git.kernel.org https://git.kernel.org/stable/c/009367099eb61a4fc2af44d4eb06b6b4de7de6db
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/3364c2ed1c241989847f19cf83e3db903ce689e3
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/7e5471b5efebc30dd0bc035cda86693a5c73d45f
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/a21d76bd0b0d39518e9a4c19f6cf7c042a974aff
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/b694989bb13ed5f166e633faa1eb0f21c6d261a6
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/ff941a8449e712eaf7efca1a13bfb9afd3d99fc2
    Patch