CVE-2024-42292

HIGH EPSS 15.9%
Published Aug 17, 20241y ago · Modified Jun 17, 20262w ago
7.1 CVSS 3.1
High
Find Similar
Published Aug 17, 2024 1y ago
Last Modified Jun 17, 2026 2w ago

Description

In the Linux kernel, the following vulnerability has been resolved: kobject_uevent: Fix OOB access within zap_modalias_env() zap_modalias_env() wrongly calculates size of memory block to move, so will cause OOB memory access issue if variable MODALIAS is not the last one within its @env parameter, fixed by correcting size to memmove.

CVSS Details

Base Score
7.1
Exploitability
1.8
Impact
5.2
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity None
Availability High

Threat Intelligence

EPSS Exploit Probability
15.9% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-125 Out-of-bounds Read Memory Safety

Affected Products 12

VendorProductVersionRange
linuxlinux_kernel*≥4.15.1  –  <4.19.320
linuxlinux_kernel*≥4.20  –  <5.4.282
linuxlinux_kernel*≥5.5  –  <5.10.224
linuxlinux_kernel*≥5.11  –  <5.15.165
linuxlinux_kernel*≥5.16  –  <6.1.103
linuxlinux_kernel*≥6.2  –  <6.6.44
linuxlinux_kernel*≥6.7  –  <6.10.3
linuxlinux_kernel4.15any
linuxlinux_kernel4.15any
linuxlinux_kernel4.15any
linuxlinux_kernel4.15any
linuxlinux_kernel4.15any

References 11

  • cert-portal.siemens.com https://cert-portal.siemens.com/productcert/html/ssa-265688.html
  • git.kernel.org https://git.kernel.org/stable/c/57fe01d3d04276875c7e3a6dc763517fc05b8762
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/648d5490460d38436640da0812bf7f6351c150d2
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/68d63ace80b76395e7935687ecdb86421adc2168
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/81a15d28f32af01493ae8c5457e0d55314a4167d
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/b59a5e86a3934f1b6a5bd1368902dbc79bdecc90
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/c5ee8adc8d98a49703320d13878ba2b923b142f5
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/d4663536754defff75ff1eca0aaebc41da165a8d
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/dd6e9894b451e7c85cceb8e9dc5432679a70e7dc
    Patch
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html

Remediation

  • git.kernel.org https://git.kernel.org/stable/c/57fe01d3d04276875c7e3a6dc763517fc05b8762
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/648d5490460d38436640da0812bf7f6351c150d2
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/68d63ace80b76395e7935687ecdb86421adc2168
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/81a15d28f32af01493ae8c5457e0d55314a4167d
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/b59a5e86a3934f1b6a5bd1368902dbc79bdecc90
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/c5ee8adc8d98a49703320d13878ba2b923b142f5
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/d4663536754defff75ff1eca0aaebc41da165a8d
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/dd6e9894b451e7c85cceb8e9dc5432679a70e7dc
    Patch