5.5

CVE-2024-27431

In the Linux kernel, the following vulnerability has been resolved:

cpumap: Zero-initialise xdp_rxq_info struct before running XDP program

When running an XDP program that is attached to a cpumap entry, we don't
initialise the xdp_rxq_info data structure being used in the xdp_buff
that backs the XDP program invocation. Tobias noticed that this leads to
random values being returned as the xdp_md->rx_queue_index value for XDP
programs running in a cpumap.

This means we're basically returning the contents of the uninitialised
memory, which is bad. Fix this by zero-initialising the rxq data
structure before running the XDP program.

Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
This information is available to logged-in users.
Daten sind bereitgestellt durch das CVE Programm von Authorized Data Publishers (ADP) (Unstrukturiert)
Vendorlinux
≫
Product linux_kernel
Default Statusunknown
Version 9216477449f3
Status affected
Vendorlinux
≫
Product linux_kernel
Default Statusunknown
Version 5.9
Status affected
Vendorlinux
≫
Product linux_kernel
Default Statusunknown
Version 0
Status unaffected
Vendorlinux
≫
Product linux_kernel
Default Statusunknown
Version 5.10.213
Status unaffected
Vendorlinux
≫
Product linux_kernel
Default Statusunknown
Version 5.15.152
Status unaffected
Vendorlinux
≫
Product linux_kernel
Default Statusunknown
Version 6.1.82
Status unaffected
Vendorlinux
≫
Product linux_kernel
Default Statusunknown
Version 6.6.22
Status unaffected
Vendorlinux
≫
Product linux_kernel
Default Statusunknown
Version 6.7.10
Status unaffected
Vendorlinux
≫
Product linux_kernel
Default Statusunknown
Version 6.8
Status unaffected
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.02% 0.019
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
134c704f-9b21-4f2e-91b3-4a467353bcc0 5.5 1.8 3.6
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-908 Use of Uninitialized Resource

The product uses or accesses a resource that has not been initialized.