5.5

CVE-2024-42312

In the Linux kernel, the following vulnerability has been resolved:

sysctl: always initialize i_uid/i_gid

Always initialize i_uid/i_gid inside the sysfs core so set_ownership()
can safely skip setting them.

Commit 5ec27ec735ba ("fs/proc/proc_sysctl.c: fix the default values of
i_uid/i_gid on /proc/sys inodes.") added defaults for i_uid/i_gid when
set_ownership() was not implemented. It also missed adjusting
net_ctl_set_ownership() to use the same default values in case the
computation of a better value failed.
Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 4.9.187 < 4.10
Linux ≫ Linux Kernel Version >= 4.14.135 < 4.15
Linux ≫ Linux Kernel Version >= 4.19.61 < 4.20
Linux ≫ Linux Kernel Version >= 5.1.20 < 5.2
Linux ≫ Linux Kernel Version >= 5.2.3 < 5.10.224
Linux ≫ Linux Kernel Version >= 5.11 < 5.15.165
Linux ≫ Linux Kernel Version >= 5.16 < 6.1.104
Linux ≫ Linux Kernel Version >= 6.2 < 6.6.45
Linux ≫ Linux Kernel Version >= 6.7 < 6.10.3
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.03% 0.059
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.5 1.8 3.6
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-908 Use of Uninitialized Resource

The product uses or accesses a resource that has not been initialized.