CVE-2024-42093
Linux dpaa2 CPUMASK Stack Overflow Vulnerability
Description
In the Linux kernel, the following vulnerability has been resolved: net/dpaa2: Avoid explicit cpumask var allocation on stack For CONFIG_CPUMASK_OFFSTACK=y kernel, explicit allocation of cpumask variable on stack is not recommended since it can cause potential stack overflow. Instead, kernel code should always use *cpumask_var API(s) to allocate cpumask var in config-neutral way, leaving allocation strategy to CONFIG_CPUMASK_OFFSTACK. Use *cpumask_var API(s) to address it.
INFO
Published Date :
July 29, 2024, 6:15 p.m.
Last Modified :
Nov. 21, 2024, 9:33 a.m.
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Remotely Exploitable :
No
Impact Score :
5.9
Exploitability Score :
1.8
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2024-42093.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2024-42093 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2024-42093 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Nov. 21, 2024
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/48147337d7efdea6ad6e49f5b8eb894b95868ef0 Added Reference https://git.kernel.org/stable/c/5e4f25091e6d06e99a23f724c839a58a8776a527 Added Reference https://git.kernel.org/stable/c/69f49527aea12c23b78fb3d0a421950bf44fb4e2 Added Reference https://git.kernel.org/stable/c/763896ab62a672d728f5eb10ac90d98c607a8509 Added Reference https://git.kernel.org/stable/c/a55afc0f5f20ba30970aaf7271929dc00eee5e7d Added Reference https://git.kernel.org/stable/c/b2262b3be27cee334a2fa175ae3afb53f38fb0b1 Added Reference https://git.kernel.org/stable/c/d33fe1714a44ff540629b149d8fab4ac6967585c -
Initial Analysis by [email protected]
Aug. 26, 2024
Action Type Old Value New Value Added CVSS V3.1 NIST AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Changed Reference Type https://git.kernel.org/stable/c/48147337d7efdea6ad6e49f5b8eb894b95868ef0 No Types Assigned https://git.kernel.org/stable/c/48147337d7efdea6ad6e49f5b8eb894b95868ef0 Patch Changed Reference Type https://git.kernel.org/stable/c/5e4f25091e6d06e99a23f724c839a58a8776a527 No Types Assigned https://git.kernel.org/stable/c/5e4f25091e6d06e99a23f724c839a58a8776a527 Patch Changed Reference Type https://git.kernel.org/stable/c/69f49527aea12c23b78fb3d0a421950bf44fb4e2 No Types Assigned https://git.kernel.org/stable/c/69f49527aea12c23b78fb3d0a421950bf44fb4e2 Patch Changed Reference Type https://git.kernel.org/stable/c/763896ab62a672d728f5eb10ac90d98c607a8509 No Types Assigned https://git.kernel.org/stable/c/763896ab62a672d728f5eb10ac90d98c607a8509 Patch Changed Reference Type https://git.kernel.org/stable/c/a55afc0f5f20ba30970aaf7271929dc00eee5e7d No Types Assigned https://git.kernel.org/stable/c/a55afc0f5f20ba30970aaf7271929dc00eee5e7d Patch Changed Reference Type https://git.kernel.org/stable/c/b2262b3be27cee334a2fa175ae3afb53f38fb0b1 No Types Assigned https://git.kernel.org/stable/c/b2262b3be27cee334a2fa175ae3afb53f38fb0b1 Patch Changed Reference Type https://git.kernel.org/stable/c/d33fe1714a44ff540629b149d8fab4ac6967585c No Types Assigned https://git.kernel.org/stable/c/d33fe1714a44ff540629b149d8fab4ac6967585c Patch Added CWE NIST CWE-787 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions up to (excluding) 5.4.279 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.5 up to (excluding) 5.10.221 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.162 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.97 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.37 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.9.8 -
CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jul. 29, 2024
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: net/dpaa2: Avoid explicit cpumask var allocation on stack For CONFIG_CPUMASK_OFFSTACK=y kernel, explicit allocation of cpumask variable on stack is not recommended since it can cause potential stack overflow. Instead, kernel code should always use *cpumask_var API(s) to allocate cpumask var in config-neutral way, leaving allocation strategy to CONFIG_CPUMASK_OFFSTACK. Use *cpumask_var API(s) to address it. Added Reference kernel.org https://git.kernel.org/stable/c/b2262b3be27cee334a2fa175ae3afb53f38fb0b1 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/763896ab62a672d728f5eb10ac90d98c607a8509 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/a55afc0f5f20ba30970aaf7271929dc00eee5e7d [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/48147337d7efdea6ad6e49f5b8eb894b95868ef0 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/69f49527aea12c23b78fb3d0a421950bf44fb4e2 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/5e4f25091e6d06e99a23f724c839a58a8776a527 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/d33fe1714a44ff540629b149d8fab4ac6967585c [No types assigned]
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2024-42093 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2024-42093
weaknesses.