PT-2024-29738 · Linux+2 · Linux Kernel+2

Published 2024-06-20 · Updated 2025-10-03 · CVE-2024-42083

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.10.0-rc3+

Description The issue is related to the handling of multi-buffer packets in the Linux kernel, specifically in the ionic run xdp() function. When a jumbo frame is received, the function fails to properly unmap dma-mapping and reset page pointers to NULL for all pages, leading to the unexpected reuse of SG pages and eventually causing a kernel panic. The vulnerability is triggered when the action is either XDP TX or XDP REDIRECT.

Recommendations To resolve the issue, update the Linux kernel to a version newer than 6.10.0-rc3+. As a temporary workaround, consider disabling the ionic run xdp() function until a patch is available. Restrict access to the vulnerable ionic module to minimize the risk of exploitation. Avoid using the XDP TX and XDP REDIRECT actions in the affected API endpoints until the issue is resolved.

Exploit

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-833

CWE-476

Related Identifiers

ALSA-2025_12746

ALSA-2025_12752

ALSA-2025_12753

ALSA-2025_16880

ALT-PU-2024-10855

ALT-PU-2025-12647

AZL-47053

AZL-47207

BDU:2025-02984

CVE-2024-42083

Affected Products

Alt Linux

Astra Linux

Linux Kernel

References · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/42xxx/CVE-2024-42083.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-42083 · Security Note
• https://osv.dev/vulnerability/AZL-47053 · Vendor Advisory
• https://git.kernel.org/stable/c/8ae401525ae84228a8986bb369224a6224e4d22f · Patch
• https://ubuntu.com/security/CVE-2024-42083 · Vendor Advisory
• https://git.kernel.org/stable/c/e3f02f32a05009a688a87f5799e049ed6b55bab5 · Patch
• https://osv.dev/vulnerability/CVE-2024-42083 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2024-42083 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-42083 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-02984 · Security Note
• https://osv.dev/vulnerability/AZL-47207 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-42083 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-42083 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-42083 · Vendor Advisory
• https://lore.kernel.org/linux-cve-announce/2024072947-CVE-2024-42083-9d35@gregkh · Note