PT-2024-29747 · Linux+1 · Linux Kernel+1

Published 2024-07-03 · Updated 2024-07-31 · CVE-2024-42099

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue is related to the invalid dereferencing of indirect CCW data pointers in the Linux kernel, specifically in the dasd eckd dump sense() function, which can lead to a kernel panic in error cases. When using indirect addressing for DASD CCWs (IDAW), the CCW CDA pointer does not contain the data address itself but a pointer to the IDAL, which needs to be translated from physical to virtual before use. This dereferencing is also used for dasd page cache and has been fixed, although it is unlikely that this code path is ever used.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Resource Release

NULL Pointer Dereference

Weakness Enumeration

CWE-404

CWE-476

Related Identifiers

BDU:2026-04389

CVE-2024-42099

Affected Products

Astra Linux

Linux Kernel

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/42xxx/CVE-2024-42099.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-42099 · Security Note
• https://git.kernel.org/stable/c/b3a58f3b90f564f42a5c35778d8c5107b2c2150b · Patch
• https://ubuntu.com/security/CVE-2024-42099 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-42099 · Security Note
• https://osv.dev/vulnerability/BELL-CVE-2024-42099 · Vendor Advisory
• https://git.kernel.org/stable/c/c116475f7d6410b1e6d399207ac75de6cf9c3652 · Patch
• https://security-tracker.debian.org/tracker/CVE-2024-42099 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-42099 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-42099 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-04389 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-42099 · Vendor Advisory
• https://git.kernel.org/linus/b3a58f3b90f564f42a5c35778d8c5107b2c2150b · Note
• https://kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.9.9 · Note
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note