PT-2024-29834 · Linux+8 · Linux Kernel+8
Published
2024-07-24
·
Updated
2025-09-29
·
CVE-2024-42283
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.6.50
Description
The issue is related to the Linux kernel's net component, specifically with the initialization of fields in dumped nexthops. The
struct nexthop grp contains two reserved fields that are not initialized by nla put nh group(), resulting in kernel memory leaks. These fields are not currently used but may complicate repurposing for new ends if not initialized properly. The leak can be observed using strace with commands like ip nexthop add and strace -e recvmsg ip nexthop get. The vulnerability may allow an attacker to cause a denial of service.Recommendations
To resolve the issue, update the Linux kernel to version 6.6.50 or later. As a temporary workaround, consider restricting access to the
net component or the nexthop functionality until a patch is available. Avoid using the recvmsg function with the ip nexthop get command until the issue is resolved.Exploit
Fix
Use of Uninitialized Resource
Memory Leak
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Linuxmint
Linux Kernel
Red Hat
Red Os
Suse
Ubuntu