PT-2024-5781 · Linux+10 · Linux Kernel+10
Syzbot
·
Published
2024-04-17
·
Updated
2025-09-29
·
CVE-2024-26901
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
A kernel information leak vulnerability was identified in the do sys name to handle() function. The vulnerability allows for the disclosure of sensitive information. The issue arises from the use of kmalloc() instead of kzalloc(), leading to uninitialized memory being accessed. The vulnerability was detected by syzbot, which issued a report detailing the issue. The report indicates that the vulnerability occurs in the instrument copy to user function, specifically in the copy to user and copy to user functions. The vulnerability can be exploited to cause a denial of service.
Recommendations
To resolve the issue, use kzalloc() instead of kmalloc() in the do sys name to handle() function to ensure that the allocated memory is initialized. As a temporary workaround, consider disabling the do sys name to handle() function until a patch is available. However, since the provided information suggests that the issue is resolved by using kzalloc(), the primary recommendation is to apply this fix. At the moment, there is no information about a newer version that contains a fix for this vulnerability, but using kzalloc() as suggested should mitigate the issue.
Exploit
Fix
Use of Uninitialized Resource
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Linuxmint
Linux Kernel
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu