Linux: Use of Uninitialized Resource
CVE-2024-35849 is a high-severity use of uninitialized resource vulnerability in Linux, with a CVSS 3.1 base score of 7.1 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 689efe22e9b5b7d9d523119a9a5c3c17107a0772, 73db209dcd4ae026021234d40cfcb2fb5b564b86, 30189e54ba80e3209d34cfeea87b848f6ae025e6 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.26% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to 689efe22e9b5b7d9d523119a9a5c3c17107a0772 or 73db209dcd4ae026021234d40cfcb2fb5b564b86 or 30189e54ba80e3209d34cfeea87b848f6ae025e6 or e58047553a4e859dafc8d1d901e1de77c9dd922d, whichever matches your release line, or a later version.
- Update SIMATIC S7-1500 TM MFP - GNU/Linux subsystem to V1.1.1 or a later version.
- Update Linux Kernel to 4.19.313 or 5.4.275 or 5.10.216 or 5.15.158, whichever matches your release line, or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | a542ad1bafc7df9fc16de8a6894b350a4df75572 up to, but not including, 689efe22e9b5b7d9d523119a9a5c3c17107a0772; a542ad1bafc7df9fc16de8a6894b350a4df75572 up to, but not including, 73db209dcd4ae026021234d40cfcb2fb5b564b86; a542ad1bafc7df9fc16de8a6894b350a4df75572 up to, but not including, 30189e54ba80e3209d34cfeea87b848f6ae025e6; a542ad1bafc7df9fc16de8a6894b350a4df75572 up to, but not including, e58047553a4e859dafc8d1d901e1de77c9dd922d; a542ad1bafc7df9fc16de8a6894b350a4df75572 up to, but not including, 8bdbcfaf3eac42f98e5486b3d7e130fa287811f6; a542ad1bafc7df9fc16de8a6894b350a4df75572 up to, but not including, 3a63cee1a5e14a3e52c19142c61dd5fcb524f6dc; a542ad1bafc7df9fc16de8a6894b350a4df75572 up to, but not including, fddc19631c51d9c17d43e9f822a7bc403af88d54; a542ad1bafc7df9fc16de8a6894b350a4df75572 up to, but not including, 2f7ef5bb4a2f3e481ef05fab946edb97c84f67cf; and 1 more ranges | 689efe22e9b5b7d9d523119a9a5c3c17107a0772, 73db209dcd4ae026021234d40cfcb2fb5b564b86, 30189e54ba80e3209d34cfeea87b848f6ae025e6, e58047553a4e859dafc8d1d901e1de77c9dd922d, 8bdbcfaf3eac42f98e5486b3d7e130fa287811f6, 3a63cee1a5e14a3e52c19142c61dd5fcb524f6dc |
| Siemens | SIMATIC S7-1500 TM MFP - GNU/Linux subsystem | before V1.1.1 | V1.1.1 |
| Linux | Linux Kernel | before 4.19.313; 4.20 up to, but not including, 5.4.275; 5.5 up to, but not including, 5.10.216; 5.11 up to, but not including, 5.15.158; 5.16 up to, but not including, 6.1.90; 6.2 up to, but not including, 6.6.30; 6.7 up to, but not including, 6.8.9; 6.9 | 4.19.313, 5.4.275, 5.10.216, 5.15.158, 6.1.90, 6.6.30 |
| Debian | Debian Linux | 10.0 | Not stated |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- NoneNothing can be modified.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H. Scored by NVD.
Official description
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix information leak in btrfs_ioctl_logical_to_ino() Syzbot reported the following information leak for in btrfs_ioctl_logical_to_ino(): BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline] BUG: KMSAN: kernel-infoleak in _copy_to_user+0xbc/0x110 lib/usercopy.c:40 instrument_copy_to_user include/linux/instrumented.h:114 [inline] _copy_to_user+0xbc/0x110 lib/usercopy.c:40 copy_to_user include/linux/uaccess.h:191 [inline] btrfs_ioctl_logical_to_ino+0x440/0x750 fs/btrfs/ioctl.c:3499 btrfs_ioctl+0x714/0x1260 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:904 [inline] __se_sys_ioctl+0x261/0x450 fs/ioctl.c:890 __x64_sys_ioctl+0x96/0xe0 fs/ioctl.c:890 x64_sys_call+0x1883/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:17 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was created at: __kmalloc_large_node+0x231/0x370 mm/slub.c:3921 __do_kmalloc_node mm/slub.c:3954 [inline] __kmalloc_node+0xb07/0x1060 mm/slub.c:3973 kmalloc_node include/linux/slab.h:648 [inline] kvmalloc_node+0xc0/0x2d0 mm/util.c:634 kvmalloc include/linux/slab.h:766 [inline] init_data_container+0x49/0x1e0 fs/btrfs/backref.c:2779 btrfs_ioctl_logical_to_ino+0x17c/0x750 fs/btrfs/ioctl.c:3480 btrfs_ioctl+0x714/0x1260 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:904 [inline] __se_sys_ioctl+0x261/0x450 fs/ioctl.c:890 __x64_sys_ioctl+0x96/0xe0 fs/ioctl.c:890 x64_sys_call+0x1883/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:17 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Bytes 40-65535 of 65536 are uninitialized Memory access of size 65536 starts at ffff888045a40000 This happens, because we're copying a 'struct btrfs_data_container' back to user-space. This btrfs_data_container is allocated in 'init_data_container()' via kvmalloc(), which does not zero-fill the memory. Fix this by using kvzalloc() which zeroes out the memory on allocation.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Use of Uninitialized Resource
The product uses or accesses a resource that has not been initialized.
How developers prevent this class of flaw
- Explicitly initialize the resource before use. If this is performed through an API function or standard procedure, follow all required steps.
- Pay close attention to complex conditionals that affect initialization, since some branches might not perform the initialization.
- Avoid race conditions (CWE-362) during initialization routines.
More Use of Uninitialized Resource vulnerabilities (CWE-908)
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
- git.kernel.org/stable/c/2f7ef5bb4a2f3e481ef05fab946edb97c84f67cf
- git.kernel.org/stable/c/30189e54ba80e3209d34cfeea87b848f6ae025e6
- git.kernel.org/stable/c/3a63cee1a5e14a3e52c19142c61dd5fcb524f6dc
- git.kernel.org/stable/c/689efe22e9b5b7d9d523119a9a5c3c17107a0772
- git.kernel.org/stable/c/73db209dcd4ae026021234d40cfcb2fb5b564b86
- git.kernel.org/stable/c/8bdbcfaf3eac42f98e5486b3d7e130fa287811f6
- git.kernel.org/stable/c/e58047553a4e859dafc8d1d901e1de77c9dd922d
- git.kernel.org/stable/c/fddc19631c51d9c17d43e9f822a7bc403af88d54
Other references
Recent Use of Uninitialized Resource vulnerabilities
- 7.8 High severity
- 7.8 High severity
- 7.3 High severity
- 7.5 High severity
- 5.5 Medium severity
Android Pixel Information Disclosure Exploited
- 7.5 High severity
Spotted an error? Tell us.