Linux: Use of Uninitialized Resource
CVE-2024-35888 is a high-severity use of uninitialized resource vulnerability in Linux, with a CVSS 3.1 base score of 7.3 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions 06a939f72a24a7d8251f84cf4c042df86c6666ac, e54a0c79cdc2548729dd7e2e468b08c5af4d0df5, b14b9f9503ec823ca75be766dcaeff4f0bfeca85 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.61% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to 06a939f72a24a7d8251f84cf4c042df86c6666ac or e54a0c79cdc2548729dd7e2e468b08c5af4d0df5 or b14b9f9503ec823ca75be766dcaeff4f0bfeca85 or ee0088101beee10fa809716d6245d915b09c37c7, whichever matches your release line, or a later version.
- Update SIMATIC S7-1500 CPU 1518-4 PN/DP MFP to V3.1.5 or a later version.
- Update SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP to V3.1.5 or a later version.
- Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | 0a198e0bb8bef51ced179702ad1af6f9e3715b64 up to, but not including, 06a939f72a24a7d8251f84cf4c042df86c6666ac; cb73ee40b1b381eaf3749e6dbeed567bb38e5258 up to, but not including, e54a0c79cdc2548729dd7e2e468b08c5af4d0df5; cb73ee40b1b381eaf3749e6dbeed567bb38e5258 up to, but not including, b14b9f9503ec823ca75be766dcaeff4f0bfeca85; cb73ee40b1b381eaf3749e6dbeed567bb38e5258 up to, but not including, ee0088101beee10fa809716d6245d915b09c37c7; cb73ee40b1b381eaf3749e6dbeed567bb38e5258 up to, but not including, 1db7fcb2b290c47c202b79528824f119fa28937d; cb73ee40b1b381eaf3749e6dbeed567bb38e5258 up to, but not including, 4e3fdeecec5707678b0d1f18c259dadb97262e9d; cb73ee40b1b381eaf3749e6dbeed567bb38e5258 up to, but not including, 0ac328a5a4138a6c03dfc3f46017bd5c19167446; cb73ee40b1b381eaf3749e6dbeed567bb38e5258 up to, but not including, 17af420545a750f763025149fa7b833a4fc8b8f0; and 4 more ranges | 06a939f72a24a7d8251f84cf4c042df86c6666ac, e54a0c79cdc2548729dd7e2e468b08c5af4d0df5, b14b9f9503ec823ca75be766dcaeff4f0bfeca85, ee0088101beee10fa809716d6245d915b09c37c7, 1db7fcb2b290c47c202b79528824f119fa28937d, 4e3fdeecec5707678b0d1f18c259dadb97262e9d |
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP | V3.1.0 up to, but not including, V3.1.5 | V3.1.5 |
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP | V3.1.0 up to, but not including, V3.1.5 | V3.1.5 |
| Siemens | SIMATIC S7-1500 TM MFP - GNU/Linux subsystem | before V1.1.1 | V1.1.1 |
| Siemens | SIPLUS S7-1500 CPU 1518-4 PN/DP MFP | V3.1.0 up to, but not including, V3.1.5 | V3.1.5 |
| Linux | Linux Kernel | 4.19.20 up to, but not including, 4.19.312; 4.20.7 up to, but not including, 5.4.274; 5.5 up to, but not including, 5.10.215; 5.11 up to, but not including, 5.15.154; 5.16 up to, but not including, 6.1.85; 6.2 up to, but not including, 6.6.26; 6.7 up to, but not including, 6.8.5; 6.9 | 4.19.312, 5.4.274, 5.10.215, 5.15.154, 6.1.85, 6.6.26 |
| Debian | Debian Linux | 10.0 | Not stated |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- NetworkCan be exploited remotely over a network, including the internet.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- NoneNo account or login is needed.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- LowSome restricted data can be read.
- Integrity
- LowLimited modification of data is possible.
- Availability
- LowPerformance or availability is reduced.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. Scored by CNA.
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 3.1 | 7.3 | High | CNA |
| CVSS 3.1 | 5.5 | Medium | CISA (ADP) |
Official description
In the Linux kernel, the following vulnerability has been resolved: erspan: make sure erspan_base_hdr is present in skb->head syzbot reported a problem in ip6erspan_rcv() [1] Issue is that ip6erspan_rcv() (and erspan_rcv()) no longer make sure erspan_base_hdr is present in skb linear part (skb->head) before getting @ver field from it. Add the missing pskb_may_pull() calls. v2: Reload iph pointer in erspan_rcv() after pskb_may_pull() because skb->head might have changed. [1] BUG: KMSAN: uninit-value in pskb_may_pull_reason include/linux/skbuff.h:2742 [inline] BUG: KMSAN: uninit-value in pskb_may_pull include/linux/skbuff.h:2756 [inline] BUG: KMSAN: uninit-value in ip6erspan_rcv net/ipv6/ip6_gre.c:541 [inline] BUG: KMSAN: uninit-value in gre_rcv+0x11f8/0x1930 net/ipv6/ip6_gre.c:610 pskb_may_pull_reason include/linux/skbuff.h:2742 [inline] pskb_may_pull include/linux/skbuff.h:2756 [inline] ip6erspan_rcv net/ipv6/ip6_gre.c:541 [inline] gre_rcv+0x11f8/0x1930 net/ipv6/ip6_gre.c:610 ip6_protocol_deliver_rcu+0x1d4c/0x2ca0 net/ipv6/ip6_input.c:438 ip6_input_finish net/ipv6/ip6_input.c:483 [inline] NF_HOOK include/linux/netfilter.h:314 [inline] ip6_input+0x15d/0x430 net/ipv6/ip6_input.c:492 ip6_mc_input+0xa7e/0xc80 net/ipv6/ip6_input.c:586 dst_input include/net/dst.h:460 [inline] ip6_rcv_finish+0x955/0x970 net/ipv6/ip6_input.c:79 NF_HOOK include/linux/netfilter.h:314 [inline] ipv6_rcv+0xde/0x390 net/ipv6/ip6_input.c:310 __netif_receive_skb_one_core net/core/dev.c:5538 [inline] __netif_receive_skb+0x1da/0xa00 net/core/dev.c:5652 netif_receive_skb_internal net/core/dev.c:5738 [inline] netif_receive_skb+0x58/0x660 net/core/dev.c:5798 tun_rx_batched+0x3ee/0x980 drivers/net/tun.c:1549 tun_get_user+0x5566/0x69e0 drivers/net/tun.c:2002 tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048 call_write_iter include/linux/fs.h:2108 [inline] new_sync_write fs/read_write.c:497 [inline] vfs_write+0xb63/0x1520 fs/read_write.c:590 ksys_write+0x20f/0x4c0 fs/read_write.c:643 __do_sys_write fs/read_write.c:655 [inline] __se_sys_write fs/read_write.c:652 [inline] __x64_sys_write+0x93/0xe0 fs/read_write.c:652 do_syscall_64+0xd5/0x1f0 entry_SYSCALL_64_after_hwframe+0x6d/0x75 Uninit was created at: slab_post_alloc_hook mm/slub.c:3804 [inline] slab_alloc_node mm/slub.c:3845 [inline] kmem_cache_alloc_node+0x613/0xc50 mm/slub.c:3888 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:577 __alloc_skb+0x35b/0x7a0 net/core/skbuff.c:668 alloc_skb include/linux/skbuff.h:1318 [inline] alloc_skb_with_frags+0xc8/0xbf0 net/core/skbuff.c:6504 sock_alloc_send_pskb+0xa81/0xbf0 net/core/sock.c:2795 tun_alloc_skb drivers/net/tun.c:1525 [inline] tun_get_user+0x209a/0x69e0 drivers/net/tun.c:1846 tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048 call_write_iter include/linux/fs.h:2108 [inline] new_sync_write fs/read_write.c:497 [inline] vfs_write+0xb63/0x1520 fs/read_write.c:590 ksys_write+0x20f/0x4c0 fs/read_write.c:643 __do_sys_write fs/read_write.c:655 [inline] __se_sys_write fs/read_write.c:652 [inline] __x64_sys_write+0x93/0xe0 fs/read_write.c:652 do_syscall_64+0xd5/0x1f0 entry_SYSCALL_64_after_hwframe+0x6d/0x75 CPU: 1 PID: 5045 Comm: syz-executor114 Not tainted 6.9.0-rc1-syzkaller-00021-g962490525cff #0
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Use of Uninitialized Resource
The product uses or accesses a resource that has not been initialized.
How developers prevent this class of flaw
- Explicitly initialize the resource before use. If this is performed through an API function or standard procedure, follow all required steps.
- Pay close attention to complex conditionals that affect initialization, since some branches might not perform the initialization.
- Avoid race conditions (CWE-362) during initialization routines.
More Use of Uninitialized Resource vulnerabilities (CWE-908)
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
- git.kernel.org/stable/c/06a939f72a24a7d8251f84cf4c042df86c6666ac
- git.kernel.org/stable/c/0ac328a5a4138a6c03dfc3f46017bd5c19167446
- git.kernel.org/stable/c/17af420545a750f763025149fa7b833a4fc8b8f0
- git.kernel.org/stable/c/1db7fcb2b290c47c202b79528824f119fa28937d
- git.kernel.org/stable/c/4e3fdeecec5707678b0d1f18c259dadb97262e9d
- git.kernel.org/stable/c/b14b9f9503ec823ca75be766dcaeff4f0bfeca85
- git.kernel.org/stable/c/e54a0c79cdc2548729dd7e2e468b08c5af4d0df5
- git.kernel.org/stable/c/ee0088101beee10fa809716d6245d915b09c37c7
Third-party and government advisories
- lists.debian.org/debian-lts-announce/2024/06/msg00017.htmlMailing List, Third Party Advisory
- lists.debian.org/debian-lts-announce/2024/06/msg00020.htmlMailing List, Third Party Advisory
Other references
Recent Use of Uninitialized Resource vulnerabilities
- 7.1 High severity
- 7.8 High severity
- 7.8 High severity
- 7.3 High severity
- 7.5 High severity
- 5.5 Medium severity
Android Pixel Information Disclosure Exploited
Spotted an error? Tell us.