CyberSecBulletin
CVE-2024-42228NVD status: Modified

Linux: Use of Uninitialized Resource

Published Updated By the CyberSecBulletin desk

CVE-2024-42228 is a high-severity use of uninitialized resource vulnerability in Linux, with a CVSS 3.1 base score of 7.0 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions d35cf41c8eb5d9fe95b21ae6ee2910f9ba4878e8, 3b505759447637dcccb50cbd98ec6f8d2a04fc46, df02642c21c984303fe34c3f7d72965792fb1a15 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.24% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to d35cf41c8eb5d9fe95b21ae6ee2910f9ba4878e8 or 3b505759447637dcccb50cbd98ec6f8d2a04fc46 or df02642c21c984303fe34c3f7d72965792fb1a15 or da6a85d197888067e8d38b5d22c986b5b5cab712, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 6.6.39 or 6.9.9, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinuxd38ceaf99ed015f2a0b9af3499791bd3a3daae21 up to, but not including, d35cf41c8eb5d9fe95b21ae6ee2910f9ba4878e8; d38ceaf99ed015f2a0b9af3499791bd3a3daae21 up to, but not including, 3b505759447637dcccb50cbd98ec6f8d2a04fc46; d38ceaf99ed015f2a0b9af3499791bd3a3daae21 up to, but not including, df02642c21c984303fe34c3f7d72965792fb1a15; d38ceaf99ed015f2a0b9af3499791bd3a3daae21 up to, but not including, da6a85d197888067e8d38b5d22c986b5b5cab712; d38ceaf99ed015f2a0b9af3499791bd3a3daae21 up to, but not including, 9ee1534ecdd5b4c013064663502d7fde824d2144; d38ceaf99ed015f2a0b9af3499791bd3a3daae21 up to, but not including, 855ae72c20310e5402b2317fc537d911e87537ef; d38ceaf99ed015f2a0b9af3499791bd3a3daae21 up to, but not including, f8f120b3de48b8b6bdf8988a9b334c2d61c17440; d38ceaf99ed015f2a0b9af3499791bd3a3daae21 up to, but not including, 88a9a467c548d0b3c7761b4fd54a68e70f9c0944; and 1 more rangesd35cf41c8eb5d9fe95b21ae6ee2910f9ba4878e8, 3b505759447637dcccb50cbd98ec6f8d2a04fc46, df02642c21c984303fe34c3f7d72965792fb1a15, da6a85d197888067e8d38b5d22c986b5b5cab712, 9ee1534ecdd5b4c013064663502d7fde824d2144, 855ae72c20310e5402b2317fc537d911e87537ef
LinuxLinux Kernelbefore 6.6.39; 6.7 up to, but not including, 6.9.96.6.39, 6.9.9

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
HighSuccess depends on conditions outside the attacker's control.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.

Official description

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc Initialize the size before calling amdgpu_vce_cs_reloc, such as case 0x03000001. V2: To really improve the handling we would actually need to have a separate value of 0xffffffff.(Christian)

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Use of Uninitialized Resource

The product uses or accesses a resource that has not been initialized.

How developers prevent this class of flaw

  • Explicitly initialize the resource before use. If this is performed through an API function or standard procedure, follow all required steps.
  • Pay close attention to complex conditionals that affect initialization, since some branches might not perform the initialization.
  • Avoid race conditions (CWE-362) during initialization routines.

More Use of Uninitialized Resource vulnerabilities (CWE-908)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Use of Uninitialized Resource vulnerabilities

Spotted an error? Tell us.