CyberSecBulletin
CVE-2024-53155NVD status: Modified

Linux: Use of Uninitialized Resource

Published Updated By the CyberSecBulletin desk

CVE-2024-53155 is a high-severity use of uninitialized resource vulnerability in Linux, with a CVSS 3.1 base score of 7.1 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 6c8f8d1e595dabd5389817f6d798cc8bd95c40ab, f4078ef38d3163e6be47403a619558b19c4bfccd, 66b7ddd1804e2c4216dd7ead8eeb746cdbb3b62f as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.24% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 6c8f8d1e595dabd5389817f6d798cc8bd95c40ab or f4078ef38d3163e6be47403a619558b19c4bfccd or 66b7ddd1804e2c4216dd7ead8eeb746cdbb3b62f or 8c966150d5abff58c3c2bdb9a6e63fd773782905, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 4.19.325 or 5.4.287 or 5.10.231 or 5.15.174, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux7cdfc3a1c3971c9125c317cb8c2525745851798e up to, but not including, 6c8f8d1e595dabd5389817f6d798cc8bd95c40ab; 7cdfc3a1c3971c9125c317cb8c2525745851798e up to, but not including, f4078ef38d3163e6be47403a619558b19c4bfccd; 7cdfc3a1c3971c9125c317cb8c2525745851798e up to, but not including, 66b7ddd1804e2c4216dd7ead8eeb746cdbb3b62f; 7cdfc3a1c3971c9125c317cb8c2525745851798e up to, but not including, 8c966150d5abff58c3c2bdb9a6e63fd773782905; 7cdfc3a1c3971c9125c317cb8c2525745851798e up to, but not including, 83f8713a0ef1d55d6a287bcfadcaab8245ac5098; 7cdfc3a1c3971c9125c317cb8c2525745851798e up to, but not including, 8e0de82ed18ba0e71f817adbd81317fd1032ca5a; 7cdfc3a1c3971c9125c317cb8c2525745851798e up to, but not including, 366c933c2ab34dd6551acc03b4872726b7605143; 7cdfc3a1c3971c9125c317cb8c2525745851798e up to, but not including, dc78efe556fed162d48736ef24066f42e463e27c; and 2 more ranges6c8f8d1e595dabd5389817f6d798cc8bd95c40ab, f4078ef38d3163e6be47403a619558b19c4bfccd, 66b7ddd1804e2c4216dd7ead8eeb746cdbb3b62f, 8c966150d5abff58c3c2bdb9a6e63fd773782905, 83f8713a0ef1d55d6a287bcfadcaab8245ac5098, 8e0de82ed18ba0e71f817adbd81317fd1032ca5a
LinuxLinux Kernel2.6.22 up to, but not including, 4.19.325; 4.20 up to, but not including, 5.4.287; 5.5 up to, but not including, 5.10.231; 5.11 up to, but not including, 5.15.174; 5.16 up to, but not including, 6.1.120; 6.2 up to, but not including, 6.6.64; 6.7 up to, but not including, 6.11.11; 6.12 up to, but not including, 6.12.24.19.325, 5.4.287, 5.10.231, 5.15.174, 6.1.120, 6.6.64

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
NoneNothing can be modified.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 3.17.1HighNVD
CVSS 3.17.1HighCISA (ADP)

Official description

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix uninitialized value in ocfs2_file_read_iter() Syzbot has reported the following KMSAN splat: BUG: KMSAN: uninit-value in ocfs2_file_read_iter+0x9a4/0xf80 ocfs2_file_read_iter+0x9a4/0xf80 __io_read+0x8d4/0x20f0 io_read+0x3e/0xf0 io_issue_sqe+0x42b/0x22c0 io_wq_submit_work+0xaf9/0xdc0 io_worker_handle_work+0xd13/0x2110 io_wq_worker+0x447/0x1410 ret_from_fork+0x6f/0x90 ret_from_fork_asm+0x1a/0x30 Uninit was created at: __alloc_pages_noprof+0x9a7/0xe00 alloc_pages_mpol_noprof+0x299/0x990 alloc_pages_noprof+0x1bf/0x1e0 allocate_slab+0x33a/0x1250 ___slab_alloc+0x12ef/0x35e0 kmem_cache_alloc_bulk_noprof+0x486/0x1330 __io_alloc_req_refill+0x84/0x560 io_submit_sqes+0x172f/0x2f30 __se_sys_io_uring_enter+0x406/0x41c0 __x64_sys_io_uring_enter+0x11f/0x1a0 x64_sys_call+0x2b54/0x3ba0 do_syscall_64+0xcd/0x1e0 entry_SYSCALL_64_after_hwframe+0x77/0x7f Since an instance of 'struct kiocb' may be passed from the block layer with 'private' field uninitialized, introduce 'ocfs2_iocb_init_rw_locked()' and use it from where 'ocfs2_dio_end_io()' might take care, i.e. in 'ocfs2_file_read_iter()' and 'ocfs2_file_write_iter()'.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Use of Uninitialized Resource

The product uses or accesses a resource that has not been initialized.

How developers prevent this class of flaw

  • Explicitly initialize the resource before use. If this is performed through an API function or standard procedure, follow all required steps.
  • Pay close attention to complex conditionals that affect initialization, since some branches might not perform the initialization.
  • Avoid race conditions (CWE-362) during initialization routines.

More Use of Uninitialized Resource vulnerabilities (CWE-908)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Use of Uninitialized Resource vulnerabilities

Spotted an error? Tell us.