CVE-2024-27431 — Use of Uninitialized Resource in Linux
Severity
5.5MEDIUMNVD
OSV7.0OSV6.5
EPSS
0.0%
top 96.84%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMay 17
Latest updateJul 26
Description
In the Linux kernel, the following vulnerability has been resolved:
cpumap: Zero-initialise xdp_rxq_info struct before running XDP program
When running an XDP program that is attached to a cpumap entry, we don't
initialise the xdp_rxq_info data structure being used in the xdp_buff
that backs the XDP program invocation. Tobias noticed that this leads to
random values being returned as the xdp_md->rx_queue_index value for XDP
programs running in a cpumap.
This means we're basically returning th…
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6
Affected Packages5 packages
▶CVEListV5linux/linux9216477449f33cdbc9c9a99d49f500b7fbb81702 — 5f4e51abfbe6eb444fa91906a5cd083044278297+6
Also affects: Debian Linux 10.0
Patches
🔴Vulnerability Details
12📋Vendor Advisories
12💬Community
1Bugzilla▶
CVE-2024-27431 kernel: cpumap: Zero-initialise xdp_rxq_info struct before running XDP program↗2024-05-17