CVE - CVE-2024-27431

CVE-ID
CVE-2024-27431	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
In the Linux kernel, the following vulnerability has been resolved: cpumap: Zero-initialise xdp_rxq_info struct before running XDP program When running an XDP program that is attached to a cpumap entry, we don't initialise the xdp_rxq_info data structure being used in the xdp_buff that backs the XDP program invocation. Tobias noticed that this leads to random values being returned as the xdp_md->rx_queue_index value for XDP programs running in a cpumap. This means we're basically returning the contents of the uninitialised memory, which is bad. Fix this by zero-initialising the rxq data structure before running the XDP program.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://git.kernel.org/stable/c/2487007aa3b9fafbd2cb14068f49791ce1d7ede5 URL:https://git.kernel.org/stable/c/2487007aa3b9fafbd2cb14068f49791ce1d7ede5 MISC:https://git.kernel.org/stable/c/3420b3ff1ff489c177ea1cb7bd9fbbc4e9a0be95 URL:https://git.kernel.org/stable/c/3420b3ff1ff489c177ea1cb7bd9fbbc4e9a0be95 MISC:https://git.kernel.org/stable/c/5f4e51abfbe6eb444fa91906a5cd083044278297 URL:https://git.kernel.org/stable/c/5f4e51abfbe6eb444fa91906a5cd083044278297 MISC:https://git.kernel.org/stable/c/eaa7cb836659ced2d9f814ac32aa3ec193803ed6 URL:https://git.kernel.org/stable/c/eaa7cb836659ced2d9f814ac32aa3ec193803ed6 MISC:https://git.kernel.org/stable/c/f0363af9619c77730764f10360e36c6445c12f7b URL:https://git.kernel.org/stable/c/f0363af9619c77730764f10360e36c6445c12f7b MISC:https://git.kernel.org/stable/c/f562e4c4aab00986dde3093c4be919c3f2b85a4a URL:https://git.kernel.org/stable/c/f562e4c4aab00986dde3093c4be919c3f2b85a4a MLIST:[debian-lts-announce] 20240625 [SECURITY] [DLA 3842-1] linux-5.10 security update URL:https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html
Assigning CNA
kernel.org
Date Record Created
20240225	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20240225)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)