CVE-2024-41079: nvmet: always initialize cqe.result
Published Jul 29, 2024
·Updated
In the Linux kernel, the following vulnerability has been resolved:
nvmet: always initialize cqe.result
The spec doesn't mandate that the first two double words (aka results) for the command queue entry need to be set to 0 when they are not used (not specified). Though, the target implemention returns 0 for TCP and FC but not for RDMA.
Let's make RDMA behave the same and thus explicitly initializing the result field. This prevents leaking any data from the stack.
Affected Software
205 affected componentsFixes available
redhat/kernel<6.1.101
6.1.101
redhat/kernel<6.6.42
6.6.42
redhat/kernel<6.9.11
6.9.11
redhat/kernel<6.10
6.10
Microsoft cbl2 kernel 5.15.186.1-1
Linux Linux kernel<6.1.101
Linux Linux kernel>=6.2<6.6.42
Linux Linux kernel>=6.7<6.9.11
Linux Linux kernel=6.10-rc1
Linux Linux kernel=6.10-rc2
Linux Linux kernel=6.10-rc3
debian/linux<6.1.106-1
6.1.106-1
debian/linux<6.9.11-1
6.9.11-1
debian/linux<6.9.11-1
6.9.11-1
debian/linux
6.1.176-16.1.190-16.12.107-16.12.115-27.2.12-17.2.15-1
ubuntu/linux-azure*
ubuntu/linux-aws-hwe*
ubuntu/linux-azure*
ubuntu/linux-gcp*
ubuntu/linux-hwe*
ubuntu/linux-hwe-edge*
ubuntu/linux-oracle*
ubuntu/linux*
ubuntu/linux-aws*
ubuntu/linux-aws-5.0*
ubuntu/linux-aws-5.3*
ubuntu/linux-aws-5.4*
ubuntu/linux-azure*
ubuntu/linux-azure-4.15*
ubuntu/linux-azure-5.3*
ubuntu/linux-azure-5.4*
ubuntu/linux-azure-edge*
ubuntu/linux-gcp*
ubuntu/linux-gcp-4.15*
ubuntu/linux-gcp-5.3*
ubuntu/linux-gcp-5.4*
ubuntu/linux-gke-4.15*
ubuntu/linux-gke-5.4*
ubuntu/linux-gkeop-5.4*
ubuntu/linux-hwe*
ubuntu/linux-hwe-5.4*
ubuntu/linux-hwe-edge*
ubuntu/linux-ibm-5.4*
ubuntu/linux-kvm*
ubuntu/linux-oem*
ubuntu/linux-oracle*
ubuntu/linux-oracle-5.0*
ubuntu/linux-oracle-5.3*
ubuntu/linux-oracle-5.4*
ubuntu/linux-raspi-5.4*
ubuntu/linux-aws-fips*
ubuntu/linux-azure-fips*
ubuntu/linux-fips*
ubuntu/linux-gcp-fips*
ubuntu/linux-aws-fips*
ubuntu/linux-azure-fips*
ubuntu/linux-fips*
ubuntu/linux-gcp-fips*
ubuntu/linux*
ubuntu/linux-aws*
ubuntu/linux-aws-5.11*
ubuntu/linux-aws-5.13*
ubuntu/linux-aws-5.15<5.15.0-1112.119~20.04.1
5.15.0-1112.119~20.04.1
ubuntu/linux-aws-5.8*
ubuntu/linux-azure*
ubuntu/linux-azure-5.11*
ubuntu/linux-azure-5.13*
ubuntu/linux-azure-5.15<5.15.0-1117.126~20.04.1
5.15.0-1117.126~20.04.1
ubuntu/linux-azure-5.8*
ubuntu/linux-azure-fde*
ubuntu/linux-azure-fde-5.15<5.15.0-1117.126~20.04.2
5.15.0-1117.126~20.04.2
ubuntu/linux-bluefield*
ubuntu/linux-gcp*
ubuntu/linux-gcp-5.11*
ubuntu/linux-gcp-5.13*
ubuntu/linux-gcp-5.15<5.15.0-1112.122~20.04.1
5.15.0-1112.122~20.04.1
ubuntu/linux-gcp-5.8*
ubuntu/linux-gke*
ubuntu/linux-gke-5.15*
ubuntu/linux-gkeop*
ubuntu/linux-gkeop-5.15*
ubuntu/linux-hwe-5.11*
ubuntu/linux-hwe-5.13*
ubuntu/linux-hwe-5.15<5.15.0-186.196~20.04.1
5.15.0-186.196~20.04.1
ubuntu/linux-hwe-5.8*
ubuntu/linux-ibm*
ubuntu/linux-ibm-5.15<5.15.0-1106.110~20.04.1
5.15.0-1106.110~20.04.1
ubuntu/linux-intel-5.13*
ubuntu/linux-intel-iotg-5.15<5.15.0-1107.113~20.04.1
5.15.0-1107.113~20.04.1
ubuntu/linux-iot*
ubuntu/linux-kvm*
ubuntu/linux-lowlatency-hwe-5.15<5.15.0-184.194~20.04.1
5.15.0-184.194~20.04.1
ubuntu/linux-nvidia-tegra-5.15<5.15.0-1064.66~20.04.1
5.15.0-1064.66~20.04.1
ubuntu/linux-oem-5.10*
ubuntu/linux-oem-5.13*
ubuntu/linux-oem-5.6*
ubuntu/linux-oracle*
ubuntu/linux-oracle-5.11*
ubuntu/linux-oracle-5.13*
ubuntu/linux-oracle-5.15<5.15.0-1109.115~20.04.1
5.15.0-1109.115~20.04.1
ubuntu/linux-oracle-5.8*
ubuntu/linux-raspi*
ubuntu/linux-raspi2*
ubuntu/linux-riscv*
ubuntu/linux-riscv-5.11*
ubuntu/linux-riscv-5.15<5.15.0-1106.110~20.04.1
5.15.0-1106.110~20.04.1
ubuntu/linux-riscv-5.8*
ubuntu/linux-xilinx-zynqmp*
ubuntu/linux-aws-fips*
ubuntu/linux-azure-fips*
ubuntu/linux-fips*
ubuntu/linux-gcp-fips*
ubuntu/linux-aws-fips*
ubuntu/linux-azure-fips*
ubuntu/linux-fips*
ubuntu/linux-gcp-fips*
ubuntu/linux<5.15.0-186.196
5.15.0-186.196
ubuntu/linux-allwinner-5.19*
ubuntu/linux-aws<5.15.0-1112.119
5.15.0-1112.119
ubuntu/linux-aws-5.19*
ubuntu/linux-aws-6.2*
ubuntu/linux-aws-6.5*
ubuntu/linux-aws-6.8<6.8.0-1018.19~22.04.1
6.8.0-1018.19~22.04.1
ubuntu/linux-azure<5.15.0-1117.126
5.15.0-1117.126
ubuntu/linux-azure-5.19*
ubuntu/linux-azure-6.2*
ubuntu/linux-azure-6.5*
ubuntu/linux-azure-6.8<6.8.0-1017.20~22.04.1
6.8.0-1017.20~22.04.1
ubuntu/linux-azure-fde<5.15.0-1117.126
5.15.0-1117.126
ubuntu/linux-azure-fde-5.19*
ubuntu/linux-azure-fde-6.2*
ubuntu/linux-gcp<5.15.0-1112.122
5.15.0-1112.122
ubuntu/linux-gcp-5.19*
ubuntu/linux-gcp-6.2*
ubuntu/linux-gcp-6.5*
ubuntu/linux-gcp-6.8<6.8.0-1017.19~22.04.1
6.8.0-1017.19~22.04.1
ubuntu/linux-gke<5.15.0-1108.114
5.15.0-1108.114
ubuntu/linux-gkeop<5.15.0-1095.103
5.15.0-1095.103
ubuntu/linux-hwe-5.19*
ubuntu/linux-hwe-6.2*
ubuntu/linux-hwe-6.5*
ubuntu/linux-hwe-6.8<6.8.0-48.48~22.04.1
6.8.0-48.48~22.04.1
ubuntu/linux-ibm<5.15.0-1106.110
5.15.0-1106.110
ubuntu/linux-ibm-6.8<6.8.0-1015.15~22.04.1
6.8.0-1015.15~22.04.1
ubuntu/linux-intel-iot-realtime*
ubuntu/linux-intel-iotg<5.15.0-1107.113
5.15.0-1107.113
ubuntu/linux-kvm<5.15.0-1104.109
5.15.0-1104.109
ubuntu/linux-lowlatency<5.15.0-184.194
5.15.0-184.194
ubuntu/linux-lowlatency-hwe-5.19*
ubuntu/linux-lowlatency-hwe-6.2*
ubuntu/linux-lowlatency-hwe-6.5*
ubuntu/linux-lowlatency-hwe-6.8<6.8.0-48.48.3~22.04.1
6.8.0-48.48.3~22.04.1
ubuntu/linux-nvidia<5.15.0-1107.108
5.15.0-1107.108
ubuntu/linux-nvidia-6.2*
ubuntu/linux-nvidia-6.5*
ubuntu/linux-nvidia-6.8<6.8.0-1017.19~22.04.1
6.8.0-1017.19~22.04.1
ubuntu/linux-nvidia-tegra<5.15.0-1064.66
5.15.0-1064.66
ubuntu/linux-nvidia-tegra-igx<5.15.0-1053.53
5.15.0-1053.53
ubuntu/linux-oem-5.17*
ubuntu/linux-oem-6.0*
ubuntu/linux-oem-6.1*
ubuntu/linux-oem-6.5*
ubuntu/linux-oracle<5.15.0-1109.115
5.15.0-1109.115
ubuntu/linux-oracle-6.5*
ubuntu/linux-oracle-6.8<6.8.0-1015.15~22.04.1
6.8.0-1015.15~22.04.1
ubuntu/linux-raspi<5.15.0-1106.109
5.15.0-1106.109
ubuntu/linux-realtime*
ubuntu/linux-riscv*
ubuntu/linux-riscv-5.19*
ubuntu/linux-riscv-6.5*
ubuntu/linux-riscv-6.8<6.8.0-48.48.1~22.04.2
6.8.0-48.48.1~22.04.2
ubuntu/linux-starfive-5.19*
ubuntu/linux-starfive-6.2*
ubuntu/linux-starfive-6.5*
ubuntu/linux-xilinx-zynqmp<5.15.0-1075.79
5.15.0-1075.79
ubuntu/linux-bluefield<5.15.0-1096.98
5.15.0-1096.98
ubuntu/linux-intel-iot-realtime<5.15.0-1104.106
5.15.0-1104.106
ubuntu/linux-realtime<5.15.0-1111.120
5.15.0-1111.120
ubuntu/linux-realtime-6.8<6.8.1-1011.11~22.04.1
6.8.1-1011.11~22.04.1
ubuntu/linux-aws-fips*
ubuntu/linux-azure-fips*
ubuntu/linux-fips*
ubuntu/linux-gcp-fips*
ubuntu/linux-aws-fips<5.15.0-1112.119+fips1
5.15.0-1112.119+fips1
ubuntu/linux-azure-fips<5.15.0-1117.126+fips1
5.15.0-1117.126+fips1
ubuntu/linux-fips<5.15.0-186.196+fips1
5.15.0-186.196+fips1
ubuntu/linux-gcp-fips<5.15.0-1112.122+fips1
5.15.0-1112.122+fips1
ubuntu/linux<6.8.0-48.48
6.8.0-48.48
ubuntu/linux-aws<6.8.0-1018.20
6.8.0-1018.20
ubuntu/linux-azure<6.8.0-1017.20
6.8.0-1017.20
ubuntu/linux-gcp<6.8.0-1017.19
6.8.0-1017.19
ubuntu/linux-gke<6.8.0-1013.17
6.8.0-1013.17
ubuntu/linux-gkeop<6.8.0-1002.4
6.8.0-1002.4
ubuntu/linux-ibm<6.8.0-1015.15
6.8.0-1015.15
ubuntu/linux-lowlatency<6.8.0-48.48.3
6.8.0-48.48.3
ubuntu/linux-nvidia<6.8.0-1017.19
6.8.0-1017.19
ubuntu/linux-nvidia-lowlatency<6.8.0-1017.19.1
6.8.0-1017.19.1
ubuntu/linux-oem-6.8<6.8.0-1016.16
6.8.0-1016.16
ubuntu/linux-oracle<6.8.0-1015.16
6.8.0-1015.16
ubuntu/linux-raspi<6.8.0-1014.16
6.8.0-1014.16
ubuntu/linux-riscv<6.8.0-48.48.1
6.8.0-48.48.1
ubuntu/linux-xilinx<6.8.0-1009.10
6.8.0-1009.10
ubuntu/linux-raspi-realtime<6.8.0-2013.14
6.8.0-2013.14
ubuntu/linux-realtime<6.8.1-1011.11
6.8.1-1011.11
ubuntu/linux-fips<6.8.0-78.78+fips1
6.8.0-78.78+fips1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.1.101 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.6.42 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.9.11 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.10 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.106-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.9.11-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1
Event History
Jul 29, 2024
CVE Published
via MITRE·03:04 PM
Data Sourced
via MITRE·03:04 PM
DescriptionSeverity
Data Sourced
via NVD·03:15 PM
RemedyDescriptionSeverityAffected Software
Data Sourced
via OSV·03:15 PM
DescriptionSeverityAffected Software
Oct 11, 2025
Data Sourced
via Microsoft·01:01 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2024-41079?
CVE-2024-41079 has a medium severity rating due to its potential to affect data integrity.
2
How do I fix CVE-2024-41079?
To fix CVE-2024-41079, update the Linux kernel to versions 6.1.101, 6.6.42, 6.9.11, or 6.10 for Red Hat systems, or upgrade to specified Debian versions.
3
Which Linux kernel versions are affected by CVE-2024-41079?
CVE-2024-41079 affects various Linux kernel versions prior to the specified remedial versions in both Red Hat and Debian distributions.
4
What is the impact of CVE-2024-41079 on systems?
The impact of CVE-2024-41079 could lead to improper initialization which may result in unpredictable command behavior.
5
Is CVE-2024-41079 relevant to all Linux distributions?
CVE-2024-41079 is particularly relevant to Red Hat and Debian based Linux distributions, impacting specific kernel versions.