CVE-2024-42094: net/iucv: Avoid explicit cpumask var allocation on stack
In the Linux kernel, the following vulnerability has been resolved:
net/iucv: Avoid explicit cpumask var allocation on stack
For CONFIGCPUMASKOFFSTACK=y kernel, explicit allocation of cpumask variable on stack is not recommended since it can cause potential stack overflow.
Instead, kernel code should always use cpumaskvar API(s) to allocate cpumask var in config-neutral way, leaving allocation strategy to CONFIGCPUMASKOFFSTACK.
Use cpumaskvar API(s) to address it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 4.19.317 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.4.279 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.10.221 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.15.162 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.1.97 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.6.37 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.9.8 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.10 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.98-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.9.8-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Compensating control
In net/iucv, replace explicit cpumask variable allocation on the stack with the *cpumask_var API(s), so allocation remains configuration-neutral for CONFIG_CPUMASK_OFFSTACK=y and avoids potential stack overflow.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-42094?
CVE-2024-42094 has been classified as a potential risk for stack overflow vulnerabilities in specific Linux kernel configurations.
How do I fix CVE-2024-42094?
To fix CVE-2024-42094, update to one of the patched kernel versions 4.19.317, 5.4.279, 5.10.221, 5.15.162, 6.1.97, 6.6.37, 6.9.8, or 6.10.
Which systems are affected by CVE-2024-42094?
CVE-2024-42094 affects various Linux kernel versions, specifically between 4.19.0 and 6.10, depending on the distribution.
What is the cause of CVE-2024-42094?
CVE-2024-42094 is caused by explicit allocation of cpumask variables on the stack, which poses a risk of stack overflows.
Is there a risk of exploit with CVE-2024-42094?
Yes, there is a risk of potential exploitation of CVE-2024-42094 if the vulnerable configurations are not updated.