CVE-2024-42157: s390/pkey: Wipe sensitive data on failure
In the Linux kernel, the following vulnerability has been resolved:
s390/pkey: Wipe sensitive data on failure
Wipe sensitive data from stack also if the copytouser() fails.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.98-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.9.9-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Compensating control
Wipe sensitive data from the stack when copy_to_user() fails in the s390/pkey code path.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-42157?
CVE-2024-42157 has been rated as a moderate severity vulnerability in the Linux kernel.
How do I fix CVE-2024-42157?
To address CVE-2024-42157, update your Linux kernel to the fixed versions listed in the official advisories.
Which versions of the Linux kernel are affected by CVE-2024-42157?
CVE-2024-42157 affects several Linux kernel versions prior to the patched releases including those listed in the vulnerability report.
What component of the Linux kernel is impacted by CVE-2024-42157?
CVE-2024-42157 impacts the s390/pkey component of the Linux kernel.
Is CVE-2024-42157 a local or remote vulnerability?
CVE-2024-42157 is considered a local vulnerability as it requires local access to the system to exploit.