CVE-2024-42312: sysctl: always initialize i_uid/i_gid
In the Linux kernel, the following vulnerability has been resolved:
sysctl: always initialize iuid/igid
Always initialize iuid/igid inside the sysfs core so setownership() can safely skip setting them.
Commit 5ec27ec735ba ("fs/proc/procsysctl.c: fix the default values of iuid/igid on /proc/sys inodes.") added defaults for iuid/igid when setownership() was not implemented. It also missed adjusting netctlsetownership() to use the same default values in case the computation of a better value failed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-42312?
CVE-2024-42312 has been assigned a medium severity rating due to its impact on system ownership attributes.
How do I fix CVE-2024-42312?
To fix CVE-2024-42312, upgrade the Linux kernel to versions 5.10.226-1, 6.1.123-1, 6.1.119-1, 6.12.10-1, or 6.12.11-1.
What systems are affected by CVE-2024-42312?
CVE-2024-42312 affects specific versions of the Linux kernel in Debian distributions.
What can happen if CVE-2024-42312 is exploited?
Exploitation of CVE-2024-42312 may lead to improper ownership being set, affecting system security.
When was CVE-2024-42312 resolved?
CVE-2024-42312 was resolved with the commit made on the Linux kernel, which focused on initializing ownership attributes.