{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-42162", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-07-29T15:50:41.197Z", "datePublished": "2024-07-30T07:47:04.050Z", "dateUpdated": "2026-08-05T11:35:53.971Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:35:53.971Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngve: Account for stopped queues when reading NIC stats\n\nWe now account for the fact that the NIC might send us stats for a\nsubset of queues. Without this change, gve_get_ethtool_stats might make\nan invalid access on the priv->stats_report->stats array." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable code is reached through the `SIOCETHTOOL`/`ETHTOOL_GSTATS` ioctl on a local netdev, requiring local system access. There is no remote or adjacent-network path into `gve_get_ethtool_stats()`.\nAC:L - The attacker can invoke `ethtool -S` an unlimited number of times with no rate limit, and because the out-of-bounds index comes from an uninitialized small kmalloc allocation, standard slab grooming lets the attacker place chosen values there, making the OOB access reliable and repeatable rather than dependent on chance.\nPR:L - `ETHTOOL_GSTATS` is explicitly listed among the ethtool commands \"allowed to be done by anyone\" in `__dev_ethtool()`, bypassing the `ns_capable(CAP_NET_ADMIN)` check, so only an ordinary unprivileged local account is needed.\nUI:N - The attacker triggers the entire flow themselves with a single ioctl; no action by any other user or administrator is required.\nS:U - The out-of-bounds read and write are confined to kernel memory within the same security authority as the kernel itself, with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - Four `u64` words per affected queue are read from an uncontrolled/groomable offset outside the `priv->stats_report->stats` DMA buffer and copied straight to userspace by `ethtool_get_stats()`, yielding disclosure of arbitrary kernel memory including pointers and secrets.\nI:H - The unvalidated device-supplied `queue_id` is used directly as an index in `rx_qid_to_stats_idx[queue_id] = stats_idx`, giving a far out-of-bounds heap write of a partly controlled `int`; the fix's added bounds checks confirm this is an out-of-bounds write suitable for heap corruption and control-flow hijack.\nA:H - A garbage `stats_idx` can address up to ±32 GB from the stats buffer, so dereferencing unmapped or non-canonical memory produces a kernel oops/panic, and the OOB write can corrupt adjacent slab objects and crash the system." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/google/gve/gve_ethtool.c" ], "versions": [ { "version": "2f523dc34ac8c355609e9b847852bf25bbdb30bf", "lessThan": "32675d828c8a392e20d5b42375ed112c407e4b62", "status": "affected", "versionType": "git" }, { "version": "2f523dc34ac8c355609e9b847852bf25bbdb30bf", "lessThan": "af9bcf910b1f86244f39e15e701b2dc564b469a6", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/google/gve/gve_ethtool.c" ], "versions": [ { "version": "5.10", "status": "affected" }, { "version": "0", "lessThan": "5.10", "status": "unaffected", "versionType": "semver" }, { "version": "6.9.9", "lessThanOrEqual": "6.9.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.10", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.9.9" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.10" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/32675d828c8a392e20d5b42375ed112c407e4b62" }, { "url": "https://git.kernel.org/stable/c/af9bcf910b1f86244f39e15e701b2dc564b469a6" } ], "title": "gve: Account for stopped queues when reading NIC stats", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:54:32.609Z" }, "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/32675d828c8a392e20d5b42375ed112c407e4b62", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/af9bcf910b1f86244f39e15e701b2dc564b469a6", "tags": [ "x_transferred" ] } ] }, { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2024-42162", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-09-10T16:14:49.244034Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:33:07.261Z" } } ] } }