CVE-2024-42076

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.9.0

Description The vulnerability is related to a kernel-infoleak issue in the Linux kernel's net/can/j1939 module. The j1939 send one() function creates a full frame including unused data but does not initialize it, causing the kernel-infoleak issue. This can be fixed by initializing the unused data. The issue was reported by syzbot and is related to the raw recvmsg() function.

Recommendations To resolve the issue, update the Linux kernel to version 6.9.0 or later. If an update is not possible, consider disabling the j1939 send one() function or restricting access to the vulnerable module as a temporary workaround.