CVE-2024-42272

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.50

Description The vulnerability is related to the use of an uninitialized resource in the Linux kernel's sched component. Specifically, the issue arises from the rhashtable lookup() function using padding bytes that are not initialized in the struct zones ht key. This can lead to a denial-of-service condition. The vulnerability is caused by a blamed commit that increased the lookup key size from 2 bytes to 16 bytes due to zones ht key getting a struct net pointer.

Recommendations To resolve the issue, update the Linux kernel to version 6.6.50 or later. As a temporary workaround, consider disabling the tcf ct flow table get() function until a patch is available. Restrict access to the vulnerable module net/sched/act ct.c to minimize the risk of exploitation. Avoid using the rhashtable lookup() function in the affected API endpoint until the issue is resolved.