CVE-2024-27431

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-27431
In the Linux kernel, the following vulnerability has been resolved: cpumap: Zero-initialise xdp_rxq_info struct before running XDP program When running an XDP program that is attached to a cpumap entry, we don't initialise the xdp_rxq_info data structure being used in the xdp_buff that backs the XDP program invocation. Tobias noticed that this leads to random values being returned as the xdp_md->rx_queue_index value for XDP programs running in a cpumap. This means we're basically returning the contents of the uninitialised memory, which is bad. Fix this by zero-initialising the rxq data structure before running the XDP program.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/2487007aa3b9fafbd2cb14068f49791ce1d7ede5 Patch
https://git.kernel.org/stable/c/3420b3ff1ff489c177ea1cb7bd9fbbc4e9a0be95 Patch
https://git.kernel.org/stable/c/5f4e51abfbe6eb444fa91906a5cd083044278297 Patch
https://git.kernel.org/stable/c/eaa7cb836659ced2d9f814ac32aa3ec193803ed6 Patch
https://git.kernel.org/stable/c/f0363af9619c77730764f10360e36c6445c12f7b Patch
https://git.kernel.org/stable/c/f562e4c4aab00986dde3093c4be919c3f2b85a4a Patch
https://git.kernel.org/stable/c/2487007aa3b9fafbd2cb14068f49791ce1d7ede5 Patch
https://git.kernel.org/stable/c/3420b3ff1ff489c177ea1cb7bd9fbbc4e9a0be95 Patch
https://git.kernel.org/stable/c/5f4e51abfbe6eb444fa91906a5cd083044278297 Patch
https://git.kernel.org/stable/c/eaa7cb836659ced2d9f814ac32aa3ec193803ed6 Patch
https://git.kernel.org/stable/c/f0363af9619c77730764f10360e36c6445c12f7b Patch
https://git.kernel.org/stable/c/f562e4c4aab00986dde3093c4be919c3f2b85a4a Patch
https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc7:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
History

23 Dec 2025, 18:45

Type Values Removed Values Added
First Time Linux
Debian
Debian debian Linux
Linux linux Kernel
CWE NVD-CWE-noinfo
CPE cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc7:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/2487007aa3b9fafbd2cb14068f49791ce1d7ede5 - () https://git.kernel.org/stable/c/2487007aa3b9fafbd2cb14068f49791ce1d7ede5 - Patch
References () https://git.kernel.org/stable/c/3420b3ff1ff489c177ea1cb7bd9fbbc4e9a0be95 - () https://git.kernel.org/stable/c/3420b3ff1ff489c177ea1cb7bd9fbbc4e9a0be95 - Patch
References () https://git.kernel.org/stable/c/5f4e51abfbe6eb444fa91906a5cd083044278297 - () https://git.kernel.org/stable/c/5f4e51abfbe6eb444fa91906a5cd083044278297 - Patch
References () https://git.kernel.org/stable/c/eaa7cb836659ced2d9f814ac32aa3ec193803ed6 - () https://git.kernel.org/stable/c/eaa7cb836659ced2d9f814ac32aa3ec193803ed6 - Patch
References () https://git.kernel.org/stable/c/f0363af9619c77730764f10360e36c6445c12f7b - () https://git.kernel.org/stable/c/f0363af9619c77730764f10360e36c6445c12f7b - Patch
References () https://git.kernel.org/stable/c/f562e4c4aab00986dde3093c4be919c3f2b85a4a - () https://git.kernel.org/stable/c/f562e4c4aab00986dde3093c4be919c3f2b85a4a - Patch
References () https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html - () https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html - Third Party Advisory

21 Nov 2024, 09:04

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html -
References () https://git.kernel.org/stable/c/2487007aa3b9fafbd2cb14068f49791ce1d7ede5 - () https://git.kernel.org/stable/c/2487007aa3b9fafbd2cb14068f49791ce1d7ede5 -
References () https://git.kernel.org/stable/c/3420b3ff1ff489c177ea1cb7bd9fbbc4e9a0be95 - () https://git.kernel.org/stable/c/3420b3ff1ff489c177ea1cb7bd9fbbc4e9a0be95 -
References () https://git.kernel.org/stable/c/5f4e51abfbe6eb444fa91906a5cd083044278297 - () https://git.kernel.org/stable/c/5f4e51abfbe6eb444fa91906a5cd083044278297 -
References () https://git.kernel.org/stable/c/eaa7cb836659ced2d9f814ac32aa3ec193803ed6 - () https://git.kernel.org/stable/c/eaa7cb836659ced2d9f814ac32aa3ec193803ed6 -
References () https://git.kernel.org/stable/c/f0363af9619c77730764f10360e36c6445c12f7b - () https://git.kernel.org/stable/c/f0363af9619c77730764f10360e36c6445c12f7b -
References () https://git.kernel.org/stable/c/f562e4c4aab00986dde3093c4be919c3f2b85a4a - () https://git.kernel.org/stable/c/f562e4c4aab00986dde3093c4be919c3f2b85a4a -

05 Nov 2024, 10:16

Type Values Removed Values Added
References
  • {'url': 'https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html', 'source': '416baaa9-dc9f-4396-8d5f-8c081fb06d67'}

03 Jul 2024, 01:50

Type Values Removed Values Added
CWE CWE-908
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5

25 Jun 2024, 22:15

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: cpumap: Inicializa a cero la estructura xdp_rxq_info antes de ejecutar el programa XDP Cuando ejecutas un programa XDP que está adjunto a una entrada de cpumap, no inicializamos la estructura de datos xdp_rxq_info que se utiliza en xdp_buff que respalda la invocación del programa XDP. Tobias notó que esto lleva a que se devuelvan valores aleatorios como el valor xdp_md->rx_queue_index para programas XDP que se ejecutan en un cpumap. Esto significa que básicamente estamos devolviendo el contenido de la memoria no inicializada, lo cual es malo. Solucione este problema inicializando a cero la estructura de datos rxq antes de ejecutar el programa XDP.
References
  • () https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html -

17 May 2024, 12:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-17 12:15

Updated : 2025-12-23 18:45

NVD link : CVE-2024-27431

Mitre link : CVE-2024-27431

CVE.ORG link : CVE-2024-27431

JSON object : View

Products Affected

debian

  • debian_linux

linux

  • linux_kernel
CWE
NVD-CWE-noinfo CWE-908

Use of Uninitialized Resource