CVE-2024-42161

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-42161
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-42161.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-42161
Downstream
Related
Published
2024-07-30T07:47:03Z
Modified
2026-08-12T03:30:24Z
Summary
bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD
Details

In the Linux kernel, the following vulnerability has been resolved:

bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD

[Changes from V1:

  • Use a default branch in the switch statement to initialize `val'.]

GCC warns that `val' may be used uninitialized in the BPF_CRE_READ_BITFIELD macro, defined in bpf_core_read.h as:

[...]
unsigned long long val;						      \
[...]								      \
switch (__CORE_RELO(s, field, BYTE_SIZE)) {			      \
case 1: val = *(const unsigned char *)p; break;			      \
case 2: val = *(const unsigned short *)p; break;		      \
case 4: val = *(const unsigned int *)p; break;			      \
case 8: val = *(const unsigned long long *)p; break;		      \
    }       							      \
[...]
val;								      \
}								      \

This patch adds a default entry in the switch statement that sets `val' to zero in order to avoid the warning, and random values to be used in case __builtin_preserve_field_info returns unexpected values for BPF_FIELD_BYTE_SIZE.

Tested in bpf-next master. No regressions.

Database specific 
{
    "cna_assigner":  "Linux",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/42xxx/CVE-2024-42161.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
ee26dade0e3bcd8a34ae7520e373fb69365fce7a
Fixed
b694989bb13ed5f166e633faa1eb0f21c6d261a6
Fixed
3364c2ed1c241989847f19cf83e3db903ce689e3
Fixed
a21d76bd0b0d39518e9a4c19f6cf7c042a974aff
Fixed
7e5471b5efebc30dd0bc035cda86693a5c73d45f
Fixed
ff941a8449e712eaf7efca1a13bfb9afd3d99fc2
Fixed
009367099eb61a4fc2af44d4eb06b6b4de7de6db

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-42161.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.5.0
Fixed
5.10.222
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.163
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.98
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.39
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.9.9

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-42161.json"