CVE-2024-42292

kobject_uevent: Fix OOB access within zap_modalias_env()

State: Published
Severity: Not scored
Published: Aug 17, 2024
Updated: Oct 15, 2026
Reserved: Jul 30, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

kobject_uevent: Fix OOB access within zap_modalias_env()

zap_modalias_env() wrongly calculates size of memory block to move, so will cause OOB memory access issue if variable MODALIAS is not the last one within its @env parameter, fixed by correcting size to memmove.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	9b3fa47d4a76b1d606a396455f9bbeee083ef008 to before 81a15d28f32af01493ae8c5457e0d55314a4167dAffected 9b3fa47d4a76b1d606a396455f9bbeee083ef008 to before b59a5e86a3934f1b6a5bd1368902dbc79bdecc90Affected 9b3fa47d4a76b1d606a396455f9bbeee083ef008 to before 648d5490460d38436640da0812bf7f6351c150d2Affected 9b3fa47d4a76b1d606a396455f9bbeee083ef008 to before c5ee8adc8d98a49703320d13878ba2b923b142f5Affected 9b3fa47d4a76b1d606a396455f9bbeee083ef008 to before 68d63ace80b76395e7935687ecdb86421adc2168Affected 9b3fa47d4a76b1d606a396455f9bbeee083ef008 to before 57fe01d3d04276875c7e3a6dc763517fc05b8762Affected 9b3fa47d4a76b1d606a396455f9bbeee083ef008 to before d4663536754defff75ff1eca0aaebc41da165a8dAffected 9b3fa47d4a76b1d606a396455f9bbeee083ef008 to before dd6e9894b451e7c85cceb8e9dc5432679a70e7dcAffected
LinuxLinux	4.15Affected before 4.15Not affected 4.19.320 through 4.19.Not affected 5.4.282 through 5.4.Not affected 5.10.224 through 5.10.Not affected 5.15.165 through 5.15.Not affected 6.1.103 through 6.1.Not affected 6.6.44 through 6.6.Not affected 6.10.3 through 6.10.*Not affected 6.11 and laterNot affected

Product

Versions

LinuxLinux

9b3fa47d4a76b1d606a396455f9bbeee083ef008 to before 81a15d28f32af01493ae8c5457e0d55314a4167dAffected
9b3fa47d4a76b1d606a396455f9bbeee083ef008 to before b59a5e86a3934f1b6a5bd1368902dbc79bdecc90Affected
9b3fa47d4a76b1d606a396455f9bbeee083ef008 to before 648d5490460d38436640da0812bf7f6351c150d2Affected
9b3fa47d4a76b1d606a396455f9bbeee083ef008 to before c5ee8adc8d98a49703320d13878ba2b923b142f5Affected
9b3fa47d4a76b1d606a396455f9bbeee083ef008 to before 68d63ace80b76395e7935687ecdb86421adc2168Affected
9b3fa47d4a76b1d606a396455f9bbeee083ef008 to before 57fe01d3d04276875c7e3a6dc763517fc05b8762Affected
9b3fa47d4a76b1d606a396455f9bbeee083ef008 to before d4663536754defff75ff1eca0aaebc41da165a8dAffected
9b3fa47d4a76b1d606a396455f9bbeee083ef008 to before dd6e9894b451e7c85cceb8e9dc5432679a70e7dcAffected

LinuxLinux

4.15Affected
before 4.15Not affected
4.19.320 through 4.19.*Not affected
5.4.282 through 5.4.*Not affected
5.10.224 through 5.10.*Not affected
5.15.165 through 5.15.*Not affected
6.1.103 through 6.1.*Not affected
6.6.44 through 6.6.*Not affected
6.10.3 through 6.10.*Not affected
6.11 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.