Riskcovery

CVE-2024-43873

vhost/vsock: always initialize seqpacket_allow

State
Published
Severity
Not scored
Published
Aug 21, 2024
Updated
May 11, 2026
Reserved
Aug 17, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

vhost/vsock: always initialize seqpacket_allow

There are two issues around seqpacket_allow: 1. seqpacket_allow is not initialized when socket is created. Thus if features are never set, it will be read uninitialized. 2. if VIRTIO_VSOCK_F_SEQPACKET is set and then cleared, then seqpacket_allow will not be cleared appropriately (existing apps I know about don't usually do this but it's legal and there's no way to be sure no one relies on this).

To fix: - initialize seqpacket_allow after allocation - set it unconditionally in set_features

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • ced7b713711fdd8f99d8d04dc53451441d194c60 to before ea558f10fb05a6503c6e655a1b7d81fdf8e5924cAffected
  • ced7b713711fdd8f99d8d04dc53451441d194c60 to before 3062cb100787a9ddf45de30004b962035cd497fbAffected
  • ced7b713711fdd8f99d8d04dc53451441d194c60 to before 30bd4593669443ac58515e23557dc8cef70d8582Affected
  • ced7b713711fdd8f99d8d04dc53451441d194c60 to before eab96e8716cbfc2834b54f71cc9501ad4eec963bAffected
  • ced7b713711fdd8f99d8d04dc53451441d194c60 to before 1e1fdcbdde3b7663e5d8faeb2245b9b151417d22Affected
LinuxLinux
  • 5.14Affected
  • before 5.14Not affected
  • 5.15.165 through 5.15.*Not affected
  • 6.1.103 through 6.1.*Not affected
  • 6.6.44 through 6.6.*Not affected
  • 6.10.3 through 6.10.*Not affected
  • 6.11 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.