Vulnerability-Lookup

GHSA-V9X7-5MRP-4M42

Vulnerability from github – Published: 2024-07-30 09:32 – Updated: 2024-08-05 21:31

Details

In the Linux kernel, the following vulnerability has been resolved:

gve: Account for stopped queues when reading NIC stats

We now account for the fact that the NIC might send us stats for a subset of queues. Without this change, gve_get_ethtool_stats might make an invalid access on the priv->stats_report->stats array.

Severity

7.0 (High)


                  
                    CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-42162"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-754"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-07-30T08:15:07Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ngve: Account for stopped queues when reading NIC stats\n\nWe now account for the fact that the NIC might send us stats for a\nsubset of queues. Without this change, gve_get_ethtool_stats might make\nan invalid access on the priv-\u003estats_report-\u003estats array.",
  "id": "GHSA-v9x7-5mrp-4m42",
  "modified": "2024-08-05T21:31:19Z",
  "published": "2024-07-30T09:32:03Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-42162"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/32675d828c8a392e20d5b42375ed112c407e4b62"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/af9bcf910b1f86244f39e15e701b2dc564b469a6"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2024-42162 (GCVE-0-2024-42162)

Vulnerability from cvelistv5 – Published: 2024-07-30 07:47 – Updated: 2026-08-05 11:35

Title

gve: Account for stopped queues when reading NIC stats

Summary

In the Linux kernel, the following vulnerability has been resolved: gve: Account for stopped queues when reading NIC stats We now account for the fact that the NIC might send us stats for a subset of queues. Without this change, gve_get_ethtool_stats might make an invalid access on the priv->stats_report->stats array.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-10 16:14 UTC

Assigner

Linux mitre root

References

2 references

URL	Tags
https://git.kernel.org/stable/c/32675d828c8a392e2…
https://git.kernel.org/stable/c/af9bcf910b1f86244…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 2f523dc34ac8c355609e9b847852bf25bbdb30bf , < 32675d828c8a392e20d5b42375ed112c407e4b62 (git) Affected: 2f523dc34ac8c355609e9b847852bf25bbdb30bf , < af9bcf910b1f86244f39e15e701b2dc564b469a6 (git)
Linux	Linux	Affected: 5.10 Unaffected: 0 , < 5.10 (semver) Unaffected: 6.9.9 , ≤ 6.9.* (semver) Unaffected: 6.10 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:54:32.609Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/32675d828c8a392e20d5b42375ed112c407e4b62"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/af9bcf910b1f86244f39e15e701b2dc564b469a6"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-42162",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:14:49.244034Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:07.261Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/google/gve/gve_ethtool.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "32675d828c8a392e20d5b42375ed112c407e4b62",
              "status": "affected",
              "version": "2f523dc34ac8c355609e9b847852bf25bbdb30bf",
              "versionType": "git"
            },
            {
              "lessThan": "af9bcf910b1f86244f39e15e701b2dc564b469a6",
              "status": "affected",
              "version": "2f523dc34ac8c355609e9b847852bf25bbdb30bf",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/google/gve/gve_ethtool.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.10"
            },
            {
              "lessThan": "5.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.9",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngve: Account for stopped queues when reading NIC stats\n\nWe now account for the fact that the NIC might send us stats for a\nsubset of queues. Without this change, gve_get_ethtool_stats might make\nan invalid access on the priv-\u003estats_report-\u003estats array."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached through the `SIOCETHTOOL`/`ETHTOOL_GSTATS` ioctl on a local netdev, requiring local system access. There is no remote or adjacent-network path into `gve_get_ethtool_stats()`.\nAC:L - The attacker can invoke `ethtool -S` an unlimited number of times with no rate limit, and because the out-of-bounds index comes from an uninitialized small kmalloc allocation, standard slab grooming lets the attacker place chosen values there, making the OOB access reliable and repeatable rather than dependent on chance.\nPR:L - `ETHTOOL_GSTATS` is explicitly listed among the ethtool commands \"allowed to be done by anyone\" in `__dev_ethtool()`, bypassing the `ns_capable(CAP_NET_ADMIN)` check, so only an ordinary unprivileged local account is needed.\nUI:N - The attacker triggers the entire flow themselves with a single ioctl; no action by any other user or administrator is required.\nS:U - The out-of-bounds read and write are confined to kernel memory within the same security authority as the kernel itself, with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - Four `u64` words per affected queue are read from an uncontrolled/groomable offset outside the `priv-\u003estats_report-\u003estats` DMA buffer and copied straight to userspace by `ethtool_get_stats()`, yielding disclosure of arbitrary kernel memory including pointers and secrets.\nI:H - The unvalidated device-supplied `queue_id` is used directly as an index in `rx_qid_to_stats_idx[queue_id] = stats_idx`, giving a far out-of-bounds heap write of a partly controlled `int`; the fix\u0027s added bounds checks confirm this is an out-of-bounds write suitable for heap corruption and control-flow hijack.\nA:H - A garbage `stats_idx` can address up to \u00b132 GB from the stats buffer, so dereferencing unmapped or non-canonical memory produces a kernel oops/panic, and the OOB write can corrupt adjacent slab objects and crash the system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:35:53.971Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/32675d828c8a392e20d5b42375ed112c407e4b62"
        },
        {
          "url": "https://git.kernel.org/stable/c/af9bcf910b1f86244f39e15e701b2dc564b469a6"
        }
      ],
      "title": "gve: Account for stopped queues when reading NIC stats",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-42162",
    "datePublished": "2024-07-30T07:47:04.050Z",
    "dateReserved": "2024-07-29T15:50:41.197Z",
    "dateUpdated": "2026-08-05T11:35:53.971Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.