VYPR
← All advisories
Medium severity5.5NVD Advisory· Published Aug 17, 2024· Updated May 12, 2026

CVE-2024-42265

CVE-2024-42265

Description

In the Linux kernel, the following vulnerability has been resolved:

protect the fetch of ->fd[fd] in do_dup2() from mispredictions

both callers have verified that fd is not greater than ->max_fds; however, misprediction might end up with tofree = fdt->fd[fd]; being speculatively executed. That's wrong for the same reasons why it's wrong in close_fd()/file_close_fd_locked(); the same solution applies - array_index_nospec(fd, fdt->max_fds) could differ from fd only in case of speculative execution on mispredicted path.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

In the Linux kernel, a speculative execution flaw in do_dup2() could allow bypass of boundary checks when accessing the file descriptor table.

Vulnerability

Overview

CVE-2024-42265 is a medium-severity vulnerability in the Linux kernel's do_dup2() function. The issue arises because both callers of do_dup2() have verified that the file descriptor fd is not greater than fdt->max_fds. However, due to CPU mispredictions, the subsequent fetch tofree = fdt->fd[fd] could be speculatively executed even when fd is out of bounds, leading to an out-of-bounds array access under speculative execution [1].

Exploitation

Prerequisites

The bug is similar to previously addressed speculative execution vulnerabilities in close_fd() and file_close_fd_locked(). An attacker who can control the file descriptor argument to dup2() and who understands the CPU's branch prediction behavior might be able to trigger speculative out-of-bounds reads. However, no active exploitation has been reported, and the vulnerability is only exploitable on systems with speculative execution CPUs.

Impact

If exploited, an attacker could potentially infer sensitive information from kernel memory through a side-channel attack, such as a variant of Spectre v1. The impact is limited to information disclosure, as the speculative read does not directly write to arbitrary memory. The CVSS score of 5.5 reflects a moderate confidentiality impact.

Mitigation

The fix applies the array_index_nospec() idiom, which inserts a speculation barrier after the bounds check, ensuring that the speculatively executed path uses an index clamped to the valid range [1]. This patch has been backported to stable kernel versions [2][3][4]. Siemens has confirmed that certain SIMATIC S7-1500 TM MFP devices with the GNU/Linux subsystem are affected and should be updated [1].

References
  1. SSA-265688
  2. Making sure you're not a bot!
  3. Making sure you're not a bot!
  4. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

229

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

11

News mentions

0

No linked articles in our index yet.