VYPR
← All advisories
High severity7.1NVD Advisory· Published Aug 17, 2024· Updated May 12, 2026

CVE-2024-42292

CVE-2024-42292

Description

In the Linux kernel, the following vulnerability has been resolved:

kobject_uevent: Fix OOB access within zap_modalias_env()

zap_modalias_env() wrongly calculates size of memory block to move, so will cause OOB memory access issue if variable MODALIAS is not the last one within its @env parameter, fixed by correcting size to memmove.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Linux kernel OOB access in kobject_uevent's zap_modalias_env() due to incorrect memmove size, allowing local privilege escalation or system crash.

In the Linux kernel, the function zap_modalias_env() within the kobject_uevent subsystem incorrectly calculated the size parameter for a memmove operation. This flaw can cause an out-of-bounds (OOB) memory access when the MODALIAS environment variable is not the last entry in the array, leading to memory corruption or information leaks [1].

Exploitation of this vulnerability requires local access to the system, as the bug is triggered during kernel processing of user-supplied environment variables via uevents. An attacker with local privileges could craft specific environment variables to trigger the OOB access, potentially leading to kernel memory corruption.

The impact of successful exploitation includes system crashes (denial of service) or, in more severe cases, local privilege escalation if an attacker can leverage the memory corruption to gain elevated permissions [1]. The high CVSS score of 7.1 reflects the potential for significant system compromise.

This vulnerability has been patched in the Linux kernel. Siemens has confirmed that the SIMATIC S7-1500 TM MFP - GNU/Linux subsystem is affected and lists this CVE among many others in their advisory SSA-265688. Users are advised to apply kernel updates from their distribution vendors or the official Linux kernel stable releases.

References
  1. SSA-265688

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

133

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

11

News mentions

0

No linked articles in our index yet.