VYPR
← All advisories
Medium severity5.5NVD Advisory· Published Aug 17, 2024· Updated May 12, 2026

CVE-2024-42312

CVE-2024-42312

Description

In the Linux kernel, the following vulnerability has been resolved:

sysctl: always initialize i_uid/i_gid

Always initialize i_uid/i_gid inside the sysfs core so set_ownership() can safely skip setting them.

Commit 5ec27ec735ba ("fs/proc/proc_sysctl.c: fix the default values of i_uid/i_gid on /proc/sys inodes.") added defaults for i_uid/i_gid when set_ownership() was not implemented. It also missed adjusting net_ctl_set_ownership() to use the same default values in case the computation of a better value failed.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

In the Linux kernel, sysctl inodes may have uninitialized i_uid/i_gid values, potentially leading to incorrect ownership and security implications.

Vulnerability

Overview

CVE-2024-42312 is a vulnerability in the Linux kernel's sysctl implementation, where the i_uid and i_gid fields in procfs inodes may not be properly initialized. The commit 5ec27ec735ba attempted to set default values when the set_ownership() callback is not implemented, but it missed a case in net_ctl_set_ownership() where the computation of better values could fail, leaving the ownership fields uninitialized [1][2][3][4].

Attack

Vector and Prerequisites

An attacker with local access and the ability to observe or interact with sysctl entries under /proc/sys/ could exploit this. The bug resides in the kernel's sysfs core, so the attacker does not need special privileges beyond what is necessary to read the procfs entries. However, exploitation typically requires the attacker to be able to trigger the uninitialized ownership scenario, which may depend on the network namespace configuration.

Impact

A successful exploit could allow an attacker to gain insights into kernel memory layout (information disclosure) by reading the uninitialized values, or potentially bypass access controls if the incorrect ownership grants unexpected privileges. The CVSS v3 score of 5.5 (Medium) reflects the local attack vector and the potential for confidentiality impact.

Mitigation

The fix ensures that i_uid and i_gid are always initialized in the sysfs core before any ownership callbacks are invoked. Patches are available from the Linux kernel stable tree [2][3][4]. Affected products, such as the SIMATIC S7-1500 TM MFP - GNU/Linux subsystem, are listed in Siemens advisory SSA-265688 [1]. Users are advised to apply the kernel updates as soon as possible.

References
  1. SSA-265688
  2. Making sure you're not a bot!
  3. Making sure you're not a bot!
  4. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

120

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

9

News mentions

0

No linked articles in our index yet.