CVE-2024-42162

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-42162", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-07-29T15:50:41.197Z", "datePublished": "2024-07-30T07:47:04.050Z", "dateUpdated": "2026-10-21T12:35:04.536Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:35:04.536Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngve: Account for stopped queues when reading NIC stats\n\nWe now account for the fact that the NIC might send us stats for a\nsubset of queues. Without this change, gve_get_ethtool_stats might make\nan invalid access on the priv->stats_report->stats array."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable code is reached through the `SIOCETHTOOL`/`ETHTOOL_GSTATS` ioctl on a local netdev, requiring local system access. There is no remote or adjacent-network path into `gve_get_ethtool_stats()`.\nAC:L - The attacker can invoke `ethtool -S` an unlimited number of times with no rate limit, and because the out-of-bounds index comes from an uninitialized small kmalloc allocation, standard slab grooming lets the attacker place chosen values there, making the OOB access reliable and repeatable rather than dependent on chance.\nPR:L - `ETHTOOL_GSTATS` is explicitly listed among the ethtool commands \"allowed to be done by anyone\" in `__dev_ethtool()`, bypassing the `ns_capable(CAP_NET_ADMIN)` check, so only an ordinary unprivileged local account is needed.\nUI:N - The attacker triggers the entire flow themselves with a single ioctl; no action by any other user or administrator is required.\nS:U - The out-of-bounds read and write are confined to kernel memory within the same security authority as the kernel itself, with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - Four `u64` words per affected queue are read from an uncontrolled/groomable offset outside the `priv->stats_report->stats` DMA buffer and copied straight to userspace by `ethtool_get_stats()`, yielding disclosure of arbitrary kernel memory including pointers and secrets.\nI:H - The unvalidated device-supplied `queue_id` is used directly as an index in `rx_qid_to_stats_idx[queue_id] = stats_idx`, giving a far out-of-bounds heap write of a partly controlled `int`; the fix's added bounds checks confirm this is an out-of-bounds write suitable for heap corruption and control-flow hijack.\nA:H - A garbage `stats_idx` can address up to \u00b132 GB from the stats buffer, so dereferencing unmapped or non-canonical memory produces a kernel oops/panic, and the OOB write can corrupt adjacent slab objects and crash the system."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/google/gve/gve_ethtool.c"], "versions": [{"version": "2f523dc34ac8c355609e9b847852bf25bbdb30bf", "lessThan": "acf609843a848e2c22ccce98eef109330403380d", "status": "affected", "versionType": "git"}, {"version": "2f523dc34ac8c355609e9b847852bf25bbdb30bf", "lessThan": "32675d828c8a392e20d5b42375ed112c407e4b62", "status": "affected", "versionType": "git"}, {"version": "2f523dc34ac8c355609e9b847852bf25bbdb30bf", "lessThan": "af9bcf910b1f86244f39e15e701b2dc564b469a6", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/google/gve/gve_ethtool.c"], "versions": [{"version": "5.10", "status": "affected"}, {"version": "0", "lessThan": "5.10", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.9.9", "lessThanOrEqual": "6.9.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.10", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.9.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.10"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/acf609843a848e2c22ccce98eef109330403380d"}, {"url": "https://git.kernel.org/stable/c/32675d828c8a392e20d5b42375ed112c407e4b62"}, {"url": "https://git.kernel.org/stable/c/af9bcf910b1f86244f39e15e701b2dc564b469a6"}], "title": "gve: Account for stopped queues when reading NIC stats", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:54:32.609Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/32675d828c8a392e20d5b42375ed112c407e4b62", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/af9bcf910b1f86244f39e15e701b2dc564b469a6", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-42162", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T16:14:49.244034Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:33:07.261Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/32675d828c8a392e20d5b42375ed112c407e4b62", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/af9bcf910b1f86244f39e15e701b2dc564b469a6", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:54:32.609Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-42162", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T16:14:49.244034Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:14.635Z"}}], "cna": {"title": "gve: Account for stopped queues when reading NIC stats", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable code is reached through the `SIOCETHTOOL`/`ETHTOOL_GSTATS` ioctl on a local netdev, requiring local system access. There is no remote or adjacent-network path into `gve_get_ethtool_stats()`.\nAC:L - The attacker can invoke `ethtool -S` an unlimited number of times with no rate limit, and because the out-of-bounds index comes from an uninitialized small kmalloc allocation, standard slab grooming lets the attacker place chosen values there, making the OOB access reliable and repeatable rather than dependent on chance.\nPR:L - `ETHTOOL_GSTATS` is explicitly listed among the ethtool commands \"allowed to be done by anyone\" in `__dev_ethtool()`, bypassing the `ns_capable(CAP_NET_ADMIN)` check, so only an ordinary unprivileged local account is needed.\nUI:N - The attacker triggers the entire flow themselves with a single ioctl; no action by any other user or administrator is required.\nS:U - The out-of-bounds read and write are confined to kernel memory within the same security authority as the kernel itself, with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - Four `u64` words per affected queue are read from an uncontrolled/groomable offset outside the `priv->stats_report->stats` DMA buffer and copied straight to userspace by `ethtool_get_stats()`, yielding disclosure of arbitrary kernel memory including pointers and secrets.\nI:H - The unvalidated device-supplied `queue_id` is used directly as an index in `rx_qid_to_stats_idx[queue_id] = stats_idx`, giving a far out-of-bounds heap write of a partly controlled `int`; the fix's added bounds checks confirm this is an out-of-bounds write suitable for heap corruption and control-flow hijack.\nA:H - A garbage `stats_idx` can address up to \u00b132 GB from the stats buffer, so dereferencing unmapped or non-canonical memory produces a kernel oops/panic, and the OOB write can corrupt adjacent slab objects and crash the system."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2f523dc34ac8c355609e9b847852bf25bbdb30bf", "lessThan": "acf609843a848e2c22ccce98eef109330403380d", "versionType": "git"}, {"status": "affected", "version": "2f523dc34ac8c355609e9b847852bf25bbdb30bf", "lessThan": "32675d828c8a392e20d5b42375ed112c407e4b62", "versionType": "git"}, {"status": "affected", "version": "2f523dc34ac8c355609e9b847852bf25bbdb30bf", "lessThan": "af9bcf910b1f86244f39e15e701b2dc564b469a6", "versionType": "git"}], "programFiles": ["drivers/net/ethernet/google/gve/gve_ethtool.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.10"}, {"status": "unaffected", "version": "0", "lessThan": "5.10", "versionType": "semver"}, {"status": "unaffected", "version": "6.6.160", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.9.9", "versionType": "semver", "lessThanOrEqual": "6.9.*"}, {"status": "unaffected", "version": "6.10", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/ethernet/google/gve/gve_ethtool.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/acf609843a848e2c22ccce98eef109330403380d"}, {"url": "https://git.kernel.org/stable/c/32675d828c8a392e20d5b42375ed112c407e4b62"}, {"url": "https://git.kernel.org/stable/c/af9bcf910b1f86244f39e15e701b2dc564b469a6"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngve: Account for stopped queues when reading NIC stats\n\nWe now account for the fact that the NIC might send us stats for a\nsubset of queues. Without this change, gve_get_ethtool_stats might make\nan invalid access on the priv->stats_report->stats array."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.160", "versionStartIncluding": "5.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.9.9", "versionStartIncluding": "5.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.10", "versionStartIncluding": "5.10"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:35:04.536Z"}}}, "cveMetadata": {"cveId": "CVE-2024-42162", "state": "PUBLISHED", "dateUpdated": "2026-10-21T12:35:04.536Z", "dateReserved": "2024-07-29T15:50:41.197Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-07-30T07:47:04.050Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/google/gve/gve_ethtool.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "acf609843a848e2c22ccce98eef109330403380d", "status": "affected", "version": "2f523dc34ac8c355609e9b847852bf25bbdb30bf", "versionType": "git"}, {"lessThan": "32675d828c8a392e20d5b42375ed112c407e4b62", "status": "affected", "version": "2f523dc34ac8c355609e9b847852bf25bbdb30bf", "versionType": "git"}, {"lessThan": "af9bcf910b1f86244f39e15e701b2dc564b469a6", "status": "affected", "version": "2f523dc34ac8c355609e9b847852bf25bbdb30bf", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/google/gve/gve_ethtool.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.10"}, {"lessThan": "5.10", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.9.*", "status": "unaffected", "version": "6.9.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.10", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "16A6D6AE-0465-47F0-A986-5D3C0A98E1B3", "versionEndIncluding": "6.9.9", "versionStartIncluding": "5.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngve: Account for stopped queues when reading NIC stats\n\nWe now account for the fact that the NIC might send us stats for a\nsubset of queues. Without this change, gve_get_ethtool_stats might make\nan invalid access on the priv->stats_report->stats array."}, {"lang": "es", "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: gve: Cuenta para colas detenidas al leer estad\u00edsticas de NIC Ahora tenemos en cuenta el hecho de que la NIC podr\u00eda enviarnos estad\u00edsticas para un subconjunto de colas. Sin este cambio, gve_get_ethtool_stats podr\u00eda realizar un acceso no v\u00e1lido en la matriz priv->stats_report->stats."}], "id": "CVE-2024-42162", "lastModified": "2026-10-21T13:17:46.530", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-42162", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:14:49.244034Z", "version": "2.0.3"}}]}, "published": "2024-07-30T08:15:07.520", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/32675d828c8a392e20d5b42375ed112c407e4b62"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/acf609843a848e2c22ccce98eef109330403380d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/af9bcf910b1f86244f39e15e701b2dc564b469a6"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/32675d828c8a392e20d5b42375ed112c407e4b62"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/af9bcf910b1f86244f39e15e701b2dc564b469a6"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-754"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: gve: Account for stopped queues when reading NIC stats", "id": "2301540", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2301540"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.7", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ngve: Account for stopped queues when reading NIC stats\nWe now account for the fact that the NIC might send us stats for a\nsubset of queues. Without this change, gve_get_ethtool_stats might make\nan invalid access on the priv->stats_report->stats array.", "An incorrect access flaw was found in the Linux kernel's Google Virtual NIC (gVNIC) driver. This issue could allow a local user to crash the system."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2024-42162", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Will not fix", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Will not fix", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-07-30T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-42162\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-42162\nhttps://lore.kernel.org/linux-cve-announce/2024073037-CVE-2024-42162-ea68@gregkh/T"], "statement": "Only Red Hat Enterprise Linux 9 (latest releases) is affected.", "threat_severity": "Moderate"}

{}