CVE-2024-42318

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-42318", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-07-30T07:40:12.278Z", "datePublished": "2024-08-17T09:09:31.160Z", "dateUpdated": "2026-08-05T11:36:37.407Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:36:37.407Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlandlock: Don't lose track of restrictions on cred_transfer\n\nWhen a process' cred struct is replaced, this _almost_ always invokes\nthe cred_prepare LSM hook; but in one special case (when\nKEYCTL_SESSION_TO_PARENT updates the parent's credentials), the\ncred_transfer LSM hook is used instead. Landlock only implements the\ncred_prepare hook, not cred_transfer, so KEYCTL_SESSION_TO_PARENT causes\nall information on Landlock restrictions to be lost.\n\nThis basically means that a process with the ability to use the fork()\nand keyctl() syscalls can get rid of all Landlock restrictions on\nitself.\n\nFix it by adding a cred_transfer hook that does the same thing as the\nexisting cred_prepare hook. (Implemented by having hook_cred_prepare()\ncall hook_cred_transfer() so that the two functions are less likely to\naccidentally diverge in the future.)"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - Exploitation requires executing local syscalls (`fork()` plus `keyctl(KEYCTL_JOIN_SESSION_KEYRING)` / `keyctl(KEYCTL_SESSION_TO_PARENT)`) on the target system; there is no remote or adjacent-network entry point into the credential-transfer path.\nAC:L - The attacker controls every precondition \u2014 the parent/child relationship, single-threadedness, matching uid/gid, and the distinct session keyrings \u2014 and the upstream selftest demonstrates the escape is 100% deterministic with no race, memory-layout, or timing dependency.\nPR:L - Only the ability to run code as an ordinary local user is needed; Landlock sandboxing and `keyctl()` are entirely unprivileged (the selftest explicitly calls `drop_caps()` before reproducing the escape), and in fact the attacker starts from a *less*-than-normal privilege level inside the sandbox.\nUI:N - The \"victim\" whose credentials are rewritten is the attacker's own parent process, driven entirely by the attacker's task_work; no action by any other user is required.\nS:C - This is a sandbox escape \u2014 the confined process breaks out of the Landlock domain imposed by a separate security authority (the sandboxing supervisor/policy), gaining access to filesystem and network resources managed outside the vulnerable component's security scope.\nC:H - All Landlock restrictions are dropped at once, so the escaped process can read every file and directory the policy was specifically deployed to hide from it, a total loss of the confidentiality guarantee of the impacted component.\nI:H - The escape restores unrestricted write, create, rename, link and (ABI 3+) truncate access plus network bind/connect, letting the process arbitrarily modify data the sandbox policy protected.\nA:H - With every restriction removed the process can delete and truncate files the Landlock policy existed to protect, destroying the availability of the sandboxed resources; the protection is permanently and completely lost for the lifetime of the process and all its descendants."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["security/landlock/cred.c"], "versions": [{"version": "385975dca53eb41031d0cbd1de318eb1bc5d6bb9", "lessThan": "916c648323fa53b89eedb34a0988ddaf01406117", "status": "affected", "versionType": "git"}, {"version": "385975dca53eb41031d0cbd1de318eb1bc5d6bb9", "lessThan": "0d74fd54db0bd0c0c224bef0da8fc95ea9c9f36c", "status": "affected", "versionType": "git"}, {"version": "385975dca53eb41031d0cbd1de318eb1bc5d6bb9", "lessThan": "16896914bace82d7811c62f3b6d5320132384f49", "status": "affected", "versionType": "git"}, {"version": "385975dca53eb41031d0cbd1de318eb1bc5d6bb9", "lessThan": "b14cc2cf313bd29056fadbc8ecd7f957cf5791ff", "status": "affected", "versionType": "git"}, {"version": "385975dca53eb41031d0cbd1de318eb1bc5d6bb9", "lessThan": "39705a6c29f8a2b93cf5b99528a55366c50014d1", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["security/landlock/cred.c"], "versions": [{"version": "5.13", "status": "affected"}, {"version": "0", "lessThan": "5.13", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.165", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.103", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.44", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.10.3", "lessThanOrEqual": "6.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.11", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "5.15.165"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.1.103"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.6.44"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.10.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.11"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/916c648323fa53b89eedb34a0988ddaf01406117"}, {"url": "https://git.kernel.org/stable/c/0d74fd54db0bd0c0c224bef0da8fc95ea9c9f36c"}, {"url": "https://git.kernel.org/stable/c/16896914bace82d7811c62f3b6d5320132384f49"}, {"url": "https://git.kernel.org/stable/c/b14cc2cf313bd29056fadbc8ecd7f957cf5791ff"}, {"url": "https://git.kernel.org/stable/c/39705a6c29f8a2b93cf5b99528a55366c50014d1"}, {"url": "https://lore.kernel.org/all/20240817.shahka3Ee1iy@digikod.net/"}, {"url": "https://www.openwall.com/lists/oss-security/2024/08/17/2"}, {"url": "https://bugs.chromium.org/p/project-zero/issues/detail?id=2566"}], "title": "landlock: Don't lose track of restrictions on cred_transfer", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2024/08/17/2"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:04:37.227Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-42318", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T16:09:35.795087Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-12T17:33:26.227Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2024/08/17/2"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:04:37.227Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-42318", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T16:09:35.795087Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:23.367Z"}}], "cna": {"title": "landlock: Don't lose track of restrictions on cred_transfer", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - Exploitation requires executing local syscalls (`fork()` plus `keyctl(KEYCTL_JOIN_SESSION_KEYRING)` / `keyctl(KEYCTL_SESSION_TO_PARENT)`) on the target system; there is no remote or adjacent-network entry point into the credential-transfer path.\nAC:L - The attacker controls every precondition \u2014 the parent/child relationship, single-threadedness, matching uid/gid, and the distinct session keyrings \u2014 and the upstream selftest demonstrates the escape is 100% deterministic with no race, memory-layout, or timing dependency.\nPR:L - Only the ability to run code as an ordinary local user is needed; Landlock sandboxing and `keyctl()` are entirely unprivileged (the selftest explicitly calls `drop_caps()` before reproducing the escape), and in fact the attacker starts from a *less*-than-normal privilege level inside the sandbox.\nUI:N - The \"victim\" whose credentials are rewritten is the attacker's own parent process, driven entirely by the attacker's task_work; no action by any other user is required.\nS:C - This is a sandbox escape \u2014 the confined process breaks out of the Landlock domain imposed by a separate security authority (the sandboxing supervisor/policy), gaining access to filesystem and network resources managed outside the vulnerable component's security scope.\nC:H - All Landlock restrictions are dropped at once, so the escaped process can read every file and directory the policy was specifically deployed to hide from it, a total loss of the confidentiality guarantee of the impacted component.\nI:H - The escape restores unrestricted write, create, rename, link and (ABI 3+) truncate access plus network bind/connect, letting the process arbitrarily modify data the sandbox policy protected.\nA:H - With every restriction removed the process can delete and truncate files the Landlock policy existed to protect, destroying the availability of the sandboxed resources; the protection is permanently and completely lost for the lifetime of the process and all its descendants."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "385975dca53eb41031d0cbd1de318eb1bc5d6bb9", "lessThan": "916c648323fa53b89eedb34a0988ddaf01406117", "versionType": "git"}, {"status": "affected", "version": "385975dca53eb41031d0cbd1de318eb1bc5d6bb9", "lessThan": "0d74fd54db0bd0c0c224bef0da8fc95ea9c9f36c", "versionType": "git"}, {"status": "affected", "version": "385975dca53eb41031d0cbd1de318eb1bc5d6bb9", "lessThan": "16896914bace82d7811c62f3b6d5320132384f49", "versionType": "git"}, {"status": "affected", "version": "385975dca53eb41031d0cbd1de318eb1bc5d6bb9", "lessThan": "b14cc2cf313bd29056fadbc8ecd7f957cf5791ff", "versionType": "git"}, {"status": "affected", "version": "385975dca53eb41031d0cbd1de318eb1bc5d6bb9", "lessThan": "39705a6c29f8a2b93cf5b99528a55366c50014d1", "versionType": "git"}], "programFiles": ["security/landlock/cred.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.13"}, {"status": "unaffected", "version": "0", "lessThan": "5.13", "versionType": "semver"}, {"status": "unaffected", "version": "5.15.165", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.103", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.44", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.10.3", "versionType": "semver", "lessThanOrEqual": "6.10.*"}, {"status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["security/landlock/cred.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/916c648323fa53b89eedb34a0988ddaf01406117"}, {"url": "https://git.kernel.org/stable/c/0d74fd54db0bd0c0c224bef0da8fc95ea9c9f36c"}, {"url": "https://git.kernel.org/stable/c/16896914bace82d7811c62f3b6d5320132384f49"}, {"url": "https://git.kernel.org/stable/c/b14cc2cf313bd29056fadbc8ecd7f957cf5791ff"}, {"url": "https://git.kernel.org/stable/c/39705a6c29f8a2b93cf5b99528a55366c50014d1"}, {"url": "https://lore.kernel.org/all/20240817.shahka3Ee1iy@digikod.net/"}, {"url": "https://www.openwall.com/lists/oss-security/2024/08/17/2"}, {"url": "https://bugs.chromium.org/p/project-zero/issues/detail?id=2566"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlandlock: Don't lose track of restrictions on cred_transfer\n\nWhen a process' cred struct is replaced, this _almost_ always invokes\nthe cred_prepare LSM hook; but in one special case (when\nKEYCTL_SESSION_TO_PARENT updates the parent's credentials), the\ncred_transfer LSM hook is used instead. Landlock only implements the\ncred_prepare hook, not cred_transfer, so KEYCTL_SESSION_TO_PARENT causes\nall information on Landlock restrictions to be lost.\n\nThis basically means that a process with the ability to use the fork()\nand keyctl() syscalls can get rid of all Landlock restrictions on\nitself.\n\nFix it by adding a cred_transfer hook that does the same thing as the\nexisting cred_prepare hook. (Implemented by having hook_cred_prepare()\ncall hook_cred_transfer() so that the two functions are less likely to\naccidentally diverge in the future.)"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.165", "versionStartIncluding": "5.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.103", "versionStartIncluding": "5.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.44", "versionStartIncluding": "5.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.10.3", "versionStartIncluding": "5.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.11", "versionStartIncluding": "5.13"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:36:37.407Z"}}}, "cveMetadata": {"cveId": "CVE-2024-42318", "state": "PUBLISHED", "dateUpdated": "2026-08-05T11:36:37.407Z", "dateReserved": "2024-07-30T07:40:12.278Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-08-17T09:09:31.160Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["security/landlock/cred.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "916c648323fa53b89eedb34a0988ddaf01406117", "status": "affected", "version": "385975dca53eb41031d0cbd1de318eb1bc5d6bb9", "versionType": "git"}, {"lessThan": "0d74fd54db0bd0c0c224bef0da8fc95ea9c9f36c", "status": "affected", "version": "385975dca53eb41031d0cbd1de318eb1bc5d6bb9", "versionType": "git"}, {"lessThan": "16896914bace82d7811c62f3b6d5320132384f49", "status": "affected", "version": "385975dca53eb41031d0cbd1de318eb1bc5d6bb9", "versionType": "git"}, {"lessThan": "b14cc2cf313bd29056fadbc8ecd7f957cf5791ff", "status": "affected", "version": "385975dca53eb41031d0cbd1de318eb1bc5d6bb9", "versionType": "git"}, {"lessThan": "39705a6c29f8a2b93cf5b99528a55366c50014d1", "status": "affected", "version": "385975dca53eb41031d0cbd1de318eb1bc5d6bb9", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["security/landlock/cred.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.13"}, {"lessThan": "5.13", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.165", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.103", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.44", "versionType": "semver"}, {"lessThanOrEqual": "6.10.*", "status": "unaffected", "version": "6.10.3", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.11", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C9AF5ED3-AC3F-4864-B907-F7C809A8995E", "versionEndExcluding": "5.15.165", "versionStartIncluding": "5.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E45EAC72-8329-4F99-8276-86AF9BB3496A", "versionEndExcluding": "6.1.103", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "CC912330-6B41-4C6B-99AF-F3857FBACB6A", "versionEndExcluding": "6.6.44", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "92D388F2-1EAF-4CFA-AC06-5B26D762EA7D", "versionEndExcluding": "6.10.3", "versionStartIncluding": "6.7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlandlock: Don't lose track of restrictions on cred_transfer\n\nWhen a process' cred struct is replaced, this _almost_ always invokes\nthe cred_prepare LSM hook; but in one special case (when\nKEYCTL_SESSION_TO_PARENT updates the parent's credentials), the\ncred_transfer LSM hook is used instead. Landlock only implements the\ncred_prepare hook, not cred_transfer, so KEYCTL_SESSION_TO_PARENT causes\nall information on Landlock restrictions to be lost.\n\nThis basically means that a process with the ability to use the fork()\nand keyctl() syscalls can get rid of all Landlock restrictions on\nitself.\n\nFix it by adding a cred_transfer hook that does the same thing as the\nexisting cred_prepare hook. (Implemented by having hook_cred_prepare()\ncall hook_cred_transfer() so that the two functions are less likely to\naccidentally diverge in the future.)"}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: landlock: no pierda de vista las restricciones en cred_transfer Cuando se reemplaza la estructura cred de un proceso, esto _almost_ always invoca el gancho LSM cred_prepare; pero en un caso especial (cuando KEYCTL_SESSION_TO_PARENT actualiza las credenciales de los padres), se utiliza el gancho LSM cred_transfer. Landlock solo implementa el gancho cred_prepare, no cred_transfer, por lo que KEYCTL_SESSION_TO_PARENT hace que se pierda toda la informaci\u00f3n sobre las restricciones de Landlock. B\u00e1sicamente, esto significa que un proceso con la capacidad de utilizar las llamadas al sistema fork() y keyctl() puede deshacerse de todas las restricciones de Landlock sobre s\u00ed mismo. Solucionelo agregando un gancho cred_transfer que haga lo mismo que el gancho cred_prepare existente. (Se implementa haciendo que hook_cred_prepare() llame a hook_cred_transfer() para que sea menos probable que las dos funciones diverjan accidentalmente en el futuro)."}], "id": "CVE-2024-42318", "lastModified": "2026-08-04T11:19:52.137", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 6.0, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-42318", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:09:35.795087Z", "version": "2.0.3"}}]}, "published": "2024-08-17T09:15:11.700", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Issue Tracking", "Third Party Advisory"], "url": "https://bugs.chromium.org/p/project-zero/issues/detail?id=2566"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0d74fd54db0bd0c0c224bef0da8fc95ea9c9f36c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/16896914bace82d7811c62f3b6d5320132384f49"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/39705a6c29f8a2b93cf5b99528a55366c50014d1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/916c648323fa53b89eedb34a0988ddaf01406117"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b14cc2cf313bd29056fadbc8ecd7f957cf5791ff"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Mailing List"], "url": "https://lore.kernel.org/all/20240817.shahka3Ee1iy@digikod.net/"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Mailing List"], "url": "https://www.openwall.com/lists/oss-security/2024/08/17/2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List"], "url": "http://www.openwall.com/lists/oss-security/2024/08/17/2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: landlock: Don't lose track of restrictions on cred_transfer", "id": "2305463", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2305463"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-99", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nlandlock: Don't lose track of restrictions on cred_transfer\nWhen a process' cred struct is replaced, this _almost_ always invokes\nthe cred_prepare LSM hook; but in one special case (when\nKEYCTL_SESSION_TO_PARENT updates the parent's credentials), the\ncred_transfer LSM hook is used instead. Landlock only implements the\ncred_prepare hook, not cred_transfer, so KEYCTL_SESSION_TO_PARENT causes\nall information on Landlock restrictions to be lost.\nThis basically means that a process with the ability to use the fork()\nand keyctl() syscalls can get rid of all Landlock restrictions on\nitself.\nFix it by adding a cred_transfer hook that does the same thing as the\nexisting cred_prepare hook. (Implemented by having hook_cred_prepare()\ncall hook_cred_transfer() so that the two functions are less likely to\naccidentally diverge in the future.)", "A vulnerability was found in the Linux kernel's `axi_chan_handle_err` function, which caused a kernel panic due to NULL pointer dereferencing. This issue has been fixed. The update protects the `vd` variable to prevent such crashes. The `axi_chan_block_xfer_complete` function was used as a reference for this improvement, enhancing system stability during exceptional cases."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2024-42318", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-08-17T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-42318\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-42318\nhttps://lore.kernel.org/linux-cve-announce/2024081754-CVE-2024-42318-f0c9@gregkh/T"], "statement": "Red Hat Enterprise Linux is not impacted by this CVE, as the vulnerability in question does not affect the specific versions or configurations of the Linux kernel used in its distributions. This ensures that users of Red Hat Enterprise Linux are not exposed to the potential risks associated with this issue, and no further action or mitigation is necessary for systems running this operating system.", "threat_severity": "Moderate"}

{"created": "2025-07-12T22:09:50.536608+00:00", "updated": "2025-07-12T22:09:50.536671+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}