{"timestamp":"2024-09-10T16:17:39.409257Z","id":"CVE-2024-42108","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ethernet/renesas/rswitch.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"0aeec4bb6a9fc963932bf3c929bdf27d835d44e9","lessThan":"4a41bb9f2b402469d425a1c13359d3b3ea4e6403","versionType":"git","status":"affected"},{"version":"271e015b91535dd87fd0f5df0cc3b906c2eddef9","lessThan":"92cbbe7759193e3418f38d0d73f8fe125312c58b","versionType":"git","status":"affected"},{"version":"271e015b91535dd87fd0f5df0cc3b906c2eddef9","lessThan":"9a0c28efeec6383ef22e97437616b920e7320b67","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ethernet/renesas/rswitch.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.8","status":"affected"},{"version":"0","lessThan":"6.8","versionType":"semver","status":"unaffected"},{"version":"6.9.9","lessThanOrEqual":"6.9.*","versionType":"semver","status":"unaffected"},{"version":"6.10","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

kernel.org: https://git.kernel.org/stable/c/4a41bb9f2b402469d425a1c13359d3b3ea4e6403 Types: Patch

https://git.kernel.org/stable/c/4a41bb9f2b402469d425a1c13359d3b3ea4e6403

https://git.kernel.org/stable/c/92cbbe7759193e3418f38d0d73f8fe125312c58b

https://git.kernel.org/stable/c/9a0c28efeec6383ef22e97437616b920e7320b67

NIST AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NIST CWE-416

OR
     *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.8 up to (excluding) 6.9.9

https://git.kernel.org/stable/c/92cbbe7759193e3418f38d0d73f8fe125312c58b No Types Assigned

https://git.kernel.org/stable/c/92cbbe7759193e3418f38d0d73f8fe125312c58b Patch

https://git.kernel.org/stable/c/9a0c28efeec6383ef22e97437616b920e7320b67 No Types Assigned

https://git.kernel.org/stable/c/9a0c28efeec6383ef22e97437616b920e7320b67 Patch

In the Linux kernel, the following vulnerability has been resolved:

net: rswitch: Avoid use-after-free in rswitch_poll()

The use-after-free is actually in rswitch_tx_free(), which is inlined in
rswitch_poll(). Since `skb` and `gq->skbs[gq->dirty]` are in fact the
same pointer, the skb is first freed using dev_kfree_skb_any(), then the
value in skb->len is used to update the interface statistics.

Let's move around the instructions to use skb->len before the skb is
freed.

This bug is trivial to reproduce using KFENCE. It will trigger a splat
every few packets. A simple ARP request or ICMP echo request is enough.

kernel.org https://git.kernel.org/stable/c/92cbbe7759193e3418f38d0d73f8fe125312c58b [No types assigned]

kernel.org https://git.kernel.org/stable/c/9a0c28efeec6383ef22e97437616b920e7320b67 [No types assigned]