NetSight
IP …
medium5.5

CVE-2024-42265

In the Linux kernel, the following vulnerability has been resolved: protect the fetch of ->fd[fd] in do_dup2() from mispredictions both callers have verified t…

Impact

In the Linux kernel, the following vulnerability has been resolved: protect the fetch of ->fd[fd] in do_dup2() from mispredictions both callers have verified that fd is not greater than ->max_fds; however, misprediction might end up with tofree = fdt->fd[fd]; being speculatively executed. That's wrong for the same reasons why it's wrong in close_fd()/file_close_fd_locked(); the same solution applies - array_index_nospec(fd, fdt->max_fds) could differ from fd only in case of speculative execution on mispredicted path.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
before 4.19.320
from 4.20 before 5.4.282
from 5.5 before 5.10.224
from 5.11 before 5.15.165
from 5.16 before 6.1.104
from 6.2 before 6.6.45

References