NetSight
IP …
medium5.5

CVE-2024-42312

In the Linux kernel, the following vulnerability has been resolved: sysctl: always initialize i_uid/i_gid Always initialize i_uid/i_gid inside the sysfs core s…

Impact

In the Linux kernel, the following vulnerability has been resolved: sysctl: always initialize i_uid/i_gid Always initialize i_uid/i_gid inside the sysfs core so set_ownership() can safely skip setting them. Commit 5ec27ec735ba ("fs/proc/proc_sysctl.c: fix the default values of i_uid/i_gid on /proc/sys inodes.") added defaults for i_uid/i_gid when set_ownership() was not implemented. It also missed adjusting net_ctl_set_ownership() to use the same default values in case the computation of a better value failed.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 4.9.187 before 4.10
from 4.14.135 before 4.15
from 4.19.61 before 4.20
from 5.1.20 before 5.2
from 5.2.3 before 5.10.224
from 5.11 before 5.15.165

Weakness classification

CWE-908

References