Log in Start free

Vulnerability · Published Jul 29, 2024 · Assigned by Linux

CVE-2024-41079nvmet: always initialize cqe.result

High 7.5

In plain English

A high-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.6%top 49.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: nvmet: always initialize cqe.result The spec doesn't mandate that the first two double words (aka results) for the command queue entry need to be set to 0 when they are not used (not specified). Though, the target implemention returns 0 for TCP and FC but not for RDMA. Let's make RDMA behave the same and thus explicitly initializing the result field. This prevents leaking any data from the stack.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux6.1.106-1DEBIAN-CVE-2024-41079
Debian:13linux6.9.11-1DEBIAN-CVE-2024-41079
Debian:14linux6.9.11-1DEBIAN-CVE-2024-41079
Ubuntu:22.04:LTSlinux5.15.0-186.196UBUNTU-CVE-2024-41079
Ubuntu:22.04:LTSlinux5.15.0-186.196USN-8575-1
Ubuntu:24.04:LTSlinux6.8.0-48.48UBUNTU-CVE-2024-41079
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2024-41079
Ubuntu:22.04:LTSlinux-aws5.15.0-1112.119UBUNTU-CVE-2024-41079
Ubuntu:22.04:LTSlinux-aws5.15.0-1112.119USN-8575-2
Ubuntu:24.04:LTSlinux-aws6.8.0-1018.20UBUNTU-CVE-2024-41079
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2024-41079
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2024-41079
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2024-41079
Ubuntu:22.04:LTSlinux-aws-6.86.8.0-1018.19~22.04.1UBUNTU-CVE-2024-41079
Ubuntu:22.04:LTSlinux-azure5.15.0-1117.126UBUNTU-CVE-2024-41079
Ubuntu:22.04:LTSlinux-azure5.15.0-1117.126USN-8575-3
Ubuntu:24.04:LTSlinux-azure6.8.0-1017.20UBUNTU-CVE-2024-41079
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2024-41079
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2024-41079
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2024-41079
Ubuntu:22.04:LTSlinux-azure-6.86.8.0-1017.20~22.04.1UBUNTU-CVE-2024-41079
Ubuntu:22.04:LTSlinux-azure-fde5.15.0-1117.126USN-8610-1
Ubuntu:22.04:LTSlinux-azure-fde5.15.0-1117.126UBUNTU-CVE-2024-41079
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2024-41079
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2024-41079
Ubuntu:22.04:LTSlinux-gcp5.15.0-1112.122USN-8575-1
Ubuntu:22.04:LTSlinux-gcp5.15.0-1112.122UBUNTU-CVE-2024-41079
Ubuntu:24.04:LTSlinux-gcp6.8.0-1017.19UBUNTU-CVE-2024-41079
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2024-41079
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2024-41079
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2024-41079
Ubuntu:22.04:LTSlinux-gcp-6.86.8.0-1017.19~22.04.1UBUNTU-CVE-2024-41079
Ubuntu:22.04:LTSlinux-gke5.15.0-1108.114USN-8575-1
Ubuntu:22.04:LTSlinux-gke5.15.0-1108.114UBUNTU-CVE-2024-41079
Ubuntu:24.04:LTSlinux-gke6.8.0-1013.17UBUNTU-CVE-2024-41079
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1095.103UBUNTU-CVE-2024-41079
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1095.103USN-8575-1
Ubuntu:24.04:LTSlinux-gkeop6.8.0-1002.4UBUNTU-CVE-2024-41079
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2024-41079
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2024-41079
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2024-41079
Ubuntu:22.04:LTSlinux-hwe-6.86.8.0-48.48~22.04.1UBUNTU-CVE-2024-41079
Ubuntu:22.04:LTSlinux-ibm5.15.0-1106.110USN-8575-2
Ubuntu:22.04:LTSlinux-ibm5.15.0-1106.110UBUNTU-CVE-2024-41079
Ubuntu:24.04:LTSlinux-ibm6.8.0-1015.15UBUNTU-CVE-2024-41079
Ubuntu:22.04:LTSlinux-ibm-6.86.8.0-1015.15~22.04.1UBUNTU-CVE-2024-41079
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2024-41079
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1107.113UBUNTU-CVE-2024-41079
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1107.113USN-8620-4
Ubuntu:22.04:LTSlinux-kvm5.15.0-1104.109USN-8575-1
Ubuntu:22.04:LTSlinux-kvm5.15.0-1104.109UBUNTU-CVE-2024-41079
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-184.194UBUNTU-CVE-2024-41079
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-184.194USN-8575-1
Ubuntu:24.04:LTSlinux-lowlatency6.8.0-48.48.3UBUNTU-CVE-2024-41079
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2024-41079
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2024-41079
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2024-41079
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.86.8.0-48.48.3~22.04.1UBUNTU-CVE-2024-41079
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1107.108UBUNTU-CVE-2024-41079
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1107.108USN-8575-2
Ubuntu:24.04:LTSlinux-nvidia6.8.0-1017.19UBUNTU-CVE-2024-41079
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2024-41079
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2024-41079
Ubuntu:22.04:LTSlinux-nvidia-6.86.8.0-1017.19~22.04.1UBUNTU-CVE-2024-41079
Ubuntu:24.04:LTSlinux-nvidia-lowlatency6.8.0-1017.19.1UBUNTU-CVE-2024-41079
Ubuntu:22.04:LTSlinux-nvidia-tegra5.15.0-1064.66UBUNTU-CVE-2024-41079
Ubuntu:22.04:LTSlinux-nvidia-tegra5.15.0-1064.66USN-8576-2
Ubuntu:22.04:LTSlinux-nvidia-tegra-igx5.15.0-1053.53USN-8576-2
Ubuntu:22.04:LTSlinux-nvidia-tegra-igx5.15.0-1053.53UBUNTU-CVE-2024-41079
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2024-41079
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2024-41079
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2024-41079
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2024-41079
Ubuntu:24.04:LTSlinux-oem-6.86.8.0-1016.16UBUNTU-CVE-2024-41079
Ubuntu:22.04:LTSlinux-oracle5.15.0-1109.115USN-8575-3
Ubuntu:22.04:LTSlinux-oracle5.15.0-1109.115UBUNTU-CVE-2024-41079
Ubuntu:24.04:LTSlinux-oracle6.8.0-1015.16UBUNTU-CVE-2024-41079
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2024-41079
Ubuntu:22.04:LTSlinux-oracle-6.86.8.0-1015.15~22.04.1UBUNTU-CVE-2024-41079
Ubuntu:22.04:LTSlinux-raspi5.15.0-1106.109USN-8668-2
Ubuntu:22.04:LTSlinux-raspi5.15.0-1106.109UBUNTU-CVE-2024-41079
Ubuntu:24.04:LTSlinux-raspi6.8.0-1014.16UBUNTU-CVE-2024-41079
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2024-41079
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2024-41079
Ubuntu:24.04:LTSlinux-riscv6.8.0-48.48.1UBUNTU-CVE-2024-41079
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2024-41079
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2024-41079
Ubuntu:22.04:LTSlinux-riscv-6.86.8.0-48.48.1~22.04.2UBUNTU-CVE-2024-41079
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2024-41079
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2024-41079
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2024-41079
Ubuntu:24.04:LTSlinux-xilinx6.8.0-1009.10UBUNTU-CVE-2024-41079
Ubuntu:22.04:LTSlinux-xilinx-zynqmp5.15.0-1075.79USN-8575-1
Ubuntu:22.04:LTSlinux-xilinx-zynqmp5.15.0-1075.79UBUNTU-CVE-2024-41079

Affected products (as reported)

VendorProductVersions
Linux Linux a07b4970f464f13640e28e16dad6cfa33647cc99 – before c6a2cf8b0764f3ba7d9bff58c8775a6d4476bb29a07b4970f464f13640e28e16dad6cfa33647cc99 – before 30d35b24b7957922f81cfdaa66f2e1b1e9b9aed2a07b4970f464f13640e28e16dad6cfa33647cc99 – before 10967873b80742261527a071954be8b54f0f8e4da07b4970f464f13640e28e16dad6cfa33647cc99 – before 0990e8a863645496b9e3f91cfcfd63cd95c80319a07b4970f464f13640e28e16dad6cfa33647cc99 – before cd0c1b8e045a8d2785342b385cb2684d9b48e426
Linux Linux 4.8

References