cve-2024-42156
Vulnerability from cvelistv5
Published
2024-07-30 07:46
Modified
2024-12-19 09:14
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Wipe copies of clear-key structures on failure Wipe all sensitive data from stack for all IOCTLs, which convert a clear-key into a protected- or secure-key.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/7f6243edd901b75aaece326c90a1cc0dcb60cc3dPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/a891938947f4427f98cb1ce54f27223501efe750
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/d65d76a44ffe74c73298ada25b0f578680576073Patch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/7f6243edd901b75aaece326c90a1cc0dcb60cc3dPatch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/d65d76a44ffe74c73298ada25b0f578680576073Patch
Impacted products
Vendor Product Version
Linux Linux Version: e80d4af0a320972aac58e2004d0ba4e44ef4c5c7
Version: e80d4af0a320972aac58e2004d0ba4e44ef4c5c7
Version: e80d4af0a320972aac58e2004d0ba4e44ef4c5c7
 Create a notification for this product.
   Linux Linux Version: 4.11
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:54:32.172Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/7f6243edd901b75aaece326c90a1cc0dcb60cc3d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d65d76a44ffe74c73298ada25b0f578680576073"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-42156",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:15:08.677401Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:34.120Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/s390/crypto/pkey_api.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a891938947f4427f98cb1ce54f27223501efe750",
              "status": "affected",
              "version": "e80d4af0a320972aac58e2004d0ba4e44ef4c5c7",
              "versionType": "git"
            },
            {
              "lessThan": "7f6243edd901b75aaece326c90a1cc0dcb60cc3d",
              "status": "affected",
              "version": "e80d4af0a320972aac58e2004d0ba4e44ef4c5c7",
              "versionType": "git"
            },
            {
              "lessThan": "d65d76a44ffe74c73298ada25b0f578680576073",
              "status": "affected",
              "version": "e80d4af0a320972aac58e2004d0ba4e44ef4c5c7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/s390/crypto/pkey_api.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.11"
            },
            {
              "lessThan": "4.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.64",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/pkey: Wipe copies of clear-key structures on failure\n\nWipe all sensitive data from stack for all IOCTLs, which convert a\nclear-key into a protected- or secure-key."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-19T09:14:12.544Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a891938947f4427f98cb1ce54f27223501efe750"
        },
        {
          "url": "https://git.kernel.org/stable/c/7f6243edd901b75aaece326c90a1cc0dcb60cc3d"
        },
        {
          "url": "https://git.kernel.org/stable/c/d65d76a44ffe74c73298ada25b0f578680576073"
        }
      ],
      "title": "s390/pkey: Wipe copies of clear-key structures on failure",
      "x_generator": {
        "engine": "bippy-5f407fcff5a0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-42156",
    "datePublished": "2024-07-30T07:46:58.513Z",
    "dateReserved": "2024-07-29T15:50:41.194Z",
    "dateUpdated": "2024-12-19T09:14:12.544Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-42156\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-07-30T08:15:07.080\",\"lastModified\":\"2024-12-09T13:10:02.267\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ns390/pkey: Wipe copies of clear-key structures on failure\\n\\nWipe all sensitive data from stack for all IOCTLs, which convert a\\nclear-key into a protected- or secure-key.\"},{\"lang\":\"es\",\"value\":\" En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: s390/pkey: borra copias de estructuras de claves claras en caso de fallo. Borra todos los datos confidenciales de la pila para todos los IOCTL, que convierten una clave clara en una clave protegida o segura.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":4.1,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":0.5,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-Other\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.11\",\"versionEndExcluding\":\"6.9.9\",\"matchCriteriaId\":\"F07A6B96-3EC3-44C6-A31F-BE7A176B3EDF\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/7f6243edd901b75aaece326c90a1cc0dcb60cc3d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a891938947f4427f98cb1ce54f27223501efe750\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d65d76a44ffe74c73298ada25b0f578680576073\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7f6243edd901b75aaece326c90a1cc0dcb60cc3d\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d65d76a44ffe74c73298ada25b0f578680576073\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/7f6243edd901b75aaece326c90a1cc0dcb60cc3d\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/d65d76a44ffe74c73298ada25b0f578680576073\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T04:54:32.172Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-42156\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T16:15:08.677401Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:24.503Z\"}}], \"cna\": {\"title\": \"s390/pkey: Wipe copies of clear-key structures on failure\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"e80d4af0a320972aac58e2004d0ba4e44ef4c5c7\", \"lessThan\": \"a891938947f4427f98cb1ce54f27223501efe750\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e80d4af0a320972aac58e2004d0ba4e44ef4c5c7\", \"lessThan\": \"7f6243edd901b75aaece326c90a1cc0dcb60cc3d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e80d4af0a320972aac58e2004d0ba4e44ef4c5c7\", \"lessThan\": \"d65d76a44ffe74c73298ada25b0f578680576073\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/s390/crypto/pkey_api.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.11\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.11\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.64\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9.9\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/s390/crypto/pkey_api.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/a891938947f4427f98cb1ce54f27223501efe750\"}, {\"url\": \"https://git.kernel.org/stable/c/7f6243edd901b75aaece326c90a1cc0dcb60cc3d\"}, {\"url\": \"https://git.kernel.org/stable/c/d65d76a44ffe74c73298ada25b0f578680576073\"}], \"x_generator\": {\"engine\": \"bippy-5f407fcff5a0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ns390/pkey: Wipe copies of clear-key structures on failure\\n\\nWipe all sensitive data from stack for all IOCTLs, which convert a\\nclear-key into a protected- or secure-key.\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-12-19T09:14:12.544Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-42156\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-12-19T09:14:12.544Z\", \"dateReserved\": \"2024-07-29T15:50:41.194Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-07-30T07:46:58.513Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.