{"id":"CVE-2024-42272","summary":"sched: act_ct: take care of padding in struct zones_ht_key","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nsched: act_ct: take care of padding in struct zones_ht_key\n\nBlamed commit increased lookup key size from 2 bytes to 16 bytes,\nbecause zones_ht_key got a struct net pointer.\n\nMake sure rhashtable_lookup() is not using the padding bytes\nwhich are not initialized.\n\n BUG: KMSAN: uninit-value in rht_ptr_rcu include/linux/rhashtable.h:376 [inline]\n BUG: KMSAN: uninit-value in __rhashtable_lookup include/linux/rhashtable.h:607 [inline]\n BUG: KMSAN: uninit-value in rhashtable_lookup include/linux/rhashtable.h:646 [inline]\n BUG: KMSAN: uninit-value in rhashtable_lookup_fast include/linux/rhashtable.h:672 [inline]\n BUG: KMSAN: uninit-value in tcf_ct_flow_table_get+0x611/0x2260 net/sched/act_ct.c:329\n  rht_ptr_rcu include/linux/rhashtable.h:376 [inline]\n  __rhashtable_lookup include/linux/rhashtable.h:607 [inline]\n  rhashtable_lookup include/linux/rhashtable.h:646 [inline]\n  rhashtable_lookup_fast include/linux/rhashtable.h:672 [inline]\n  tcf_ct_flow_table_get+0x611/0x2260 net/sched/act_ct.c:329\n  tcf_ct_init+0xa67/0x2890 net/sched/act_ct.c:1408\n  tcf_action_init_1+0x6cc/0xb30 net/sched/act_api.c:1425\n  tcf_action_init+0x458/0xf00 net/sched/act_api.c:1488\n  tcf_action_add net/sched/act_api.c:2061 [inline]\n  tc_ctl_action+0x4be/0x19d0 net/sched/act_api.c:2118\n  rtnetlink_rcv_msg+0x12fc/0x1410 net/core/rtnetlink.c:6647\n  netlink_rcv_skb+0x375/0x650 net/netlink/af_netlink.c:2550\n  rtnetlink_rcv+0x34/0x40 net/core/rtnetlink.c:6665\n  netlink_unicast_kernel net/netlink/af_netlink.c:1331 [inline]\n  netlink_unicast+0xf52/0x1260 net/netlink/af_netlink.c:1357\n  netlink_sendmsg+0x10da/0x11e0 net/netlink/af_netlink.c:1901\n  sock_sendmsg_nosec net/socket.c:730 [inline]\n  __sock_sendmsg+0x30f/0x380 net/socket.c:745\n  ____sys_sendmsg+0x877/0xb60 net/socket.c:2597\n  ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2651\n  __sys_sendmsg net/socket.c:2680 [inline]\n  __do_sys_sendmsg net/socket.c:2689 [inline]\n  __se_sys_sendmsg net/socket.c:2687 [inline]\n  __x64_sys_sendmsg+0x307/0x4a0 net/socket.c:2687\n  x64_sys_call+0x2dd6/0x3c10 arch/x86/include/generated/asm/syscalls_64.h:47\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nLocal variable key created at:\n  tcf_ct_flow_table_get+0x4a/0x2260 net/sched/act_ct.c:324\n  tcf_ct_init+0xa67/0x2890 net/sched/act_ct.c:1408","modified":"2026-04-16T00:04:01.913630189Z","published":"2024-08-17T08:54:26.755Z","related":["ALSA-2024:8162"],"database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/42xxx/CVE-2024-42272.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/2191a54f63225b548fd8346be3611c3219a24738"},{"type":"WEB","url":"https://git.kernel.org/stable/c/3a5b68869dbe14f1157c6a24ac71923db060eeab"},{"type":"WEB","url":"https://git.kernel.org/stable/c/3ddefcb8f75e312535e2e7d5fef9932019ba60f2"},{"type":"WEB","url":"https://git.kernel.org/stable/c/7c03ab555eb1ba26c77fd7c25bdf44a0ac23edee"},{"type":"WEB","url":"https://git.kernel.org/stable/c/d06daf0ad645d9225a3ff6958dd82e1f3988fa64"},{"type":"WEB","url":"https://git.kernel.org/stable/c/d7cc186d0973afce0e1237c37f7512c01981fb79"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/42xxx/CVE-2024-42272.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42272"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"03f625505e27f709390a86c9b78d3707f4c23df8"},{"fixed":"7c03ab555eb1ba26c77fd7c25bdf44a0ac23edee"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"aa1f81fe3a059bc984b230b5352ab89d06aa3c7b"},{"fixed":"3ddefcb8f75e312535e2e7d5fef9932019ba60f2"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"2f82f75f843445daa81e8b2a76774b1348033ce6"},{"fixed":"d06daf0ad645d9225a3ff6958dd82e1f3988fa64"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"9126fd82e9edc7b4796f756e4b258d34f17e5e4a"},{"fixed":"d7cc186d0973afce0e1237c37f7512c01981fb79"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"88c67aeb14070bab61d3dd8be96c8b42ebcaf53a"},{"fixed":"3a5b68869dbe14f1157c6a24ac71923db060eeab"},{"fixed":"2191a54f63225b548fd8346be3611c3219a24738"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"0"},{"last_affected":"b4382b854975ae96fbfcc83a1d79b5c063c1aaa8"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-42272.json"}}],"schema_version":"1.7.5"}