CVE-2024-42113: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-42113 affects the Linux kernel's txgbe network driver. The vulnerability was discovered when using MSI/INTx interrupts, where the wx->num_q_vectors variable remains uninitialized, leading to potential kernel panic during queue vector allocation in the wx_alloc_q_vectors() function. This issue was identified and reported on July 30, 2024 (NVD).

The vulnerability exists in the Linux kernel's network driver subsystem, specifically in the txgbe driver's interrupt handling code. The issue stems from an uninitialized wx->num_q_vectors variable when using MSI/INTx interrupts, which can cause a kernel panic during the execution of wx_alloc_q_vectors() function. The bug was introduced in commit 3f703186113f ("net: libwx: Add irq flow functions") and was fixed by initializing wx->num_q_vectors to 1 in the wx_set_interrupt_capability function (Kernel Commit).

When exploited, this vulnerability can cause a kernel panic in systems using the affected txgbe network driver with MSI/INTx interrupts, potentially leading to system crashes and denial of service conditions (NVD).

The vulnerability requires access to a system using the txgbe network driver with MSI/INTx interrupts. It can be triggered during the interrupt configuration process, specifically when allocating queue vectors (Kernel Commit).

The issue has been fixed in various Linux kernel versions. Ubuntu has released patches for affected versions including 24.04 LTS (noble) with kernel version 6.8.0-48.48 and 22.04 LTS (jammy) with various kernel variants. The fix involves initializing wx->num_q_vectors to 1 in the wx_set_interrupt_capability function (Ubuntu Security).