CVE-2024-42155: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-42155 affects the Linux kernel's s390/pkey subsystem. The vulnerability was discovered in July 2024 and involves improper handling of protected and secure keys in the s390 architecture. Although the clear-key of neither protected nor secure keys is accessible, the key material should only be visible to the calling process. The vulnerability affects Linux kernel versions from 4.11 up to (excluding) 6.9.9 (NVD).

The vulnerability exists in the Linux kernel's s390/pkey API where copies of protected and secure keys were not properly wiped from the stack, even in case of an error. The issue has been assigned a CVSS v3.1 base score of 1.9 (Low) with the vector string CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N, indicating local access requirements and low impact (NVD).

The vulnerability could potentially expose sensitive key material to the calling process, though the impact is limited as the clear-key of neither protected nor secure keys is directly accessible. The low CVSS score reflects the limited potential for exploitation and impact (NVD).

The vulnerability requires local access with high privileges and complex exploitation conditions. There are no known reports of this vulnerability being exploited in the wild (NVD).

The vulnerability has been fixed in the Linux kernel through patches that implement proper wiping of protected and secure key copies from the stack. The fix involves using memzero_explicit() to ensure key material is properly cleared, even in error cases. Updated kernel versions are available through distribution-specific updates (Kernel Patch).