CVE-2024-42157: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-42157 is a security vulnerability in the Linux kernel's s390/pkey subsystem, discovered and disclosed on July 30, 2024. The vulnerability affects Linux kernel versions from 4.11 through 6.9.9, specifically impacting the handling of sensitive data in the s390 architecture's protected key management system (NVD).

The vulnerability exists in the Linux kernel's s390/pkey driver where sensitive data is not properly wiped from the stack when copy_to_user() operations fail. The issue has been assigned a CVSS v3.1 base score of 4.1 (Medium) with the vector string CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N, indicating local access requirements and potential for high confidentiality impact (NVD).

The vulnerability could potentially lead to sensitive cryptographic data remaining in memory when operations fail, potentially exposing this information to unauthorized access. The impact is limited to systems using the s390 architecture's protected key functionality (NVD).

The vulnerability requires local access with high privileges and complex exploitation conditions. There are no known reports of this vulnerability being exploited in the wild (NVD).

The vulnerability has been fixed in multiple Linux kernel versions. Patches have been released for affected versions, including fixes in Ubuntu 22.04 LTS (5.15.0-121.131), 20.04 LTS (5.4.0-195.215), and 18.04 LTS (4.15.0-230.242). The fix involves properly wiping sensitive data from the stack when copy_to_user() operations fail (Ubuntu).