CVE-2024-42272: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-42272 affects the Linux kernel's scheduler component, specifically in the handling of padding in struct zones_ht_key. The vulnerability was discovered on August 17, 2024, and impacts various versions of the Linux kernel including 5.10.221-5.10.224, 5.15.162-5.15.165, 6.1.96-6.1.104, and 6.6.36-6.6.45 (NVD).

The vulnerability stems from a commit that increased the lookup key size from 2 bytes to 16 bytes due to zones_ht_key receiving a struct net pointer. The issue occurs in the rhashtable_lookup() function where uninitialized padding bytes are being used. This was detected through KMSAN (Kernel Memory Sanitizer) which reported uninit-value errors in multiple functions within the call stack, primarily in the net/sched/act_ct.c file (Kernel Patch). The CVSS v3.1 base score is 5.5 (Medium) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability has been classified with a CVSS v3.1 base score of 5.5 (Medium), indicating a moderate severity level. The impact is primarily focused on availability, as indicated by the CVSS metrics showing no impact on confidentiality or integrity, but high impact on availability (NVD).

The vulnerability requires local access with low complexity and low privileges to exploit. No user interaction is required for exploitation, as indicated by the CVSS metrics AV:L/AC:L/PR:L/UI:N (NVD).

The vulnerability has been patched in the Linux kernel. The fix involves modifying the key_len parameter in the zones_params structure to use offsetof(struct zones_ht_key, pad) instead of sizeof_field(struct tcf_ct_flow_table, key). This ensures that rhashtable_lookup() does not use the uninitialized padding bytes (Kernel Patch).