CVE-2024-43873 vhost/vsock: always initialize seqpacket_allow
An uninitialized variable in the Linux kernel vhost/vsock module can lead to a null pointer dereference and denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-43873?
CVE-2024-43873 is a high-severity vulnerability in Linux kernel, published on 21 Aug 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
vhost/vsock: always initialize seqpacket_allow
There are two issues around seqpacket_allow: 1. seqpacket_allow is not initialized when socket is created. Thus if features are never set, it will be read uninitialized. 2. if VIRTIO_VSOCK_F_SEQPACKET is set and then cleared, then seqpacket_allow will not be cleared appropriately (existing apps I know about don't usually do this but it's legal and there's no way to be sure no one relies on this).
To fix: - initialize seqpacket_allow after allocation - set it unconditionally in set_features
Weakness: CWE-909
Which versions are affected by CVE-2024-43873?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-43873?
Apply the vendor's patch.
Is CVE-2024-43873 being exploited?
There is no known exploitation of CVE-2024-43873 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-48504, BELL-CVE-2024-43873, DEBIAN-CVE-2024-43873, GHSA-rjp6-gjq7-25v6, UBUNTU-CVE-2024-43873.