{"id":"CVE-2024-42283","revision":"1bae6a03d79746dba0c241f65233b42c","records":[{"revision":"1bae6a03d79746dba0c241f65233b42c","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2024-42283","aliases":[],"title":"net: nexthop: Initialize all fields in dumped nexthops","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: nexthop: Initialize all fields in dumped nexthops\n\nstruct nexthop_grp contains two reserved fields that are not initialized by\nnla_put_nh_group(), and carry garbage. This can be observed e.g. with\nstrace (edited for clarity):\n\n    # ip nexthop add id 1 dev lo\n    # ip nexthop add id 101 group 1\n    # strace -e recvmsg ip nexthop get id 101\n    ...\n    recvmsg(... [{nla_len=12, nla_type=NHA_GROUP},\n                 [{id=1, weight=0, resvd1=0x69, resvd2=0x67}]] ...) = 52\n\nThe fields are reserved and therefore not currently used. But as they are, they\nleak kernel memory, and the fact they are not just zero complicates repurposing\nof the fields for new ends. Initialize the full structure.","state":0,"publishedAt":"2024-08-17T09:08:49.866+00:00","modifiedAt":"2026-10-15T00:48:13.038+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/ipv4/nexthop.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"430a049190de3c9e219f43084de9f1122da04570\",\n                            \"lessThan\": \"fd06cb4a5fc7bda3dea31712618a62af72a1c6cb\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"430a049190de3c9e219f43084de9f1122da04570\",\n                            \"lessThan\": \"5cc4d71dda2dd4f1520f40e634a527022e48ccd8\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"430a049190de3c9e219f43084de9f1122da04570\",\n                            \"lessThan\": \"9e8f558a3afe99ce51a642ce0d3637ddc2b5d5d0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"430a049190de3c9e219f43084de9f1122da04570\",\n                            \"lessThan\": \"1377de719652d868f5317ba8398b7e74c5f0430b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"430a049190de3c9e219f43084de9f1122da04570\",\n                            \"lessThan\": \"7704460acd7f5d35eb07c52500987dc9b95313fb\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"430a049190de3c9e219f43084de9f1122da04570\",\n                            \"lessThan\": \"a13d3864b76ac87085ec530b2ff8e37482a63a96\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"430a049190de3c9e219f43084de9f1122da04570\",\n                            \"lessThan\": \"6d745cd0e9720282cd291d36b9db528aea18add2\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/ipv4/nexthop.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.3\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.3\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.4.282\",\n                            \"lessThanOrEqual\": \"5.4.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.224\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.165\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.103\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.44\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.10.3\",\n                            \"lessThanOrEqual\": \"6.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.11\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/fd06cb4a5fc7bda3dea31712618a62af72a1c6cb","https://git.kernel.org/stable/c/5cc4d71dda2dd4f1520f40e634a527022e48ccd8","https://git.kernel.org/stable/c/9e8f558a3afe99ce51a642ce0d3637ddc2b5d5d0","https://git.kernel.org/stable/c/1377de719652d868f5317ba8398b7e74c5f0430b","https://git.kernel.org/stable/c/7704460acd7f5d35eb07c52500987dc9b95313fb","https://git.kernel.org/stable/c/a13d3864b76ac87085ec530b2ff8e37482a63a96","https://git.kernel.org/stable/c/6d745cd0e9720282cd291d36b9db528aea18add2"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-42283","license":"CVE Program Terms of Use","key":"cve-program:CVE-2024-42283","identifiers":["CVE-2024-42283"]},"retained":false,"historicalAffected":[]}],"coverage":[]}