CVE-2024-42283

What it actually does

Uninitialized reserved fields in struct nexthop_grp are not zeroed by nla_put_nh_group(), causing kernel memory contents to be copied into netlink responses when dumping nexthop groups.

Why it matters to the business

Kernel memory disclosure on any Linux system exposing the netlink interface to local users; widespread exposure across 1,393 downstream dependents increases risk of sensitive data leakage that can facilitate further attacks.

How an attack unfolds

An attacker with local access issues netlink requests to retrieve nexthop group information (for example via ip nexthop commands); the kernel returns structures containing uninitialized reserved fields that carry leftover kernel stack or heap bytes, which the attacker can read directly from the netlink message.

How to fix it

Apply the upstream fix in commit fd06cb4a5fc7bda3dea31712618a62af72a1c6cb or later; update to a kernel containing the corrected nla_put_nh_group() implementation that fully initializes the nexthop_grp structure before transmission.

How to confirm the fix worked

After patching, repeat the strace or netlink dump of a group nexthop and confirm that the reserved fields are now zero; verify the running kernel contains commit fd06cb4a5fc7bda3dea31712618a62af72a1c6cb or an equivalent backport.

Typical attack path

1. Obtain local shell or unprivileged user context on a Linux host
2. Issue netlink RTM_GETNEXTHOP or equivalent NHA_GROUP query for a group nexthop
3. Parse the received netlink attributes and inspect the reserved1/reserved2 bytes for non-zero garbage values
4. Extract and analyze leaked kernel memory contents for pointers, credentials, or other useful data

How to detect it

Review netlink audit logs or system call traces for frequent RTM_GETNEXTHOP or NHA_GROUP queries from untrusted processes; no reliable post-exploitation artifacts exist because the leak occurs on legitimate queries.

What your security team should do

• Prioritize patching all Linux kernels to the fixed commit within the next maintenance window
• Restrict unprivileged access to netlink route sockets where feasible via SELinux, AppArmor, or seccomp filters
• Monitor for future Linux kernel information-disclosure CVEs given the high ecosystem prevalence