CVE-2024-42292

What it actually does

Incorrect size calculation in zap_modalias_env() leads to out-of-bounds memory access via memmove when the MODALIAS variable is not the final entry in the environment block, enabling local memory corruption or disclosure.

Why it matters to the business

Systems running affected Linux kernels face elevated risk of local privilege escalation, kernel crashes, or information leaks; with over 50,000 downstream dependents the flaw can propagate through distributions, containers, and embedded devices, increasing operational disruption and patching workload.

How an attack unfolds

A local attacker crafts an environment structure where MODALIAS is not last, triggers kobject_uevent to invoke zap_modalias_env, and leverages the resulting OOB read/write; espionage and financially motivated actors have demonstrated interest in similar Linux kernel memory issues in recent zero-day campaigns.

How to fix it

Upgrade the Linux kernel to a version containing commit 81a15d28f32af01493ae8c5457e0d55314a4167d or later; for the ip package apply versions 2.0.1 or 1.1.9; rebuild and reboot affected systems, then verify the corrected memmove size logic is present.

How to confirm the fix worked

Confirm the running kernel includes commit 81a15d28f32af01493ae8c5457e0d55314a4167d; review source for the corrected memmove size argument in zap_modalias_env; test by exercising uevent generation with non-final MODALIAS entries and monitor for OOB faults.

Typical attack path

1. Obtain local shell or code execution on target system
2. Construct a uevent environment array with MODALIAS positioned before the final variable
3. Trigger kobject_uevent path that calls zap_modalias_env
4. Exploit resulting OOB memory access for read or write primitives
5. Escalate to kernel-level access or cause denial of service

How to detect it

Search kernel logs and audit trails for OOB-related faults or warnings around uevent processing; correlate with process activity invoking kobject_uevent; review threat actor reports on Linux kernel memory issues for matching TTPs.

What your security team should do

• Apply kernel updates containing the referenced commit within the next maintenance window given the high number of downstream dependents
• Harden local access controls and monitor for unusual uevent activity until patches are deployed
• Include the fix in all container base images and embedded Linux builds
• Track EPSS and threat actor reports for any rise in observed exploitation attempts