CVE-2024-42162 in Linux
Summary
by MITRE • 07/30/2024
In the Linux kernel, the following vulnerability has been resolved:
gve: Account for stopped queues when reading NIC stats
We now account for the fact that the NIC might send us stats for a subset of queues. Without this change, gve_get_ethtool_stats might make an invalid access on the priv->stats_report->stats array.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/19/2025
The vulnerability identified as CVE-2024-42162 resides within the Linux kernel's generic virtio ethernet driver implementation known as gve. This issue specifically affects the handling of network interface controller statistics when queues are in a stopped state. The gve driver is responsible for managing virtio network devices in virtualized environments, making it a critical component for cloud computing and containerized applications. The vulnerability manifests when the driver attempts to read statistics from the NIC hardware while some queues have been stopped, creating a scenario where the driver's assumptions about available statistics become invalid. This flaw represents a classic buffer overread condition that could potentially lead to system instability or information disclosure.
The technical root cause of this vulnerability stems from the driver's failure to properly account for the possibility that the NIC hardware may only report statistics for a subset of available queues. When the gve_get_ethtool_stats function is invoked to retrieve network statistics, it assumes that all queues will provide valid statistical data. However, when certain queues are stopped or inactive, the NIC hardware may not populate the corresponding statistics entries in the stats_report structure. Without proper validation, the driver accesses memory locations in the priv->stats_report->stats array that may not contain valid data, leading to potential memory access violations. This type of error falls under the CWE-129 weakness category, which encompasses issues related to improper validation of array indices, and specifically aligns with CWE-787, which addresses out-of-bounds write operations.
The operational impact of this vulnerability extends beyond simple memory access violations to potentially compromise the stability and reliability of virtualized network environments. When the gve driver encounters stopped queues during statistics collection, it may cause kernel panics, system crashes, or data corruption in network monitoring applications. This issue particularly affects cloud infrastructure providers and virtualization platforms that rely heavily on virtio network drivers for their operations. The vulnerability could be exploited by malicious actors to cause denial of service conditions, particularly in environments where network statistics are frequently queried or where the driver's behavior is not properly validated. Network administrators and security teams should be aware that this issue could manifest during routine system monitoring activities or when network performance is being analyzed. The ATT&CK framework categorizes this vulnerability under the T1499.004 technique for "Network Denial of Service" and potentially T1566.001 for "Phishing" if the denial of service impacts network availability for legitimate users.
Mitigation strategies for CVE-2024-42162 should focus on applying the kernel patch that properly accounts for stopped queues during statistics collection. System administrators should prioritize updating their Linux kernel versions to include the fix, particularly in production environments where network stability is critical. Additionally, monitoring systems should be configured to detect unusual patterns in network statistics collection that might indicate this vulnerability's exploitation. The patch implementation ensures that the gve_get_ethtool_stats function validates the state of queues before accessing statistics data, preventing invalid memory accesses. Organizations should also implement proper kernel security hardening measures, including kernel module signing and runtime integrity checks. Regular security assessments of virtualized environments are recommended to identify potential impacts of similar vulnerabilities in other network driver components. The fix demonstrates the importance of robust error handling in kernel space code and emphasizes the need for comprehensive testing of driver behavior under various queue states to prevent similar issues from occurring in other network subsystems.