Improper Initialization in Linux kernel - CVE-2024-38593

Vulnerability identifier: #VU92382

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-38593

CWE-ID: CWE-665

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper initialization within the lan8841_suspend() function in drivers/net/phy/micrel.c. A local user can perform a denial of service (DoS) attack.

Linux kernel
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for Real Time
Red Hat Enterprise Linux for Real Time for NFV
Red Hat Enterprise Linux for ARM 64
Ubuntu
openEuler
kernel (Red Hat package)
kernel-debugsource
kernel-debuginfo
bpftool-debuginfo
bpftool
kernel
kernel-devel
kernel-headers
kernel-source
kernel-tools
kernel-tools-debuginfo
kernel-tools-devel
perf
perf-debuginfo
python3-perf
python3-perf-debuginfo
linux-image-virtual-hwe-24.04 (Ubuntu package)
linux-image-virtual (Ubuntu package)
linux-image-kvm (Ubuntu package)
linux-image-generic-64k (Ubuntu package)
linux-image-generic-lpae (Ubuntu package)
linux-image-generic-hwe-24.04 (Ubuntu package)
linux-image-generic-64k-hwe-24.04 (Ubuntu package)
linux-image-generic (Ubuntu package)
linux-image-6.8.0-40-generic-64k (Ubuntu package)
linux-image-6.8.0-40-generic (Ubuntu package)
linux-image-6.8.0-40-lowlatency (Ubuntu package)
linux-image-6.8.0-40-lowlatency-64k (Ubuntu package)
linux-image-lowlatency-64k (Ubuntu package)
linux-image-lowlatency (Ubuntu package)
linux-image-6.8.0-1008-gke (Ubuntu package)
linux-image-gke (Ubuntu package)
linux-image-raspi (Ubuntu package)
linux-image-6.8.0-1009-raspi (Ubuntu package)
linux-image-6.8.0-1010-oracle-64k (Ubuntu package)
linux-image-oem-24.04a (Ubuntu package)
linux-image-oem-24.04 (Ubuntu package)
linux-image-6.8.0-1010-oem (Ubuntu package)
linux-image-oracle-64k (Ubuntu package)
linux-image-oracle (Ubuntu package)
linux-image-6.8.0-1010-ibm (Ubuntu package)
linux-image-6.8.0-1010-oracle (Ubuntu package)
linux-image-ibm (Ubuntu package)
linux-image-ibm-lts-24.04 (Ubuntu package)
linux-image-ibm-classic (Ubuntu package)
linux-image-6.8.0-1011-nvidia (Ubuntu package)
linux-image-6.8.0-1011-nvidia-64k (Ubuntu package)
linux-image-nvidia-64k (Ubuntu package)
linux-image-nvidia (Ubuntu package)
linux-image-nvidia-lowlatency-64k (Ubuntu package)
linux-image-6.8.0-1011-nvidia-lowlatency (Ubuntu package)
linux-image-6.8.0-1011-nvidia-lowlatency-64k (Ubuntu package)
linux-image-nvidia-lowlatency (Ubuntu package)
linux-image-nvidia-6.8 (Ubuntu package)
linux-image-nvidia-64k-6.8 (Ubuntu package)
linux-image-gcp (Ubuntu package)
linux-image-6.8.0-1012-gcp (Ubuntu package)
linux-image-aws (Ubuntu package)
linux-image-6.8.0-1013-aws (Ubuntu package)
Guardium Data Protection

Install update from vendor's website.

Linux kernel - addressed in versions 6.6.33, 6.8.12, 6.10
kernel (Red Hat package) - update to 5.14.0-427.26.1.el9_4
kernel-debugsource - update to 6.6.0-39.0.0.47
kernel-debuginfo - update to 6.6.0-39.0.0.47
bpftool-debuginfo - update to 6.6.0-39.0.0.47
bpftool - update to 6.6.0-39.0.0.47
kernel - update to 6.6.0-39.0.0.47
kernel-devel - update to 6.6.0-39.0.0.47
kernel-headers - update to 6.6.0-39.0.0.47
kernel-source - update to 6.6.0-39.0.0.47
kernel-tools - update to 6.6.0-39.0.0.47
kernel-tools-debuginfo - update to 6.6.0-39.0.0.47
kernel-tools-devel - update to 6.6.0-39.0.0.47
perf - update to 6.6.0-39.0.0.47
perf-debuginfo - update to 6.6.0-39.0.0.47
python3-perf - update to 6.6.0-39.0.0.47
python3-perf-debuginfo - update to 6.6.0-39.0.0.47
linux-image-virtual-hwe-24.04 (Ubuntu package) - update to 6.8.0-40.40
linux-image-virtual (Ubuntu package) - update to 6.8.0-40.40
linux-image-kvm (Ubuntu package) - update to 6.8.0-40.40
linux-image-generic-64k (Ubuntu package) - update to 6.8.0-40.40
linux-image-generic-lpae (Ubuntu package) - update to 6.8.0-40.40
linux-image-generic-hwe-24.04 (Ubuntu package) - update to 6.8.0-40.40
linux-image-generic-64k-hwe-24.04 (Ubuntu package) - update to 6.8.0-40.40
linux-image-generic (Ubuntu package) - update to 6.8.0-40.40
linux-image-6.8.0-40-generic-64k (Ubuntu package) - update to 6.8.0-40.40
linux-image-6.8.0-40-generic (Ubuntu package) - update to 6.8.0-40.40
linux-image-6.8.0-40-lowlatency (Ubuntu package) - update to 6.8.0-40.40.1
linux-image-6.8.0-40-lowlatency-64k (Ubuntu package) - update to 6.8.0-40.40.1
linux-image-lowlatency-64k (Ubuntu package) - update to 6.8.0-40.40.1
linux-image-lowlatency (Ubuntu package) - update to 6.8.0-40.40.1
linux-image-6.8.0-1008-gke (Ubuntu package) - update to 6.8.0-1008.11
linux-image-gke (Ubuntu package) - update to 6.8.0-1008.11
linux-image-raspi (Ubuntu package) - update to 6.8.0-1009.10
linux-image-6.8.0-1009-raspi (Ubuntu package) - update to 6.8.0-1009.10
linux-image-6.8.0-1010-oracle-64k (Ubuntu package) - update to 6.8.0-1010.10
linux-image-oem-24.04a (Ubuntu package) - update to 6.8.0-1010.10
linux-image-oem-24.04 (Ubuntu package) - update to 6.8.0-1010.10
linux-image-6.8.0-1010-oem (Ubuntu package) - update to 6.8.0-1010.10
linux-image-oracle-64k (Ubuntu package) - update to 6.8.0-1010.10
linux-image-oracle (Ubuntu package) - update to 6.8.0-1010.10
linux-image-6.8.0-1010-ibm (Ubuntu package) - update to 6.8.0-1010.10
linux-image-6.8.0-1010-oracle (Ubuntu package) - update to 6.8.0-1010.10
linux-image-ibm (Ubuntu package) - update to 6.8.0-1010.10
linux-image-ibm-lts-24.04 (Ubuntu package) - update to 6.8.0-1010.10
linux-image-ibm-classic (Ubuntu package) - update to 6.8.0-1010.10
linux-image-6.8.0-1011-nvidia (Ubuntu package) - addressed in versions 6.8.0-1011.11, 6.8.0-1011.11~22.04.1
linux-image-6.8.0-1011-nvidia-64k (Ubuntu package) - addressed in versions 6.8.0-1011.11, 6.8.0-1011.11~22.04.1
linux-image-nvidia-64k (Ubuntu package) - update to 6.8.0-1011.11
linux-image-nvidia (Ubuntu package) - update to 6.8.0-1011.11
linux-image-nvidia-lowlatency-64k (Ubuntu package) - update to 6.8.0-1011.11.1
linux-image-6.8.0-1011-nvidia-lowlatency (Ubuntu package) - update to 6.8.0-1011.11.1
linux-image-6.8.0-1011-nvidia-lowlatency-64k (Ubuntu package) - update to 6.8.0-1011.11.1
linux-image-nvidia-lowlatency (Ubuntu package) - update to 6.8.0-1011.11.1
linux-image-nvidia-6.8 (Ubuntu package) - update to 6.8.0-1011.11~22.04.1
linux-image-nvidia-64k-6.8 (Ubuntu package) - update to 6.8.0-1011.11~22.04.1
linux-image-gcp (Ubuntu package) - update to 6.8.0-1012.13
linux-image-6.8.0-1012-gcp (Ubuntu package) - update to 6.8.0-1012.13
linux-image-aws (Ubuntu package) - update to 6.8.0-1013.14
linux-image-6.8.0-1013-aws (Ubuntu package) - update to 6.8.0-1013.14
Guardium Data Protection - addressed in versions 12.0p35, 12.0p115

• https://git.kernel.org/stable/c/3ddf170e4a604f5d4d9459a36993f5e92b53e8b0
• https://git.kernel.org/stable/c/3fd4282d5f25c3c97fef3ef0b89b82ef4e2bc975
• https://git.kernel.org/stable/c/64a47cf634ae44e92be24ebc982410841093bd7b
• https://git.kernel.org/stable/c/aea27a92a41dae14843f92c79e9e42d8f570105c
• https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.10
• https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.33
• https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.8.12

• Improper Initialization in Linux kernel net phy driver
• Red Hat Enterprise Linux 9 update for kernel
• Ubuntu update for linux
• Ubuntu update for linux-nvidia-lowlatency
• Ubuntu update for linux-oem-6.8
• Ubuntu update for linux-lowlatency
• openEuler 24.03 LTS update for kernel
• Multiple vulnerabilities in IBM Guardium Data Protection