Security readout for executives and security teams
Plain-English summary
A Linux kernel BPF JIT protection operation can fail without being handled, potentially leaving generated kernel memory insufficiently protected. A local user with limited privileges may be able to exploit the resulting condition to compromise confidentiality, integrity, and availability. The supplied record rates it 7.8 High.
Executive priority
Prioritize remediation on multi-user systems, shared compute, and hosts where untrusted users can obtain local access. The potential impact is severe, but the local-access requirement reduces urgency relative to remotely exploitable flaws. Validate vendor backports promptly and schedule corrected kernels through normal high-severity patching procedures.
Technical view
The vulnerable BPF path failed to act on errors returned by set_memory_rox() through bpf_jit_binary_lock_ro(). Consequently, execution could continue after memory was not made read-only and executable as intended. The kernel correction checks the return value and abandons the operation on error.
Likely exposure
Exposure is limited to Linux systems running versions identified as affected in the supplied record, including entries for 6.2, 6.9.8, and 6.10. Distribution kernels may contain backported fixes, so version numbers alone are insufficient. The relevant BPF JIT code and local low-privilege access are important exposure factors.
Exploitation context
The CVSS vector describes a local, low-complexity attack requiring low privileges and no user interaction, with potentially high impact. The source bundle marks this CVE as absent from KEV and provides no evidence of active exploitation or a public exploit. Practical exploitability is not established by the supplied evidence.
Researcher notes
The core security invariant is that JIT-generated memory must not remain writable when execution proceeds. Review the architecture-specific stable commits referenced by the record because correction identifiers may differ across maintained branches. The supplied evidence does not identify triggering conditions for set_memory_rox() failure, affected distributions, exploit reliability, or observed attacks.
Mitigation direction
- Install a vendor-supported kernel release containing the referenced stable correction.
- Confirm distribution security guidance because vendors may backport fixes without changing the apparent upstream version.
- Restrict unnecessary local account access while affected kernels remain deployed.
- Follow vendor guidance for BPF-related risk reduction if immediate kernel replacement is unavailable.
Validation and detection
- Inventory kernel versions and builds across Linux hosts.
- Compare each build with distribution advisories and backport records for CVE-2024-42067.
- Verify kernel source or package metadata includes the error-handling correction.
- After updating, confirm hosts booted into the corrected kernel rather than an older installed build.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-42067 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/044da7ae7afd4ef60806d73654a2e6a79aa4ed7aCVE reference, Linux
- https://git.kernel.org/stable/c/e60adf513275c3a38e5cb67f7fd12387e43a3ff5CVE reference, Linux
- https://git.kernel.org/stable/c/08f6c05feb1db21653e98ca84ea04ca032d014c7CVE reference, CVE · x_transferred
- https://git.kernel.org/stable/c/9fef36cad60d4226f9d06953cd56d1d2f9119730CVE reference, CVE · x_transferred
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.