Security readout for executives and security teams
Plain-English summary
A flaw in the Linux kernel’s BPF handling can let a locally authenticated, low-privilege user trigger incorrect control-flow processing. The supplied CVSS assessment indicates possible compromise of confidentiality, integrity, and availability. This is primarily a host privilege-boundary risk, not a remotely exploitable network flaw.
Executive priority
Treat as a high-priority local privilege-boundary issue. Accelerate patching on shared, multi-user, container-hosting, and other systems exposed to untrusted local workloads. Internet-facing status alone does not determine exposure because the stated attack vector is local.
Technical view
The defect affects BPF may_goto processing. Negative offsets were patched incorrectly, and the verifier could prune exploration when equal may_goto_depth values actually represented an infinite loop. A crafted BPF program discovered by syzbot exposed both conditions. The supplied CVSS v3.1 score is 7.8 with local, low-privilege access required and no user interaction.
Likely exposure
The bundle identifies Linux kernel 6.9-related versions as affected and provides two stable-kernel fix commits. Exact version boundaries and downstream distribution package mappings are unclear in the supplied evidence. Exposure is most relevant where low-privilege local users or workloads can reach BPF functionality.
Exploitation context
The CVE is not listed as KEV in the supplied bundle. A syzbot-crafted BPF program exposed the bugs, but the sources provide no evidence of active exploitation or a public weaponized exploit.
Researcher notes
The two documented defects concern negative-offset instruction patching and verifier state pruning around may_goto_depth. The source bundle does not provide a CWE, precise downstream package matrix, demonstrated privilege escalation chain, or exploitation telemetry. Validate remediation by fix inclusion rather than relying solely on ambiguous version labels.
Mitigation direction
- Apply vendor-supported kernel updates that incorporate the referenced stable-kernel fixes.
- Check Linux distribution advisories for the exact fixed package version.
- Prioritize multi-user and shared-workload systems where low-privilege local access exists.
- Restrict unnecessary local access while affected systems await vendor updates.
Validation and detection
- Inventory running kernel versions across Linux hosts.
- Confirm installed kernel packages contain either referenced stable-kernel fix.
- Verify systems rebooted into the updated kernel after installation.
- Review whether low-privilege users or workloads can access BPF functionality.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-42072 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/175827e04f4be53f3dfb57edf12d0d49b18fd939CVE reference, Linux
- https://git.kernel.org/stable/c/2b2efe1937ca9f8815884bd4dcd5b32733025103CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.