Security readout for executives and security teams
Plain-English summary
This Linux kernel CVE concerns safer cleanup of sensitive memory in the s390 protected key code. The fix replaces manual zeroing plus free with kfree_sensitive(). The sources do not provide CVSS, CWE, impact details, or evidence of active exploitation, so urgency should be based on whether the organization runs affected s390 Linux kernels.
Executive priority
Treat this as targeted kernel maintenance, not an emergency, unless critical s390 systems rely on protected key handling. The available evidence does not show exploitation or quantified severity, but sensitive-memory cleanup in kernel cryptographic code is worth tracking through normal patch governance.
Technical view
The resolved issue is in Linux kernel s390/pkey code. Coccinelle reported opportunities to use kfree_sensitive() at three locations, replacing memzero_explicit() followed by kfree(). This suggests a sensitive-memory cleanup hardening change, but the source bundle does not document a concrete attack path, privilege requirement, or data exposure scenario.
Likely exposure
Exposure appears limited to Linux systems using the s390 architecture and pkey functionality. The record lists Linux kernel ranges as affected, but the supplied version data is not detailed enough to safely restate exact fixed or vulnerable ranges beyond the referenced stable commits.
Exploitation context
No active exploitation is supported by the supplied sources. The CVE is not marked KEV, and the references only show kernel stable fixes. There is no public exploit status, attacker model, or weaponized technique in the provided bundle.
Researcher notes
The record is unusually sparse: no CVSS, CWE, exploitability analysis, or explicit impact is provided. Analysis should stay close to the commit rationale: replacing memzero_explicit()+kfree() with kfree_sensitive() in s390/pkey after Coccinelle warnings.
Mitigation direction
- Check kernel vendor advisories for CVE-2024-42158 applicability.
- Update affected s390 Linux kernels to builds containing the referenced stable fixes.
- Prioritize systems using protected key or cryptographic key management features.
- If no vendor package is available, request vendor guidance before backporting.
Validation and detection
- Inventory Linux kernel versions on IBM s390 systems.
- Confirm whether s390 pkey functionality is enabled or in use.
- Verify kernel packages include the referenced stable commits.
- Document non-s390 systems as not indicated by these sources.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-42158 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/62151a0acde90823bdfa991d598c85cf4b1d387dCVE reference, Linux
- https://git.kernel.org/stable/c/22e6824622e8a8889df0f8fc4ed5aea0e702a694CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.