Security readout for executives and security teams
Plain-English summary
A bounds error in the Linux parallel-port subsystem can corrupt kernel memory and crash the operating system. The supplied assessment rates potential confidentiality, integrity, and availability impact as high, but the documented real-world outcome is a kernel panic rather than confirmed code execution.
Executive priority
Treat this as a high-priority kernel maintenance issue for exposed multi-user Linux systems. Accelerate normal patching where local untrusted access exists; otherwise schedule the supported kernel update promptly. There is no supplied evidence supporting an emergency response for active exploitation.
Technical view
The Linux parport code used sprintf for data copying in a path associated with do_hardware_base_addr. Unbounded output could exceed the destination array, corrupt the kernel stack, and trigger a stack-protector panic. Stable-kernel changes replace sprintf with snprintf to constrain the write.
Likely exposure
Exposure is most likely on systems running an affected Linux kernel where the parport component is present and reachable by a local, low-privileged user. The bundle lists affected kernel versions, but does not provide reliable distribution-package mappings or configuration prerequisites.
Exploitation context
The vulnerability requires local access according to CVSS and does not require user interaction. The bundle marks it absent from KEV and provides no evidence of active exploitation. It documents an encountered kernel panic, not confirmed attacker-controlled code execution.
Researcher notes
The bundle provides multiple stable-branch commits but an ambiguous affected-version list, including repeated commit identifiers. It does not establish exact triggering prerequisites, public proof-of-concept availability, or successful privilege escalation. The observed evidence supports stack corruption and denial of service; broader impact is represented by the supplied CVSS vector.
Mitigation direction
- Install the distribution-supported kernel update that incorporates the relevant stable-kernel fix.
- Reboot into the updated kernel after installation.
- Consult Linux distribution advisories to confirm the fixed package version for each maintained branch.
- Prioritize multi-user systems where untrusted users can obtain local accounts.
Validation and detection
- Record each system's running kernel version and distribution package release.
- Confirm the installed package includes the applicable upstream stable commit or vendor backport.
- Verify systems rebooted into the corrected kernel rather than retaining an older running kernel.
- Determine whether the parport component is enabled or used on potentially affected hosts.
- Review kernel logs for stack-protector failures or panics involving do_hardware_base_addr and parport.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-42301 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/166a0bddcc27de41fe13f861c8348e8e53e988c8CVE reference, Linux
- https://git.kernel.org/stable/c/47b3dce100778001cd76f7e9188944b5cb27a76dCVE reference, Linux
- https://git.kernel.org/stable/c/a44f88f7576bc1916d8d6293f5c62fbe7cbe03e0CVE reference, Linux
- https://git.kernel.org/stable/c/c719b393374d3763e64900ee19aaed767d5a08d6CVE reference, Linux
- https://git.kernel.org/stable/c/7f4da759092a1a6ce35fb085182d02de8cc4cc84CVE reference, Linux
- https://git.kernel.org/stable/c/b579ea3516c371ecf59d073772bc45dfd28c8a0eCVE reference, Linux
- https://git.kernel.org/stable/c/7789a1d6792af410aa9b39a1eb237ed24fa2170aCVE reference, Linux
- https://git.kernel.org/stable/c/ab11dac93d2d568d151b1918d7b84c2d02bacbd5CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2024/10/msg00003.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.