CVE-2024-42154

A vulnerability was found in the Linux kernel's tcp_metrics.c, where insufficient validation of the length of the source address for TCP metrics could lead to incorrect memory read (out of boundary read).

The impact level is limited, because:

1. Missed check existed before and worked correctly (because by default it worked for int32 value, even if it was not specified exactly).
2. Even if for some specific case fail could happen, still it can lead only to incorrect memory read.
3. Even if memory corruption happens, it should not lead to anything apart from incorrect tcp-ip statistics output to the local user.
4. This bug is restricted to local as netlink is configured to be local only out of the box.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.