CVE-2024-42265

A flaw was found in the Linux kernel. The file descriptor duplication mechanism in the do_dup2() function does not sanitize array indexing against speculative execution. A local user can exploit this flaw through processor branch mispredictions to trigger speculative out-of-bounds memory reads, potentially leading to a Denial of Service (DoS) or information disclosure through side-channel observation.

This vulnerability is evaluated as having a Moderate impact because exploitation requires local access and cannot be triggered over the network. While file descriptor duplication routines are universally available to unprivileged user space processes in default configurations, weaponizing speculative branch mispredictions is technically complex and primarily confined to side-channel observation or denial of service. Consequently, the flaw does not allow direct privilege escalation or arbitrary code execution.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.