{"id":"CVE-2024-42265","state":"PUBLISHED","title":"protect the fetch of ->fd[fd] in do_dup2() from mispredictions","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nprotect the fetch of ->fd[fd] in do_dup2() from mispredictions\n\nboth callers have verified that fd is not greater than ->max_fds;\nhowever, misprediction might end up with\n        tofree = fdt->fd[fd];\nbeing speculatively executed.  That's wrong for the same reasons\nwhy it's wrong in close_fd()/file_close_fd_locked(); the same\nsolution applies - array_index_nospec(fd, fdt->max_fds) could differ\nfrom fd only in case of speculative execution on mispredicted path.","publishedAt":"2024-08-17T08:54:21.636Z","updatedAt":"2026-10-15T00:48:07.974Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"8280d16172243702ed43432f826ca6130edb4086","status":"affected","lessThan":"ed42e8ff509d2a61c6642d1825032072dab79f26","versionType":"git"},{"version":"8280d16172243702ed43432f826ca6130edb4086","status":"affected","lessThan":"41a6c31df77bd8e050136b0a200b537da9e1084a","versionType":"git"},{"version":"8280d16172243702ed43432f826ca6130edb4086","status":"affected","lessThan":"08775b3d6ed117cf4518754ec7300ee42b6a5368","versionType":"git"},{"version":"8280d16172243702ed43432f826ca6130edb4086","status":"affected","lessThan":"3f480493550b6a23d3a65d095d6569d4a7f56a0f","versionType":"git"},{"version":"8280d16172243702ed43432f826ca6130edb4086","status":"affected","lessThan":"5db999fff545b924b24c9afd368ef5c17279b176","versionType":"git"},{"version":"8280d16172243702ed43432f826ca6130edb4086","status":"affected","lessThan":"da72e783afd27d9f487836b2e6738146c0edd149","versionType":"git"},{"version":"8280d16172243702ed43432f826ca6130edb4086","status":"affected","lessThan":"1171ceccabfd596ca370c5d2cbb47d110c3f2fe1","versionType":"git"},{"version":"8280d16172243702ed43432f826ca6130edb4086","status":"affected","lessThan":"8aa37bde1a7b645816cda8b80df4753ecf172bf1","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/file.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"3.7","status":"affected"},{"version":"0","status":"unaffected","lessThan":"3.7","versionType":"semver"},{"version":"4.19.320","status":"unaffected","lessThanOrEqual":"4.19.*","versionType":"semver"},{"version":"5.4.282","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.224","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.165","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.104","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.45","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.10.4","status":"unaffected","lessThanOrEqual":"6.10.*","versionType":"semver"},{"version":"6.11","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/file.c"]}],"references":["https://git.kernel.org/stable/c/ed42e8ff509d2a61c6642d1825032072dab79f26","https://git.kernel.org/stable/c/41a6c31df77bd8e050136b0a200b537da9e1084a","https://git.kernel.org/stable/c/08775b3d6ed117cf4518754ec7300ee42b6a5368","https://git.kernel.org/stable/c/3f480493550b6a23d3a65d095d6569d4a7f56a0f","https://git.kernel.org/stable/c/5db999fff545b924b24c9afd368ef5c17279b176","https://git.kernel.org/stable/c/da72e783afd27d9f487836b2e6738146c0edd149","https://git.kernel.org/stable/c/1171ceccabfd596ca370c5d2cbb47d110c3f2fe1","https://git.kernel.org/stable/c/8aa37bde1a7b645816cda8b80df4753ecf172bf1","https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html","https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"weaknesses":[],"ingestedAt":"2026-10-29T20:07:47.831Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/42xxx/CVE-2024-42265.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-42265","state":"PUBLISHED","datePublished":"2024-08-17T08:54:21.636Z","dateUpdated":"2026-10-15T00:48:07.974Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2024-07-30T07:40:12.259Z"},"containers":{"cna":{"title":"protect the fetch of ->fd[fd] in do_dup2() from mispredictions","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nprotect the fetch of ->fd[fd] in do_dup2() from mispredictions\n\nboth callers have verified that fd is not greater than ->max_fds;\nhowever, misprediction might end up with\n        tofree = fdt->fd[fd];\nbeing speculatively executed.  That's wrong for the same reasons\nwhy it's wrong in close_fd()/file_close_fd_locked(); the same\nsolution applies - array_index_nospec(fd, fdt->max_fds) could differ\nfrom fd only in case of speculative execution on mispredicted path."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"8280d16172243702ed43432f826ca6130edb4086","status":"affected","lessThan":"ed42e8ff509d2a61c6642d1825032072dab79f26","versionType":"git"},{"version":"8280d16172243702ed43432f826ca6130edb4086","status":"affected","lessThan":"41a6c31df77bd8e050136b0a200b537da9e1084a","versionType":"git"},{"version":"8280d16172243702ed43432f826ca6130edb4086","status":"affected","lessThan":"08775b3d6ed117cf4518754ec7300ee42b6a5368","versionType":"git"},{"version":"8280d16172243702ed43432f826ca6130edb4086","status":"affected","lessThan":"3f480493550b6a23d3a65d095d6569d4a7f56a0f","versionType":"git"},{"version":"8280d16172243702ed43432f826ca6130edb4086","status":"affected","lessThan":"5db999fff545b924b24c9afd368ef5c17279b176","versionType":"git"},{"version":"8280d16172243702ed43432f826ca6130edb4086","status":"affected","lessThan":"da72e783afd27d9f487836b2e6738146c0edd149","versionType":"git"},{"version":"8280d16172243702ed43432f826ca6130edb4086","status":"affected","lessThan":"1171ceccabfd596ca370c5d2cbb47d110c3f2fe1","versionType":"git"},{"version":"8280d16172243702ed43432f826ca6130edb4086","status":"affected","lessThan":"8aa37bde1a7b645816cda8b80df4753ecf172bf1","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/file.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"3.7","status":"affected"},{"version":"0","status":"unaffected","lessThan":"3.7","versionType":"semver"},{"version":"4.19.320","status":"unaffected","lessThanOrEqual":"4.19.*","versionType":"semver"},{"version":"5.4.282","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.224","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.165","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.104","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.45","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.10.4","status":"unaffected","lessThanOrEqual":"6.10.*","versionType":"semver"},{"version":"6.11","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/file.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/ed42e8ff509d2a61c6642d1825032072dab79f26"},{"url":"https://git.kernel.org/stable/c/41a6c31df77bd8e050136b0a200b537da9e1084a"},{"url":"https://git.kernel.org/stable/c/08775b3d6ed117cf4518754ec7300ee42b6a5368"},{"url":"https://git.kernel.org/stable/c/3f480493550b6a23d3a65d095d6569d4a7f56a0f"},{"url":"https://git.kernel.org/stable/c/5db999fff545b924b24c9afd368ef5c17279b176"},{"url":"https://git.kernel.org/stable/c/da72e783afd27d9f487836b2e6738146c0edd149"},{"url":"https://git.kernel.org/stable/c/1171ceccabfd596ca370c5d2cbb47d110c3f2fe1"},{"url":"https://git.kernel.org/stable/c/8aa37bde1a7b645816cda8b80df4753ecf172bf1"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-05-11T20:28:59.946Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.7","versionEndExcluding":"4.19.320"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.7","versionEndExcluding":"5.4.282"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.7","versionEndExcluding":"5.10.224"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.7","versionEndExcluding":"5.15.165"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.7","versionEndExcluding":"6.1.104"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.7","versionEndExcluding":"6.6.45"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.7","versionEndExcluding":"6.10.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.7","versionEndExcluding":"6.11"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-42265","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-09-10T16:12:30.860612Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-09-12T17:33:05.845Z"}},{"title":"CVE Program Container","references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"},{"url":"https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2025-11-03T22:02:59.813Z"}},{"affected":[{"vendor":"Siemens","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"V1.1.1","versionType":"custom"}]}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-265688.html"}],"providerMetadata":{"shortName":"siemens-SADP","orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","dateUpdated":"2026-10-15T00:48:07.974Z"},"x_adpType":"supplier"}]}}}