---
cve: "CVE-2024-42154"
severity: "LOW"
cvss: 3.1
epss: "26%"
vendor: "Linux"
kev: false
exploited: false
published: "2024-07-30 08:15:06"
tags: [cve, security, low]
source: tsecurity.de CVE-Dossier
exported: "2026-09-12T03:21:28+02:00"
---

# CVE-2024-42154

> 3.1 LOW

## Beschreibung

In the Linux kernel, the following vulnerability has been resolved:

tcp_metrics: validate source addr length

I don't see anything checking that TCP_METRICS_ATTR_SADDR_IPV4
is at least 4 bytes long, and the policy doesn't have an entry
for this attribute at all (neither does it for IPv6 but v6 is
manually validated).

## Patch verfügbar (OSV)

- Kernel ≥ 4.19.318
- Kernel ≥ 5.4.280
- Kernel ≥ 5.10.222
- Kernel ≥ 5.15.163
- Kernel ≥ 6.1.98
- Kernel ≥ 6.6.39
- Kernel ≥ 6.9.9

## Referenzen

- <https://git.kernel.org/stable/c/19d997b59fa1fd7a02e770ee0881c0652b9c32c9>
- <https://git.kernel.org/stable/c/2a2e79dbe2236a1289412d2044994f7ab419b44c>
- <https://git.kernel.org/stable/c/cdffc358717e436bb67122bb82c1a2a26e050f98>
- <https://git.kernel.org/stable/c/ef7c428b425beeb52b894e16f1c4b629d6cebfb6>
- <https://git.kernel.org/stable/c/31f03bb04146c1c6df6c03e9f45401f5f5a985d3>
- <https://git.kernel.org/stable/c/8c2debdd170e395934ac0e039748576dfde14e99>
- <https://git.kernel.org/stable/c/3d550dd5418729a6e77fe7721d27adea7152e321>
- <https://git.kernel.org/stable/c/66be40e622e177316ae81717aa30057ba9e61dff>
- <http://www.openwall.com/lists/oss-security/2024/09/24/3>
- <http://www.openwall.com/lists/oss-security/2024/09/24/4>
- <http://www.openwall.com/lists/oss-security/2024/09/25/3>
- <https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2024-42154) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_