What’s Vulnerable › Vulnerabilities

CVE-2024-42155: s390/pkey: Wipe copies of protected- and secure-keys

• Severity: low (CVSS 1.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-07-30 · updated 2026-10-30

Description

In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Wipe copies of protected- and secure-keys Although the clear-key of neither protected- nor secure-keys is accessible, this key material should only be visible to the calling process. So wipe all copies of protected- or secure-keys from stack, even in case of an error.

Affected products

• Linux kernel: from 4.11 before 6.9.9 — fixed in 6.9.9
• Linux: 4.11 — fixed in 6.10

How to fix

Upgrade to a fixed version: Linux kernel 6.9.9; Linux 6.10. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/016dbf1a1ae1d13fca8589f884a296854c1756db
• https://git.kernel.org/stable/c/7d5711e03cefd59da4d198ca02d4f8238ba1105c
• https://git.kernel.org/stable/c/c746f7ced4ad88ee48d0b6c92710e4674403185b
• https://git.kernel.org/stable/c/f2ebdadd85af4f4d0cae1e5d009c70eccc78c207
• https://git.kernel.org/stable/c/c746f7ced4ad88ee48d0b6c92710e4674403185b
• https://git.kernel.org/stable/c/f2ebdadd85af4f4d0cae1e5d009c70eccc78c207

Get alerted when CVE-2024-42155 or the next vulnerability affects your stack