CVE-2024-42145
mediumpriority · track · 22EPSS 0.009 · 59 %ileDEEURUUSEPSS · scored 2026-10-27
In the Linux kernel, the following vulnerability has been resolved: IB/core: Implement a limit on UMAD receive List The existing behavior of ib_umad, which maintains received MAD packets in an unbounded list, poses a risk of uncontrolled growth. As user-space applications extract packets from this list, the rate of extraction may not match the rate of incoming packets, leading to potential list overflow. To address this, we introduce a limit to the size of the list. After considering typical scenarios, such as OpenSM processing, which can handle approximately 100k packets per second, and the 1-second retry timeout for most packets, we set the list size limit to 200k. Packets received beyond this limit are dropped, assuming they are likely timed out by the time they are handled by user-space. Notably, packets queued on the receive list due to reasons like timed-out sends are preserved even when the list is full.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedRUGGEDCOM RST2428P (6GK6242-6PA00)siemens_psirt
Update to V3.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109977557/ - FixedSCALANCE XCM-/XRM-/XCH-/XRH-300 familysiemens_psirt
Update to V3.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109977557/ - FixedRUGGEDCOM RST2428P (6GK6242-6PA00)cisa_csaf_ot
Update to V3.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109977557/ - FixedSCALANCE XCM-/XRM-/XCH-/XRH-300 familycisa_csaf_ot
Update to V3.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109977557/
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5.1–7.5
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (94)
Products and version ranges known to be affected.
- Dell PowerProtect Data Domain Management Centerall versionscert_bundDEcpe:/a:dell:powerprotect_data_domain_management_center:-
- NetApp ActiveIQ Unified Manager for VMware vSphereall versionscert_bundDEcpe:/a:netapp:active_iq_unified_manager:for_vmware_vsphere
advisories (5)
Vendor and ecosystem advisories describing this.
- SSA-355557SSA-355557: Multiple Vulnerabilities in Third-Party Components in SINEC OS before V3.22025-08-12csaf · siemens_psirtDE
SINEC OS before V3.2 contains third-party components with multiple vulnerabilities. Siemens has released new versions for the affected products and recommends to update to the latest versions.
- SSA-613116SSA-613116: Multiple Vulnerabilities in Third-Party Components in SINEC OS before V3.12025-08-12csaf · siemens_psirtDE
SINEC OS before V3.1 contains third-party components with multiple vulnerabilities. Siemens has released new versions for the affected products and recommends to update to the latest versions.
- WID-SEC-W-2024-1722Linux Kernel: Mehrere Schwachstellen ermöglichen nicht spezifizierten AngriffDeutsch2024-07-29csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.
- ICSA-25-226-07Siemens Third-Party Components in SINEC OS2025-08-12icsa · cisa_csaf_otUS
SINEC OS before V3.2 contains third-party components with multiple vulnerabilities. Siemens has released new versions for the affected products and recommends to update to the latest versions.
- ICSA-25-226-15Siemens SINEC OS2025-08-12icsa · cisa_csaf_otUS
SINEC OS before V3.1 contains third-party components with multiple vulnerabilities. Siemens has released new versions for the affected products and recommends to update to the latest versions.
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (26)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2024-42145/cnnvd
- https://git.kernel.org/stable/c/1288cf1cceb0e6df276e182f5412370fb4169bcbcnnvd
- https://git.kernel.org/stable/c/62349fbf86b5e13b02721bdadf98c29afd1e7b5fcnnvd
- https://git.kernel.org/stable/c/63d202d948bb6d3a28cd8e8b96b160fa53e18baacnnvd
- https://git.kernel.org/stable/c/a6627fba793cc75b7365d9504a0095fb2902dda4cnnvd
- https://git.kernel.org/stable/c/b4913702419d064ec4c4bbf7270643c95cc89a1bcnnvd
- https://git.kernel.org/stable/c/b8c5f635997f49c625178d1a0cb32a80ed33abe6cnnvd
- https://git.kernel.org/stable/c/ca0b44e20a6f3032224599f02e7c8fb49525c894cnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan