IM
IronMonkey Threat Research

CVE-2024-50142 MEDIUM

Published: 2024-11-07 | Last Modified: 2026-05-12 | Status: Modified

Description

In the Linux kernel, the following vulnerability has been resolved: xfrm: validate new SA's prefixlen using SA family when sel.family is unset This expands the validation introduced in commit 07bf7908950a ("xfrm: Validate address prefix lengths in the xfrm selector.") syzbot created an SA with usersa.sel.family = AF_UNSPEC usersa.sel.prefixlen_s = 128 usersa.family = AF_INET Because of the AF_UNSPEC selector, verify_newsa_info doesn't put limits on prefixlen_{s,d}. But then copy_from_user_state sets x->sel.family to usersa.family (AF_INET). Do the same conversion in verify_newsa_info before validating prefixlen_{s,d}, since that's how prefixlen is going to be used later on.

Additional Descriptions (1)

En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: xfrm: validar el prefijo de la nueva SA usando la familia de SA cuando sel.family no está configurado Esto expande la validación introducida en el commit 07bf7908950a ("xfrm: validar las longitudes de prefijo de dirección en el selector xfrm"). syzbot creó una SA con usersa.sel.family = AF_UNSPEC usersa.sel.prefixlen_s = 128 usersa.family = AF_INET Debido al selector AF_UNSPEC, verificar_newsa_info no pone límites en prefixlen_{s,d}. Pero luego copy_from_user_state establece x->sel.family en usersa.family (AF_INET). Realice la misma conversión en verificar_newsa_info antes de validar prefixlen_{s,d}, ya que así es como se usará prefixlen más adelante.

CVSS Metrics

Base Score: 5.5 (MEDIUM)

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack VectorLOCAL
Attack ComplexityLOW
Privileges RequiredLOW
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactNONE
Integrity ImpactNONE
Availability ImpactHIGH

Source: [email protected]

Type: Primary

Exploitability Score: 1.8

Impact Score: 3.6

Weaknesses

Source Type Description
[email protected] Primary
en NVD-CWE-noinfo

Affected Products

Vendor Product Version Update Type
linux linux_kernel * <built-in method update of dict object at 0x7fd36adef0c0> Operating System
linux linux_kernel * <built-in method update of dict object at 0x7fd36adeef40> Operating System
linux linux_kernel * <built-in method update of dict object at 0x7fd384a210c0> Operating System
linux linux_kernel * <built-in method update of dict object at 0x7fd36a618ac0> Operating System
linux linux_kernel * <built-in method update of dict object at 0x7fd36adef280> Operating System
linux linux_kernel * <built-in method update of dict object at 0x7fd36aded940> Operating System
linux linux_kernel * <built-in method update of dict object at 0x7fd31b2371c0> Operating System
linux linux_kernel 6.12 <built-in method update of dict object at 0x7fd3682472c0> Operating System
linux linux_kernel 6.12 <built-in method update of dict object at 0x7fd31b237780> Operating System
linux linux_kernel 6.12 <built-in method update of dict object at 0x7fd36adee100> Operating System
linux linux_kernel 6.12 <built-in method update of dict object at 0x7fd36a6e66c0> Operating System

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:*

References