CVE-2024-50033 (GCVE-0-2024-50033)

Vulnerability from cvelistv5 – Published: 2024-10-21 19:39 – Updated: 2025-11-03 22:24
VLAI?
Title
slip: make slhc_remember() more robust against malicious packets
Summary
In the Linux kernel, the following vulnerability has been resolved: slip: make slhc_remember() more robust against malicious packets syzbot found that slhc_remember() was missing checks against malicious packets [1]. slhc_remember() only checked the size of the packet was at least 20, which is not good enough. We need to make sure the packet includes the IPv4 and TCP header that are supposed to be carried. Add iph and th pointers to make the code more readable. [1] BUG: KMSAN: uninit-value in slhc_remember+0x2e8/0x7b0 drivers/net/slip/slhc.c:666 slhc_remember+0x2e8/0x7b0 drivers/net/slip/slhc.c:666 ppp_receive_nonmp_frame+0xe45/0x35e0 drivers/net/ppp/ppp_generic.c:2455 ppp_receive_frame drivers/net/ppp/ppp_generic.c:2372 [inline] ppp_do_recv+0x65f/0x40d0 drivers/net/ppp/ppp_generic.c:2212 ppp_input+0x7dc/0xe60 drivers/net/ppp/ppp_generic.c:2327 pppoe_rcv_core+0x1d3/0x720 drivers/net/ppp/pppoe.c:379 sk_backlog_rcv+0x13b/0x420 include/net/sock.h:1113 __release_sock+0x1da/0x330 net/core/sock.c:3072 release_sock+0x6b/0x250 net/core/sock.c:3626 pppoe_sendmsg+0x2b8/0xb90 drivers/net/ppp/pppoe.c:903 sock_sendmsg_nosec net/socket.c:729 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:744 ____sys_sendmsg+0x903/0xb60 net/socket.c:2602 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2656 __sys_sendmmsg+0x3c1/0x960 net/socket.c:2742 __do_sys_sendmmsg net/socket.c:2771 [inline] __se_sys_sendmmsg net/socket.c:2768 [inline] __x64_sys_sendmmsg+0xbc/0x120 net/socket.c:2768 x64_sys_call+0xb6e/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:308 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was created at: slab_post_alloc_hook mm/slub.c:4091 [inline] slab_alloc_node mm/slub.c:4134 [inline] kmem_cache_alloc_node_noprof+0x6bf/0xb80 mm/slub.c:4186 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:587 __alloc_skb+0x363/0x7b0 net/core/skbuff.c:678 alloc_skb include/linux/skbuff.h:1322 [inline] sock_wmalloc+0xfe/0x1a0 net/core/sock.c:2732 pppoe_sendmsg+0x3a7/0xb90 drivers/net/ppp/pppoe.c:867 sock_sendmsg_nosec net/socket.c:729 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:744 ____sys_sendmsg+0x903/0xb60 net/socket.c:2602 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2656 __sys_sendmmsg+0x3c1/0x960 net/socket.c:2742 __do_sys_sendmmsg net/socket.c:2771 [inline] __se_sys_sendmmsg net/socket.c:2768 [inline] __x64_sys_sendmmsg+0xbc/0x120 net/socket.c:2768 x64_sys_call+0xb6e/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:308 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f CPU: 0 UID: 0 PID: 5460 Comm: syz.2.33 Not tainted 6.12.0-rc2-syzkaller-00006-g87d6aab2389e #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Severity ?
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: b5451d783ade99308dfccdf5ca284ed07affa4ff , < ba6501ea06462d6404d57d5644cf2854db38e7d7 (git)
Affected: b5451d783ade99308dfccdf5ca284ed07affa4ff , < 36b054324d18e51cf466134e13b6fbe3c91f52af (git)
Affected: b5451d783ade99308dfccdf5ca284ed07affa4ff , < 5e336384cc9b608e0551f99c3d87316ca3b0e51a (git)
Affected: b5451d783ade99308dfccdf5ca284ed07affa4ff , < ff5e0f895315706e4ca5a19df15be6866cee4f5d (git)
Affected: b5451d783ade99308dfccdf5ca284ed07affa4ff , < 8bb79eb1db85a10865f0d4dd15b013def3f2d246 (git)
Affected: b5451d783ade99308dfccdf5ca284ed07affa4ff , < 29e8d96d44f51cf89a62dd042be35d052833b95c (git)
Affected: b5451d783ade99308dfccdf5ca284ed07affa4ff , < 7d3fce8cbe3a70a1c7c06c9b53696be5d5d8dd5c (git)
Create a notification for this product.
    Linux Linux Affected: 3.2
Unaffected: 0 , < 3.2 (semver)
Unaffected: 5.4.285 , ≤ 5.4.* (semver)
Unaffected: 5.10.227 , ≤ 5.10.* (semver)
Unaffected: 5.15.168 , ≤ 5.15.* (semver)
Unaffected: 6.1.113 , ≤ 6.1.* (semver)
Unaffected: 6.6.57 , ≤ 6.6.* (semver)
Unaffected: 6.11.4 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-50033",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-22T13:25:49.586727Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-22T13:28:45.501Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:24:39.473Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/slip/slhc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ba6501ea06462d6404d57d5644cf2854db38e7d7",
              "status": "affected",
              "version": "b5451d783ade99308dfccdf5ca284ed07affa4ff",
              "versionType": "git"
            },
            {
              "lessThan": "36b054324d18e51cf466134e13b6fbe3c91f52af",
              "status": "affected",
              "version": "b5451d783ade99308dfccdf5ca284ed07affa4ff",
              "versionType": "git"
            },
            {
              "lessThan": "5e336384cc9b608e0551f99c3d87316ca3b0e51a",
              "status": "affected",
              "version": "b5451d783ade99308dfccdf5ca284ed07affa4ff",
              "versionType": "git"
            },
            {
              "lessThan": "ff5e0f895315706e4ca5a19df15be6866cee4f5d",
              "status": "affected",
              "version": "b5451d783ade99308dfccdf5ca284ed07affa4ff",
              "versionType": "git"
            },
            {
              "lessThan": "8bb79eb1db85a10865f0d4dd15b013def3f2d246",
              "status": "affected",
              "version": "b5451d783ade99308dfccdf5ca284ed07affa4ff",
              "versionType": "git"
            },
            {
              "lessThan": "29e8d96d44f51cf89a62dd042be35d052833b95c",
              "status": "affected",
              "version": "b5451d783ade99308dfccdf5ca284ed07affa4ff",
              "versionType": "git"
            },
            {
              "lessThan": "7d3fce8cbe3a70a1c7c06c9b53696be5d5d8dd5c",
              "status": "affected",
              "version": "b5451d783ade99308dfccdf5ca284ed07affa4ff",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/slip/slhc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.2"
            },
            {
              "lessThan": "3.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.285",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.227",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.168",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.57",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.285",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.227",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.168",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.113",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.57",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.4",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nslip: make slhc_remember() more robust against malicious packets\n\nsyzbot found that slhc_remember() was missing checks against\nmalicious packets [1].\n\nslhc_remember() only checked the size of the packet was at least 20,\nwhich is not good enough.\n\nWe need to make sure the packet includes the IPv4 and TCP header\nthat are supposed to be carried.\n\nAdd iph and th pointers to make the code more readable.\n\n[1]\n\nBUG: KMSAN: uninit-value in slhc_remember+0x2e8/0x7b0 drivers/net/slip/slhc.c:666\n  slhc_remember+0x2e8/0x7b0 drivers/net/slip/slhc.c:666\n  ppp_receive_nonmp_frame+0xe45/0x35e0 drivers/net/ppp/ppp_generic.c:2455\n  ppp_receive_frame drivers/net/ppp/ppp_generic.c:2372 [inline]\n  ppp_do_recv+0x65f/0x40d0 drivers/net/ppp/ppp_generic.c:2212\n  ppp_input+0x7dc/0xe60 drivers/net/ppp/ppp_generic.c:2327\n  pppoe_rcv_core+0x1d3/0x720 drivers/net/ppp/pppoe.c:379\n  sk_backlog_rcv+0x13b/0x420 include/net/sock.h:1113\n  __release_sock+0x1da/0x330 net/core/sock.c:3072\n  release_sock+0x6b/0x250 net/core/sock.c:3626\n  pppoe_sendmsg+0x2b8/0xb90 drivers/net/ppp/pppoe.c:903\n  sock_sendmsg_nosec net/socket.c:729 [inline]\n  __sock_sendmsg+0x30f/0x380 net/socket.c:744\n  ____sys_sendmsg+0x903/0xb60 net/socket.c:2602\n  ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2656\n  __sys_sendmmsg+0x3c1/0x960 net/socket.c:2742\n  __do_sys_sendmmsg net/socket.c:2771 [inline]\n  __se_sys_sendmmsg net/socket.c:2768 [inline]\n  __x64_sys_sendmmsg+0xbc/0x120 net/socket.c:2768\n  x64_sys_call+0xb6e/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:308\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nUninit was created at:\n  slab_post_alloc_hook mm/slub.c:4091 [inline]\n  slab_alloc_node mm/slub.c:4134 [inline]\n  kmem_cache_alloc_node_noprof+0x6bf/0xb80 mm/slub.c:4186\n  kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:587\n  __alloc_skb+0x363/0x7b0 net/core/skbuff.c:678\n  alloc_skb include/linux/skbuff.h:1322 [inline]\n  sock_wmalloc+0xfe/0x1a0 net/core/sock.c:2732\n  pppoe_sendmsg+0x3a7/0xb90 drivers/net/ppp/pppoe.c:867\n  sock_sendmsg_nosec net/socket.c:729 [inline]\n  __sock_sendmsg+0x30f/0x380 net/socket.c:744\n  ____sys_sendmsg+0x903/0xb60 net/socket.c:2602\n  ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2656\n  __sys_sendmmsg+0x3c1/0x960 net/socket.c:2742\n  __do_sys_sendmmsg net/socket.c:2771 [inline]\n  __se_sys_sendmmsg net/socket.c:2768 [inline]\n  __x64_sys_sendmmsg+0xbc/0x120 net/socket.c:2768\n  x64_sys_call+0xb6e/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:308\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nCPU: 0 UID: 0 PID: 5460 Comm: syz.2.33 Not tainted 6.12.0-rc2-syzkaller-00006-g87d6aab2389e #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T09:44:17.458Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ba6501ea06462d6404d57d5644cf2854db38e7d7"
        },
        {
          "url": "https://git.kernel.org/stable/c/36b054324d18e51cf466134e13b6fbe3c91f52af"
        },
        {
          "url": "https://git.kernel.org/stable/c/5e336384cc9b608e0551f99c3d87316ca3b0e51a"
        },
        {
          "url": "https://git.kernel.org/stable/c/ff5e0f895315706e4ca5a19df15be6866cee4f5d"
        },
        {
          "url": "https://git.kernel.org/stable/c/8bb79eb1db85a10865f0d4dd15b013def3f2d246"
        },
        {
          "url": "https://git.kernel.org/stable/c/29e8d96d44f51cf89a62dd042be35d052833b95c"
        },
        {
          "url": "https://git.kernel.org/stable/c/7d3fce8cbe3a70a1c7c06c9b53696be5d5d8dd5c"
        }
      ],
      "title": "slip: make slhc_remember() more robust against malicious packets",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-50033",
    "datePublished": "2024-10-21T19:39:35.127Z",
    "dateReserved": "2024-10-21T12:17:06.069Z",
    "dateUpdated": "2025-11-03T22:24:39.473Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T22:24:39.473Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-50033\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-22T13:25:49.586727Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-22T13:25:52.898Z\"}}], \"cna\": {\"title\": \"slip: make slhc_remember() more robust against malicious packets\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"b5451d783ade99308dfccdf5ca284ed07affa4ff\", \"lessThan\": \"ba6501ea06462d6404d57d5644cf2854db38e7d7\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b5451d783ade99308dfccdf5ca284ed07affa4ff\", \"lessThan\": \"36b054324d18e51cf466134e13b6fbe3c91f52af\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b5451d783ade99308dfccdf5ca284ed07affa4ff\", \"lessThan\": \"5e336384cc9b608e0551f99c3d87316ca3b0e51a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b5451d783ade99308dfccdf5ca284ed07affa4ff\", \"lessThan\": \"ff5e0f895315706e4ca5a19df15be6866cee4f5d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b5451d783ade99308dfccdf5ca284ed07affa4ff\", \"lessThan\": \"8bb79eb1db85a10865f0d4dd15b013def3f2d246\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b5451d783ade99308dfccdf5ca284ed07affa4ff\", \"lessThan\": \"29e8d96d44f51cf89a62dd042be35d052833b95c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b5451d783ade99308dfccdf5ca284ed07affa4ff\", \"lessThan\": \"7d3fce8cbe3a70a1c7c06c9b53696be5d5d8dd5c\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/slip/slhc.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.2\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"3.2\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.4.285\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.227\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.168\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.113\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.57\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.4\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/slip/slhc.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/ba6501ea06462d6404d57d5644cf2854db38e7d7\"}, {\"url\": \"https://git.kernel.org/stable/c/36b054324d18e51cf466134e13b6fbe3c91f52af\"}, {\"url\": \"https://git.kernel.org/stable/c/5e336384cc9b608e0551f99c3d87316ca3b0e51a\"}, {\"url\": \"https://git.kernel.org/stable/c/ff5e0f895315706e4ca5a19df15be6866cee4f5d\"}, {\"url\": \"https://git.kernel.org/stable/c/8bb79eb1db85a10865f0d4dd15b013def3f2d246\"}, {\"url\": \"https://git.kernel.org/stable/c/29e8d96d44f51cf89a62dd042be35d052833b95c\"}, {\"url\": \"https://git.kernel.org/stable/c/7d3fce8cbe3a70a1c7c06c9b53696be5d5d8dd5c\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nslip: make slhc_remember() more robust against malicious packets\\n\\nsyzbot found that slhc_remember() was missing checks against\\nmalicious packets [1].\\n\\nslhc_remember() only checked the size of the packet was at least 20,\\nwhich is not good enough.\\n\\nWe need to make sure the packet includes the IPv4 and TCP header\\nthat are supposed to be carried.\\n\\nAdd iph and th pointers to make the code more readable.\\n\\n[1]\\n\\nBUG: KMSAN: uninit-value in slhc_remember+0x2e8/0x7b0 drivers/net/slip/slhc.c:666\\n  slhc_remember+0x2e8/0x7b0 drivers/net/slip/slhc.c:666\\n  ppp_receive_nonmp_frame+0xe45/0x35e0 drivers/net/ppp/ppp_generic.c:2455\\n  ppp_receive_frame drivers/net/ppp/ppp_generic.c:2372 [inline]\\n  ppp_do_recv+0x65f/0x40d0 drivers/net/ppp/ppp_generic.c:2212\\n  ppp_input+0x7dc/0xe60 drivers/net/ppp/ppp_generic.c:2327\\n  pppoe_rcv_core+0x1d3/0x720 drivers/net/ppp/pppoe.c:379\\n  sk_backlog_rcv+0x13b/0x420 include/net/sock.h:1113\\n  __release_sock+0x1da/0x330 net/core/sock.c:3072\\n  release_sock+0x6b/0x250 net/core/sock.c:3626\\n  pppoe_sendmsg+0x2b8/0xb90 drivers/net/ppp/pppoe.c:903\\n  sock_sendmsg_nosec net/socket.c:729 [inline]\\n  __sock_sendmsg+0x30f/0x380 net/socket.c:744\\n  ____sys_sendmsg+0x903/0xb60 net/socket.c:2602\\n  ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2656\\n  __sys_sendmmsg+0x3c1/0x960 net/socket.c:2742\\n  __do_sys_sendmmsg net/socket.c:2771 [inline]\\n  __se_sys_sendmmsg net/socket.c:2768 [inline]\\n  __x64_sys_sendmmsg+0xbc/0x120 net/socket.c:2768\\n  x64_sys_call+0xb6e/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:308\\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\\n  do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83\\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\\n\\nUninit was created at:\\n  slab_post_alloc_hook mm/slub.c:4091 [inline]\\n  slab_alloc_node mm/slub.c:4134 [inline]\\n  kmem_cache_alloc_node_noprof+0x6bf/0xb80 mm/slub.c:4186\\n  kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:587\\n  __alloc_skb+0x363/0x7b0 net/core/skbuff.c:678\\n  alloc_skb include/linux/skbuff.h:1322 [inline]\\n  sock_wmalloc+0xfe/0x1a0 net/core/sock.c:2732\\n  pppoe_sendmsg+0x3a7/0xb90 drivers/net/ppp/pppoe.c:867\\n  sock_sendmsg_nosec net/socket.c:729 [inline]\\n  __sock_sendmsg+0x30f/0x380 net/socket.c:744\\n  ____sys_sendmsg+0x903/0xb60 net/socket.c:2602\\n  ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2656\\n  __sys_sendmmsg+0x3c1/0x960 net/socket.c:2742\\n  __do_sys_sendmmsg net/socket.c:2771 [inline]\\n  __se_sys_sendmmsg net/socket.c:2768 [inline]\\n  __x64_sys_sendmmsg+0xbc/0x120 net/socket.c:2768\\n  x64_sys_call+0xb6e/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:308\\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\\n  do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83\\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\\n\\nCPU: 0 UID: 0 PID: 5460 Comm: syz.2.33 Not tainted 6.12.0-rc2-syzkaller-00006-g87d6aab2389e #0\\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.285\", \"versionStartIncluding\": \"3.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.227\", \"versionStartIncluding\": \"3.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.168\", \"versionStartIncluding\": \"3.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.113\", \"versionStartIncluding\": \"3.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.57\", \"versionStartIncluding\": \"3.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.4\", \"versionStartIncluding\": \"3.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"3.2\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T09:44:17.458Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-50033\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-11-03T22:24:39.473Z\", \"dateReserved\": \"2024-10-21T12:17:06.069Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-10-21T19:39:35.127Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.