CVE-2024-50264

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-50264
In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans During loopback communication, a dangling pointer can be created in vsk->trans, potentially leading to a Use-After-Free condition. This issue is resolved by initializing vsk->trans to NULL.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/2a6a4e69f255b7aed17f93995691ab4f0d3c2203 Patch
https://git.kernel.org/stable/c/44d29897eafd0e1196453d3003a4d5e0b968eeab Patch
https://git.kernel.org/stable/c/5f092a4271f6dccf88fe0d132475a17b69ef71df Patch
https://git.kernel.org/stable/c/5f970935d09934222fdef3d0e20c648ea7a963c1 VDB Entry
https://git.kernel.org/stable/c/6ca575374dd9a507cdd16dfa0e78c2e9e20bd05f Patch
https://git.kernel.org/stable/c/b110196fec44fe966952004bd426967c2a8fd358 Patch
https://git.kernel.org/stable/c/eb1bdcb7dfc30b24495ee4c5533af0ed135cb5f1 Patch
https://git.kernel.org/stable/c/fd8ae346692a56b4437d626c5460c7104980f389 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc6:*:*:*:*:*:*
History

21 Nov 2024, 19:28

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/2a6a4e69f255b7aed17f93995691ab4f0d3c2203 - () https://git.kernel.org/stable/c/2a6a4e69f255b7aed17f93995691ab4f0d3c2203 - Patch
References () https://git.kernel.org/stable/c/44d29897eafd0e1196453d3003a4d5e0b968eeab - () https://git.kernel.org/stable/c/44d29897eafd0e1196453d3003a4d5e0b968eeab - Patch
References () https://git.kernel.org/stable/c/5f092a4271f6dccf88fe0d132475a17b69ef71df - () https://git.kernel.org/stable/c/5f092a4271f6dccf88fe0d132475a17b69ef71df - Patch
References () https://git.kernel.org/stable/c/5f970935d09934222fdef3d0e20c648ea7a963c1 - () https://git.kernel.org/stable/c/5f970935d09934222fdef3d0e20c648ea7a963c1 - VDB Entry
References () https://git.kernel.org/stable/c/6ca575374dd9a507cdd16dfa0e78c2e9e20bd05f - () https://git.kernel.org/stable/c/6ca575374dd9a507cdd16dfa0e78c2e9e20bd05f - Patch
References () https://git.kernel.org/stable/c/b110196fec44fe966952004bd426967c2a8fd358 - () https://git.kernel.org/stable/c/b110196fec44fe966952004bd426967c2a8fd358 - Patch
References () https://git.kernel.org/stable/c/eb1bdcb7dfc30b24495ee4c5533af0ed135cb5f1 - () https://git.kernel.org/stable/c/eb1bdcb7dfc30b24495ee4c5533af0ed135cb5f1 - Patch
References () https://git.kernel.org/stable/c/fd8ae346692a56b4437d626c5460c7104980f389 - () https://git.kernel.org/stable/c/fd8ae346692a56b4437d626c5460c7104980f389 - Patch
CWE CWE-416
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
First Time Linux linux Kernel
Linux
CPE cpe:2.3:o:linux:linux_kernel:6.12:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc5:*:*:*:*:*:*

19 Nov 2024, 21:57

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: vsock/virtio: inicialización del puntero colgante que se produce en vsk->trans. Durante la comunicación de bucle invertido, se puede crear un puntero colgante en vsk->trans, lo que puede provocar una condición de Use-After-Free. Este problema se resuelve inicializando vsk->trans en NULL.

19 Nov 2024, 02:16

Type Values Removed Values Added
New CVE
Information

Published : 2024-11-19 02:16

Updated : 2024-11-21 19:28

NVD link : CVE-2024-50264

Mitre link : CVE-2024-50264

CVE.ORG link : CVE-2024-50264

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-416

Use After Free