5.5

CVE-2024-50142: xfrm: validate new SA's prefixlen using SA family when sel.family is unset

Modified
AliasesUBUNTU-CVE-2024-50142DEBIAN-CVE-2024-50142
Published 07-11-2024Last modified 15-10-2026

Vulnerability summary

CVE-2024-50142 is a medium (CVSS 5.5) vulnerability in linux. EPSS estimates a 0.26% chance of exploitation in the next 30 days, higher than 17.7% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 5.5, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
5.5/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.26%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 60 · Related 54
DLA-4008-1DLA-4075-1MGASA-2024-0368MGASA-2024-0369OPENSUSE-SU-2024:14500-1OPENSUSE-SU-2025:14705-1

Timeline

  1. 07-11-2024
    PublishedVulnerability first disclosed.
  2. 15-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: xfrm: validate new SA's prefixlen using SA family when sel.family is unset This expands the validation introduced in commit 07bf7908950a ("xfrm: Validate address prefix lengths in the xfrm selector.") syzbot created an SA with usersa.sel.family = AF_UNSPEC usersa.sel.prefixlen_s = 128 usersa.family = AF_INET Because of the AF_UNSPEC selector, verify_newsa_info doesn't put limits on prefixlen_{s,d}. But then copy_from_user_state sets x->sel.family to usersa.family (AF_INET). Do the same conversion in verify_newsa_info before validating prefixlen_{s,d}, since that's how prefixlen is going to be used later on.

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

0.26%

Chance of exploitation in the next 30 days

Percentile

18%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.26% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Ubuntu134 products
  • linuxAll versions (No fix recorded) | < 4.4.0-280.314 | < 4.15.0-249.261 | < 5.4.0-208.228 | < 5.15.0-133.144 | < 6.8.0-58.60
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-aws< 4.4.0-1154.160 | < 4.4.0-1192.207 | < 4.15.0-1191.204 | < 5.4.0-1140.150 | < 5.15.0-1078.85 | < 6.8.0-1027.29
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < f31398570acf0f0804c644006f7bfa9067106b0a | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 401ad99a5ae7180dd9449eac104cb755f442e7f3 | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 8df5cd51fd70c33aa1776e5cbcd82b0a86649d73 | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 2d08a6c31c65f23db71a5385ee9cf9d8f9a67a71 | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < bce1afaa212ec380bf971614f70909a27882b862 | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 7d9868180bd1e4cf37e7c5067362658971162366 | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < e68dd80ba498265d2266b12dc3459164f4ff0c4a | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563 | 2.6.12
  • linux_kernel≥ 2.6.12, < 4.19.323 | ≥ 4.20, < 5.4.285 | ≥ 5.5, < 5.10.229 | ≥ 5.11, < 5.15.170 | ≥ 5.16, < 6.1.115 | ≥ 6.2, < 6.6.59 | ≥ 6.7, < 6.11.6 | 6.12:rc1 | 6.12:rc2 | 6.12:rc3 | 6.12:rc4
Debian1 product
  • linux< 6.1.115-1 | < 6.11.6-1

3 vendors · 137 products

References

56 links
Show all 56 references