7.8

CVE-2024-50143: linux Use of Uninitialized Resource

CVSS: 7.8v3.1HighModified
AliasesUBUNTU-CVE-2024-50143DEBIAN-CVE-2024-50143
Published 07-11-2024Last modified 05-08-2026
Open JSON

Vulnerability summary

CVE-2024-50143 is a high (CVSS 7.8) Use of Uninitialized Resource vulnerability in linux. EPSS estimates a 0.28% chance of exploitation in the next 30 days, higher than 18.9% of scored vulnerabilities.

Overall risk
31/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.8/10
010
High · v3.1 (CVE.org)
EPSS score
0.28%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 58 · Related 55
DLA-4008-1DLA-4404-1MGASA-2024-0368MGASA-2024-0369OPENSUSE-SU-2024:14500-1OPENSUSE-SU-2025:14705-1

Timeline

  1. 07-11-2024
    PublishedVulnerability first disclosed.
  2. 05-08-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: udf: fix uninit-value use in udf_get_fileshortad Check for overflow when computing alen in udf_current_aext to mitigate later uninit-value use in udf_get_fileshortad KMSAN bug[1]. After applying the patch reproducer did not trigger any issue[2]. [1] https://syzkaller.appspot.com/bug?extid=8901c4560b7ab5c2f9df [2] https://syzkaller.appspot.com/x/log.txt?x=10242227980000

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.28%

Chance of exploitation in the next 30 days

Percentile

19%

Versus all other CVEs

30-day change

0.00 pp

From 0.28% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.28%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Ubuntu135 products
  • linuxAll versions (No fix recorded) | < 5.4.0-208.228 | < 5.15.0-133.144 | < 6.8.0-58.60
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 5.4.0-1140.150 | < 5.15.0-1078.85 | < 6.8.0-1027.29
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 5eb76fb98b3335aa5cca6a7db2e659561c79c32b | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 417bd613bdbe791549f7687bb1b9b8012ff111c2 | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 0ce61b1f6b32df822b59c680cbe8e5ba5d335742 | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 4fc0d8660e391dcd8dde23c44d702be1f6846c61 | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 72e445df65a0aa9066c6fe2b8736ba2fcca6dac7 | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 1ac49babc952f48d82676979b20885e480e69be8 | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < e52e0b92ed31dc62afbda15c243dcee0bb5bb58d | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 264db9d666ad9a35075cc9ed9ec09d021580fbb1 | 2.6.12
  • linux_kernel< 4.19.323 | ≥ 4.20, < 5.4.285 | ≥ 5.5, < 5.15.170 | ≥ 5.16, < 6.1.115 | ≥ 6.2, < 6.6.59 | ≥ 6.7, < 6.11.6 | 6.12:rc1
Debian1 product
  • linux< 6.1.115-1 | < 6.11.6-1

3 vendors · 138 products

References

51 links
Show all 51 references