PT-2024-33875 · Linux+8 · Linux Kernel+8
Syzbot
·
Published
2024-10-10
·
Updated
2025-10-03
·
CVE-2024-50035
CVSS v3.1
7.1
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H |
Name of the Vulnerable Software and Affected Versions:
Linux kernel versions prior to 6.6.58
Description:
A vulnerability has been resolved in the Linux kernel related to the
ppp async encode() function. The issue occurs when pppoe sendmsg() is called with a zero size, leading to ppp async encode() being called with an empty skb. This results in an uninit-value bug. The vulnerability is related to the ppp async encode() and ppp async push() functions in the drivers/net/ppp/ppp async.c file. The pppoe sendmsg() function is also involved in the issue.Recommendations:
To resolve the issue, update the Linux kernel to version 6.6.58 or later.
As a temporary workaround, consider disabling the
ppp async encode() function until a patch is available.
Restrict access to the pppoe sendmsg() function to minimize the risk of exploitation.
Avoid using the ppp async push() function in the affected API endpoint until the issue is resolved.Exploit
Fix
Use of Uninitialized Resource
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Debian
Linuxmint
Linux Kernel
Red Hat
Red Os
Suse
Ubuntu