PT-2024-33977 · Linux+6 · Linux Kernel+6
Published
2024-11-07
·
Updated
2025-10-03
·
CVE-2024-50145
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions:
Linux kernel versions prior to 6.6.61
Description:
The issue is related to the handling of SKB allocation failures in the
octep oq process rx() function. When build skb() returns NULL due to a memory allocation failure, the function now handles it to avoid a NULL pointer dereference. During NAPI polling by the driver, if SKB allocation fails, packets are skipped and not processed or pushed up the network stack. A helper function is implemented to unmmap/flush fragment buffers used by dropped packets, and an 'alloc failures' counter is incremented to mark the error in driver statistics.Recommendations:
For Linux kernel versions prior to 6.6.61, update to version 6.6.61 or later to resolve the issue. As a temporary workaround, consider disabling the
octep oq process rx() function until a patch is available. Restrict access to the vulnerable module to minimize the risk of exploitation. Avoid using the build skb() function in the affected API endpoint until the issue is resolved.Exploit
Fix
NULL Pointer Dereference
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Linuxmint
Linux Kernel
Red Os
Suse
Ubuntu