PT-2024-34084 · Linux+9 · Linux Kernel+9
Slavin Liu
·
Published
2024-10-30
·
Updated
2025-10-03
·
CVE-2024-50251
CVSS v3.1
6.2
Medium
| Vector | AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions:
Linux kernel versions prior to 6.6.61
Description:
A vulnerability has been resolved in the Linux kernel, specifically in the netfilter: nft payload module. The issue arises when the
skb checksum() function is called with an offset and length that exceed the skbuff length, triggering a BUG ON() error. The skb checksum() function internally subtracts the length parameter while iterating over the skbuff and checks that the expected length is fully consumed at the end.Recommendations:
For Linux kernel versions prior to 6.6.61, update to version 6.6.61 or later to resolve the issue. As a temporary workaround, consider restricting access to the
nft payload module until a patch is available. Avoid using the skb checksum() function with unvalidated offset and length parameters in the affected API endpoints until the issue is resolved.Exploit
Fix
Memory Leak
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Debian
Linuxmint
Linux Kernel
Red Hat
Red Os
Suse
Ubuntu