PT-2024-34107 · Linux+2 · Linux Kernel+2

Parthiban N · Published 2024-11-04 · Updated 2025-02-28 · CVE-2024-50281

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified)

Description: A NULL pointer dereference issue has been identified in the Linux kernel, specifically in the KEYS: trusted: dcp component. This issue occurs when sealing or unsealing a key blob, as the system does not wait for the AEAD cipher operation to finish before resuming the seal and unseal calls. Under heavy system load, this can result in the buffer being removed from the stack before the cipher operation is complete, leading to NULL pointer dereference errors in the DCP driver during blob creation.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BDU:2025-14146

CVE-2024-50281

USN-7276-1

USN-7277-1

USN-7310-1

Affected Products

Linuxmint

Linux Kernel

Ubuntu

References · 785

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/50xxx/CVE-2024-50281.json · Exploit
• https://ubuntu.com/security/CVE-2024-53166 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-50059 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-50185 · Vendor Advisory
• https://git.kernel.org/stable/c/04de7589e0a95167d803ecadd115235ba2c14997 · Patch
• https://ubuntu.com/security/CVE-2024-50016 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-49943 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-50249 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-50211 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-49907 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-49868 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-50151 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-50205 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-50277 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-50145 · Vendor Advisory