CVE-2024-50024

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-50024", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-10-21T12:17:06.065Z", "datePublished": "2024-10-21T19:39:29.203Z", "dateUpdated": "2026-08-05T11:41:02.236Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:41:02.236Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: Fix an unsafe loop on the list\n\nThe kernel may crash when deleting a genetlink family if there are still\nlisteners for that family:\n\nOops: Kernel access of bad area, sig: 11 [#1]\n ...\n NIP [c000000000c080bc] netlink_update_socket_mc+0x3c/0xc0\n LR [c000000000c0f764] __netlink_clear_multicast_users+0x74/0xc0\n Call Trace:\n__netlink_clear_multicast_users+0x74/0xc0\ngenl_unregister_family+0xd4/0x2d0\n\nChange the unsafe loop on the list to a safe one, because inside the\nloop there is an element removal from this list."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.3, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The attacker-controlled state is built exclusively through local AF_NETLINK/NETLINK_GENERIC sockets (bind() and setsockopt(NETLINK_ADD_MEMBERSHIP)), and the faulty loop lives in netlink table maintenance code. There is no remote, adjacent-network, or guest-to-host path into `__netlink_clear_multicast_users()`.\nAC:L - The attacker deterministically constructs the dangerous `mc_list` \u2014 many sockets subscribed to many genl multicast group ids, with subscription counts arranged so the loop body unlinks the element it is standing on \u2014 and no condition outside their influence (specific timing window, unpredictable memory layout, or victim process state) is needed for the walk to leave the list.\nPR:L - NETLINK_GENERIC is registered with NL_CFG_F_NONROOT_RECV, so `netlink_allowed()` lets any unprivileged user join genl multicast groups, and `genl_bind()`'s CAP_NET_ADMIN/CAP_SYS_ADMIN checks are `ns_capable(net->user_ns, \u2026)`, which a plain user satisfies via `unshare -Urn`; since `nl_table[].mc_list` is global and `genl_unregister_mc_groups()` sweeps every netns, sockets planted from an unprivileged namespace are walked by the buggy loop.\nUI:R - The unsafe loop only executes from `genl_unregister_family()`, which every in-tree caller reaches from a module exit or module-init failure path, so an administrator must unload/teardown the genl-providing module (rmmod, driver upgrade, udev-driven `modprobe -r`) after the attacker has planted the listeners.\nS:U - The stale list node, the netlink socket group bitmaps, and the corrupted slab memory all belong to the host kernel, the same security authority that is compromised. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The loop dereferences a list element already unlinked inside the body and reads through pointers taken from it (`test_bit(group - 1, nlk->groups)`), and the missing `ngroups` bound check \u2014 present in the sibling `netlink_update_listeners()` \u2014 makes that an out-of-bounds slab read at an attacker-chosen group index, a stale-object read primitive usable to disclose adjacent kernel heap contents.\nI:H - The same code path writes through the stale/undersized object \u2014 `__assign_bit(group - 1, nlk->groups, new)` and `nlk->subscriptions = subscriptions` \u2014 so once the freed or overrun slab region is groomed by the attacker this becomes an arbitrary-bit clear at an attacker-influenced address, plus corruption of the `mc_list` linkage itself, which is sufficient for control-flow hijacking.\nA:H - The committed reproduction is a hard kernel crash \u2014 \"Oops: Kernel access of bad area, sig: 11\" at `netlink_update_socket_mc+0x3c` under `__netlink_clear_multicast_users()` \u2014 and the corruption happens while `nl_table_lock` is held via `netlink_table_grab()` (`write_lock_irq`), so a mangled list also wedges the entire netlink subsystem."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/net/sock.h", "net/netlink/af_netlink.c"], "versions": [{"version": "b8273570f802a7658827dcb077b0b517ba75a289", "lessThan": "464801a0f6ccb52b21faa33bac6014fd74cc5e10", "status": "affected", "versionType": "git"}, {"version": "b8273570f802a7658827dcb077b0b517ba75a289", "lessThan": "8e0766fcf37ad8eed289dd3853628dd9b01b58b0", "status": "affected", "versionType": "git"}, {"version": "b8273570f802a7658827dcb077b0b517ba75a289", "lessThan": "68ad5da6ca630a276f0a5c924179e57724d00013", "status": "affected", "versionType": "git"}, {"version": "b8273570f802a7658827dcb077b0b517ba75a289", "lessThan": "1cdec792b2450105b1314c5123a9a0452cb2c2f0", "status": "affected", "versionType": "git"}, {"version": "b8273570f802a7658827dcb077b0b517ba75a289", "lessThan": "5f03a7f601f33cda1f710611625235dc86fd8a9e", "status": "affected", "versionType": "git"}, {"version": "b8273570f802a7658827dcb077b0b517ba75a289", "lessThan": "3be342e0332a7c83eb26fbb22bf156fdca467a5d", "status": "affected", "versionType": "git"}, {"version": "b8273570f802a7658827dcb077b0b517ba75a289", "lessThan": "49f9b726bf2bf3dd2caf0d27cadf4bc1ccf7a7dd", "status": "affected", "versionType": "git"}, {"version": "b8273570f802a7658827dcb077b0b517ba75a289", "lessThan": "1dae9f1187189bc09ff6d25ca97ead711f7e26f9", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/net/sock.h", "net/netlink/af_netlink.c"], "versions": [{"version": "2.6.32", "status": "affected"}, {"version": "0", "lessThan": "2.6.32", "status": "unaffected", "versionType": "semver"}, {"version": "4.19.323", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.285", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.227", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.168", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.113", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.57", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.11.4", "lessThanOrEqual": "6.11.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.32", "versionEndExcluding": "4.19.323"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.32", "versionEndExcluding": "5.4.285"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.32", "versionEndExcluding": "5.10.227"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.32", "versionEndExcluding": "5.15.168"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.32", "versionEndExcluding": "6.1.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.32", "versionEndExcluding": "6.6.57"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.32", "versionEndExcluding": "6.11.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.32", "versionEndExcluding": "6.12"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/464801a0f6ccb52b21faa33bac6014fd74cc5e10"}, {"url": "https://git.kernel.org/stable/c/8e0766fcf37ad8eed289dd3853628dd9b01b58b0"}, {"url": "https://git.kernel.org/stable/c/68ad5da6ca630a276f0a5c924179e57724d00013"}, {"url": "https://git.kernel.org/stable/c/1cdec792b2450105b1314c5123a9a0452cb2c2f0"}, {"url": "https://git.kernel.org/stable/c/5f03a7f601f33cda1f710611625235dc86fd8a9e"}, {"url": "https://git.kernel.org/stable/c/3be342e0332a7c83eb26fbb22bf156fdca467a5d"}, {"url": "https://git.kernel.org/stable/c/49f9b726bf2bf3dd2caf0d27cadf4bc1ccf7a7dd"}, {"url": "https://git.kernel.org/stable/c/1dae9f1187189bc09ff6d25ca97ead711f7e26f9"}], "title": "net: Fix an unsafe loop on the list", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-50024", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-10-22T13:27:00.388543Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-22T13:28:46.817Z"}}, {"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:24:35.047Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:24:35.047Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-50024", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-10-22T13:27:00.388543Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-22T13:27:03.641Z"}}], "cna": {"title": "net: Fix an unsafe loop on the list", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The attacker-controlled state is built exclusively through local AF_NETLINK/NETLINK_GENERIC sockets (bind() and setsockopt(NETLINK_ADD_MEMBERSHIP)), and the faulty loop lives in netlink table maintenance code. There is no remote, adjacent-network, or guest-to-host path into `__netlink_clear_multicast_users()`.\nAC:L - The attacker deterministically constructs the dangerous `mc_list` \u2014 many sockets subscribed to many genl multicast group ids, with subscription counts arranged so the loop body unlinks the element it is standing on \u2014 and no condition outside their influence (specific timing window, unpredictable memory layout, or victim process state) is needed for the walk to leave the list.\nPR:L - NETLINK_GENERIC is registered with NL_CFG_F_NONROOT_RECV, so `netlink_allowed()` lets any unprivileged user join genl multicast groups, and `genl_bind()`'s CAP_NET_ADMIN/CAP_SYS_ADMIN checks are `ns_capable(net->user_ns, \u2026)`, which a plain user satisfies via `unshare -Urn`; since `nl_table[].mc_list` is global and `genl_unregister_mc_groups()` sweeps every netns, sockets planted from an unprivileged namespace are walked by the buggy loop.\nUI:R - The unsafe loop only executes from `genl_unregister_family()`, which every in-tree caller reaches from a module exit or module-init failure path, so an administrator must unload/teardown the genl-providing module (rmmod, driver upgrade, udev-driven `modprobe -r`) after the attacker has planted the listeners.\nS:U - The stale list node, the netlink socket group bitmaps, and the corrupted slab memory all belong to the host kernel, the same security authority that is compromised. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The loop dereferences a list element already unlinked inside the body and reads through pointers taken from it (`test_bit(group - 1, nlk->groups)`), and the missing `ngroups` bound check \u2014 present in the sibling `netlink_update_listeners()` \u2014 makes that an out-of-bounds slab read at an attacker-chosen group index, a stale-object read primitive usable to disclose adjacent kernel heap contents.\nI:H - The same code path writes through the stale/undersized object \u2014 `__assign_bit(group - 1, nlk->groups, new)` and `nlk->subscriptions = subscriptions` \u2014 so once the freed or overrun slab region is groomed by the attacker this becomes an arbitrary-bit clear at an attacker-influenced address, plus corruption of the `mc_list` linkage itself, which is sufficient for control-flow hijacking.\nA:H - The committed reproduction is a hard kernel crash \u2014 \"Oops: Kernel access of bad area, sig: 11\" at `netlink_update_socket_mc+0x3c` under `__netlink_clear_multicast_users()` \u2014 and the corruption happens while `nl_table_lock` is held via `netlink_table_grab()` (`write_lock_irq`), so a mangled list also wedges the entire netlink subsystem."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "b8273570f802a7658827dcb077b0b517ba75a289", "lessThan": "464801a0f6ccb52b21faa33bac6014fd74cc5e10", "versionType": "git"}, {"status": "affected", "version": "b8273570f802a7658827dcb077b0b517ba75a289", "lessThan": "8e0766fcf37ad8eed289dd3853628dd9b01b58b0", "versionType": "git"}, {"status": "affected", "version": "b8273570f802a7658827dcb077b0b517ba75a289", "lessThan": "68ad5da6ca630a276f0a5c924179e57724d00013", "versionType": "git"}, {"status": "affected", "version": "b8273570f802a7658827dcb077b0b517ba75a289", "lessThan": "1cdec792b2450105b1314c5123a9a0452cb2c2f0", "versionType": "git"}, {"status": "affected", "version": "b8273570f802a7658827dcb077b0b517ba75a289", "lessThan": "5f03a7f601f33cda1f710611625235dc86fd8a9e", "versionType": "git"}, {"status": "affected", "version": "b8273570f802a7658827dcb077b0b517ba75a289", "lessThan": "3be342e0332a7c83eb26fbb22bf156fdca467a5d", "versionType": "git"}, {"status": "affected", "version": "b8273570f802a7658827dcb077b0b517ba75a289", "lessThan": "49f9b726bf2bf3dd2caf0d27cadf4bc1ccf7a7dd", "versionType": "git"}, {"status": "affected", "version": "b8273570f802a7658827dcb077b0b517ba75a289", "lessThan": "1dae9f1187189bc09ff6d25ca97ead711f7e26f9", "versionType": "git"}], "programFiles": ["include/net/sock.h", "net/netlink/af_netlink.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2.6.32"}, {"status": "unaffected", "version": "0", "lessThan": "2.6.32", "versionType": "semver"}, {"status": "unaffected", "version": "4.19.323", "versionType": "semver", "lessThanOrEqual": "4.19.*"}, {"status": "unaffected", "version": "5.4.285", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.227", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.168", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.113", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.57", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.11.4", "versionType": "semver", "lessThanOrEqual": "6.11.*"}, {"status": "unaffected", "version": "6.12", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["include/net/sock.h", "net/netlink/af_netlink.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/464801a0f6ccb52b21faa33bac6014fd74cc5e10"}, {"url": "https://git.kernel.org/stable/c/8e0766fcf37ad8eed289dd3853628dd9b01b58b0"}, {"url": "https://git.kernel.org/stable/c/68ad5da6ca630a276f0a5c924179e57724d00013"}, {"url": "https://git.kernel.org/stable/c/1cdec792b2450105b1314c5123a9a0452cb2c2f0"}, {"url": "https://git.kernel.org/stable/c/5f03a7f601f33cda1f710611625235dc86fd8a9e"}, {"url": "https://git.kernel.org/stable/c/3be342e0332a7c83eb26fbb22bf156fdca467a5d"}, {"url": "https://git.kernel.org/stable/c/49f9b726bf2bf3dd2caf0d27cadf4bc1ccf7a7dd"}, {"url": "https://git.kernel.org/stable/c/1dae9f1187189bc09ff6d25ca97ead711f7e26f9"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: Fix an unsafe loop on the list\n\nThe kernel may crash when deleting a genetlink family if there are still\nlisteners for that family:\n\nOops: Kernel access of bad area, sig: 11 [#1]\n ...\n NIP [c000000000c080bc] netlink_update_socket_mc+0x3c/0xc0\n LR [c000000000c0f764] __netlink_clear_multicast_users+0x74/0xc0\n Call Trace:\n__netlink_clear_multicast_users+0x74/0xc0\ngenl_unregister_family+0xd4/0x2d0\n\nChange the unsafe loop on the list to a safe one, because inside the\nloop there is an element removal from this list."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.19.323", "versionStartIncluding": "2.6.32"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.285", "versionStartIncluding": "2.6.32"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.227", "versionStartIncluding": "2.6.32"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.168", "versionStartIncluding": "2.6.32"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.113", "versionStartIncluding": "2.6.32"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.57", "versionStartIncluding": "2.6.32"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.11.4", "versionStartIncluding": "2.6.32"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12", "versionStartIncluding": "2.6.32"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:41:02.236Z"}}}, "cveMetadata": {"cveId": "CVE-2024-50024", "state": "PUBLISHED", "dateUpdated": "2026-08-05T11:41:02.236Z", "dateReserved": "2024-10-21T12:17:06.065Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-10-21T19:39:29.203Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["include/net/sock.h", "net/netlink/af_netlink.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "464801a0f6ccb52b21faa33bac6014fd74cc5e10", "status": "affected", "version": "b8273570f802a7658827dcb077b0b517ba75a289", "versionType": "git"}, {"lessThan": "8e0766fcf37ad8eed289dd3853628dd9b01b58b0", "status": "affected", "version": "b8273570f802a7658827dcb077b0b517ba75a289", "versionType": "git"}, {"lessThan": "68ad5da6ca630a276f0a5c924179e57724d00013", "status": "affected", "version": "b8273570f802a7658827dcb077b0b517ba75a289", "versionType": "git"}, {"lessThan": "1cdec792b2450105b1314c5123a9a0452cb2c2f0", "status": "affected", "version": "b8273570f802a7658827dcb077b0b517ba75a289", "versionType": "git"}, {"lessThan": "5f03a7f601f33cda1f710611625235dc86fd8a9e", "status": "affected", "version": "b8273570f802a7658827dcb077b0b517ba75a289", "versionType": "git"}, {"lessThan": "3be342e0332a7c83eb26fbb22bf156fdca467a5d", "status": "affected", "version": "b8273570f802a7658827dcb077b0b517ba75a289", "versionType": "git"}, {"lessThan": "49f9b726bf2bf3dd2caf0d27cadf4bc1ccf7a7dd", "status": "affected", "version": "b8273570f802a7658827dcb077b0b517ba75a289", "versionType": "git"}, {"lessThan": "1dae9f1187189bc09ff6d25ca97ead711f7e26f9", "status": "affected", "version": "b8273570f802a7658827dcb077b0b517ba75a289", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["include/net/sock.h", "net/netlink/af_netlink.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.32"}, {"lessThan": "2.6.32", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.323", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.285", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.227", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.168", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.113", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.57", "versionType": "semver"}, {"lessThanOrEqual": "6.11.*", "status": "unaffected", "version": "6.11.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.12", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "BF903132-A3AF-4A91-AFA9-3C8A9C378FAE", "versionEndExcluding": "5.10.227", "versionStartIncluding": "2.6.32", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "4D51C05D-455B-4D8D-89E7-A58E140B864C", "versionEndExcluding": "5.15.168", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D01BD22E-ACD1-4618-9D01-6116570BE1EE", "versionEndExcluding": "6.1.113", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "05D83DB8-7465-4F88-AFB2-980011992AC1", "versionEndExcluding": "6.6.57", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "AA84D336-CE9A-4535-B901-1AD77EC17C34", "versionEndExcluding": "6.11.4", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*", "matchCriteriaId": "7F361E1D-580F-4A2D-A509-7615F73167A1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*", "matchCriteriaId": "925478D0-3E3D-4E6F-ACD5-09F28D5DF82C", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: Fix an unsafe loop on the list\n\nThe kernel may crash when deleting a genetlink family if there are still\nlisteners for that family:\n\nOops: Kernel access of bad area, sig: 11 [#1]\n ...\n NIP [c000000000c080bc] netlink_update_socket_mc+0x3c/0xc0\n LR [c000000000c0f764] __netlink_clear_multicast_users+0x74/0xc0\n Call Trace:\n__netlink_clear_multicast_users+0x74/0xc0\ngenl_unregister_family+0xd4/0x2d0\n\nChange the unsafe loop on the list to a safe one, because inside the\nloop there is an element removal from this list."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: Corrige un bucle inseguro en la lista El kernel puede bloquearse al eliminar una familia genetlink si a\u00fan hay oyentes para esa familia: Oops: Acceso al kernel al \u00e1rea incorrecta, sig: 11 [#1] ... NIP [c000000000c080bc] netlink_update_socket_mc+0x3c/0xc0 LR [c000000000c0f764] __netlink_clear_multicast_users+0x74/0xc0 Rastreo de llamadas: __netlink_clear_multicast_users+0x74/0xc0 genl_unregister_family+0xd4/0x2d0 Cambia el bucle inseguro en la lista a uno seguro, porque dentro del bucle hay una eliminaci\u00f3n de elementos de esta lista."}], "id": "CVE-2024-50024", "lastModified": "2026-08-04T11:21:08.313", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-50024", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-10-22T13:27:00.388543Z", "version": "2.0.3"}}]}, "published": "2024-10-21T20:15:15.850", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1cdec792b2450105b1314c5123a9a0452cb2c2f0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1dae9f1187189bc09ff6d25ca97ead711f7e26f9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3be342e0332a7c83eb26fbb22bf156fdca467a5d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/464801a0f6ccb52b21faa33bac6014fd74cc5e10"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/49f9b726bf2bf3dd2caf0d27cadf4bc1ccf7a7dd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5f03a7f601f33cda1f710611625235dc86fd8a9e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/68ad5da6ca630a276f0a5c924179e57724d00013"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8e0766fcf37ad8eed289dd3853628dd9b01b58b0"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2025:6966", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-570.12.1.el9_6", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2025-05-13T00:00:00Z"}, {"advisory": "RHSA-2025:6966", "cpe": "cpe:/o:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-570.12.1.el9_6", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2025-05-13T00:00:00Z"}], "bugzilla": {"description": "kernel: net: Fix an unsafe loop on the list", "id": "2320611", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2320611"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.7", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "verified"}, "cwe": "CWE-404", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet: Fix an unsafe loop on the list\nThe kernel may crash when deleting a genetlink family if there are still\nlisteners for that family:\nOops: Kernel access of bad area, sig: 11 [#1]\n...\nNIP [c000000000c080bc] netlink_update_socket_mc+0x3c/0xc0\nLR [c000000000c0f764] __netlink_clear_multicast_users+0x74/0xc0\nCall Trace:\n__netlink_clear_multicast_users+0x74/0xc0\ngenl_unregister_family+0xd4/0x2d0\nChange the unsafe loop on the list to a safe one, because inside the\nloop there is an element removal from this list."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2024-50024", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Will not fix", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Will not fix", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-10-21T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-50024\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-50024\nhttps://lore.kernel.org/linux-cve-announce/2024102129-CVE-2024-50024-a052@gregkh/T"], "statement": "The bug happens during unregister or disconnection of local listeners. It would be complex to trigger it or it requires privileges of the user.", "threat_severity": "Moderate"}

{}