CVE-2024-56650

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-56650", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-12-27T15:00:39.840Z", "datePublished": "2024-12-27T15:02:50.098Z", "dateUpdated": "2026-10-15T01:00:07.163Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:45:47.823Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: x_tables: fix LED ID check in led_tg_check()\n\nSyzbot has reported the following BUG detected by KASAN:\n\nBUG: KASAN: slab-out-of-bounds in strlen+0x58/0x70\nRead of size 1 at addr ffff8881022da0c8 by task repro/5879\n...\nCall Trace:\n <TASK>\n dump_stack_lvl+0x241/0x360\n ? __pfx_dump_stack_lvl+0x10/0x10\n ? __pfx__printk+0x10/0x10\n ? _printk+0xd5/0x120\n ? __virt_addr_valid+0x183/0x530\n ? __virt_addr_valid+0x183/0x530\n print_report+0x169/0x550\n ? __virt_addr_valid+0x183/0x530\n ? __virt_addr_valid+0x183/0x530\n ? __virt_addr_valid+0x45f/0x530\n ? __phys_addr+0xba/0x170\n ? strlen+0x58/0x70\n kasan_report+0x143/0x180\n ? strlen+0x58/0x70\n strlen+0x58/0x70\n kstrdup+0x20/0x80\n led_tg_check+0x18b/0x3c0\n xt_check_target+0x3bb/0xa40\n ? __pfx_xt_check_target+0x10/0x10\n ? stack_depot_save_flags+0x6e4/0x830\n ? nft_target_init+0x174/0xc30\n nft_target_init+0x82d/0xc30\n ? __pfx_nft_target_init+0x10/0x10\n ? nf_tables_newrule+0x1609/0x2980\n ? nf_tables_newrule+0x1609/0x2980\n ? rcu_is_watching+0x15/0xb0\n ? nf_tables_newrule+0x1609/0x2980\n ? nf_tables_newrule+0x1609/0x2980\n ? __kmalloc_noprof+0x21a/0x400\n nf_tables_newrule+0x1860/0x2980\n ? __pfx_nf_tables_newrule+0x10/0x10\n ? __nla_parse+0x40/0x60\n nfnetlink_rcv+0x14e5/0x2ab0\n ? __pfx_validate_chain+0x10/0x10\n ? __pfx_nfnetlink_rcv+0x10/0x10\n ? __lock_acquire+0x1384/0x2050\n ? netlink_deliver_tap+0x2e/0x1b0\n ? __pfx_lock_release+0x10/0x10\n ? netlink_deliver_tap+0x2e/0x1b0\n netlink_unicast+0x7f8/0x990\n ? __pfx_netlink_unicast+0x10/0x10\n ? __virt_addr_valid+0x183/0x530\n ? __check_object_size+0x48e/0x900\n netlink_sendmsg+0x8e4/0xcb0\n ? __pfx_netlink_sendmsg+0x10/0x10\n ? aa_sock_msg_perm+0x91/0x160\n ? __pfx_netlink_sendmsg+0x10/0x10\n __sock_sendmsg+0x223/0x270\n ____sys_sendmsg+0x52a/0x7e0\n ? __pfx_____sys_sendmsg+0x10/0x10\n __sys_sendmsg+0x292/0x380\n ? __pfx___sys_sendmsg+0x10/0x10\n ? lockdep_hardirqs_on_prepare+0x43d/0x780\n ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10\n ? exc_page_fault+0x590/0x8c0\n ? do_syscall_64+0xb6/0x230\n do_syscall_64+0xf3/0x230\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n...\n </TASK>\n\nSince an invalid (without '\\0' byte at all) byte sequence may be passed\nfrom userspace, add an extra check to ensure that such a sequence is\nrejected as possible ID and so never passed to 'kstrdup()' and further."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable path is entered only through local syscalls \u2014 `sendmsg()` on a NETLINK_NETFILTER socket (nf_tables/nft_compat) or `setsockopt(IPT_SO_SET_REPLACE)` on the legacy iptables interface. No remote peer can supply the malformed `xt_led_info` blob.\nAC:L - The attacker fully controls all 40 bytes of the target info blob and simply omits any NUL byte, making `strlen()` read out of bounds deterministically on every attempt; there is no race, no memory-layout precondition, and the required xt_LED module is present in stock distro and embedded kernel configs.\nPR:L - `nf_tables_newrule` requires CAP_NET_ADMIN only in the network namespace's owning user namespace, which any unprivileged user obtains with `unshare -Urn` \u2014 exactly how the syzbot reproducer reached it.\nUI:N - The attacker performs the entire sequence \u2014 create netns, add an nftables rule with an xt LED target \u2014 with no action by any other user, and reads the leaked bytes back from sysfs itself.\nS:U - The out-of-bounds read stays within the kernel's own heap and the disclosed data is exposed through kernel-managed interfaces; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is an unbounded slab out-of-bounds read whose contents are not merely touched but `kstrdup()`'d into a globally registered LED trigger name, then printed into the world-readable (0644) `/sys/class/leds/*/trigger` file, plus an `-EEXIST` collision oracle from `led_trigger_register()` \u2014 giving an unprivileged user a practical adjacent-kernel-heap disclosure primitive that can leak pointers and defeat KASLR/heap-layout hardening.\nI:N - `kstrdup()` allocates exactly `strlen()+1` bytes and the sysfs printer clamps with `vscnprintf`, so no memory is written out of bounds and no kernel data structure is corrupted by the flaw.\nA:H - The `strlen()` walk continues until it happens to find a zero byte and can fault on a KFENCE guard page \u2014 enabled by default in production distro and Android kernels \u2014 or run past mapped memory, oopsing the kernel; on KASAN builds it panics outright, and the attacker can repeat the attempt arbitrarily."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/netfilter/xt_LED.c"], "versions": [{"version": "268cb38e1802db560c73167e643f14a3dcb4b07c", "lessThan": "147a42bb02de8735cb08476be6d0917987d022c2", "status": "affected", "versionType": "git"}, {"version": "268cb38e1802db560c73167e643f14a3dcb4b07c", "lessThan": "ad28612ebae1fcc1104bd432e99e99d87f6bfe09", "status": "affected", "versionType": "git"}, {"version": "268cb38e1802db560c73167e643f14a3dcb4b07c", "lessThan": "36a9d94dac28beef6b8abba46ba8874320d3e800", "status": "affected", "versionType": "git"}, {"version": "268cb38e1802db560c73167e643f14a3dcb4b07c", "lessThan": "ab9916321c95f5280b72b4c5055e269f98627efe", "status": "affected", "versionType": "git"}, {"version": "268cb38e1802db560c73167e643f14a3dcb4b07c", "lessThan": "a9bcc0b70d9baf3ff005874489a0dc9d023b54c3", "status": "affected", "versionType": "git"}, {"version": "268cb38e1802db560c73167e643f14a3dcb4b07c", "lessThan": "c40c96d98e536fc1daaa125c2332b988615e30a4", "status": "affected", "versionType": "git"}, {"version": "268cb38e1802db560c73167e643f14a3dcb4b07c", "lessThan": "04317f4eb2aad312ad85c1a17ad81fe75f1f9bc7", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/netfilter/xt_LED.c"], "versions": [{"version": "2.6.30", "status": "affected"}, {"version": "0", "lessThan": "2.6.30", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.287", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.231", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.174", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.120", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.66", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.5", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.13", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "5.4.287"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "5.10.231"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "5.15.174"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "6.1.120"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "6.6.66"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "6.12.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "6.13"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/147a42bb02de8735cb08476be6d0917987d022c2"}, {"url": "https://git.kernel.org/stable/c/ad28612ebae1fcc1104bd432e99e99d87f6bfe09"}, {"url": "https://git.kernel.org/stable/c/36a9d94dac28beef6b8abba46ba8874320d3e800"}, {"url": "https://git.kernel.org/stable/c/ab9916321c95f5280b72b4c5055e269f98627efe"}, {"url": "https://git.kernel.org/stable/c/a9bcc0b70d9baf3ff005874489a0dc9d023b54c3"}, {"url": "https://git.kernel.org/stable/c/c40c96d98e536fc1daaa125c2332b988615e30a4"}, {"url": "https://git.kernel.org/stable/c/04317f4eb2aad312ad85c1a17ad81fe75f1f9bc7"}], "title": "netfilter: x_tables: fix LED ID check in led_tg_check()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-56650", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-01T20:00:22.683789Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-01T20:07:11.150Z"}}, {"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T20:51:56.813Z"}}, {"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T01:00:07.163Z"}, "affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.0", "lessThan": "V3.1.5", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.0", "lessThan": "V3.1.5", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.0", "lessThan": "V3.1.5", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.0", "lessThan": "V3.1.5", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.0", "lessThan": "V3.1.5", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "RUGGEDCOM RST2428P", "versions": [{"status": "affected", "version": "0", "lessThan": "V3.2", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family", "versions": [{"status": "affected", "version": "0", "lessThan": "V3.2", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SCALANCE XCM-/XRM-/XCH-/XRH-300 family", "versions": [{"status": "affected", "version": "0", "lessThan": "V3.2", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-398330.html"}, {"url": "https://cert-portal.siemens.com/productcert/html/ssa-355557.html"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T20:51:56.813Z"}}, {"affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.0", "lessThan": "V3.1.5", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.0", "lessThan": "V3.1.5", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.0", "lessThan": "V3.1.5", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.0", "lessThan": "V3.1.5", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.0", "lessThan": "V3.1.5", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "RUGGEDCOM RST2428P", "versions": [{"status": "affected", "version": "0", "lessThan": "V3.2", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family", "versions": [{"status": "affected", "version": "0", "lessThan": "V3.2", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SCALANCE XCM-/XRM-/XCH-/XRH-300 family", "versions": [{"status": "affected", "version": "0", "lessThan": "V3.2", "versionType": "custom"}], "defaultStatus": "unknown"}], "x_adpType": "supplier", "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-398330.html"}, {"url": "https://cert-portal.siemens.com/productcert/html/ssa-355557.html"}], "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T01:00:07.163Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-56650", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-01T20:00:22.683789Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-01T15:44:39.351Z"}}], "cna": {"title": "netfilter: x_tables: fix LED ID check in led_tg_check()", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable path is entered only through local syscalls \u2014 `sendmsg()` on a NETLINK_NETFILTER socket (nf_tables/nft_compat) or `setsockopt(IPT_SO_SET_REPLACE)` on the legacy iptables interface. No remote peer can supply the malformed `xt_led_info` blob.\nAC:L - The attacker fully controls all 40 bytes of the target info blob and simply omits any NUL byte, making `strlen()` read out of bounds deterministically on every attempt; there is no race, no memory-layout precondition, and the required xt_LED module is present in stock distro and embedded kernel configs.\nPR:L - `nf_tables_newrule` requires CAP_NET_ADMIN only in the network namespace's owning user namespace, which any unprivileged user obtains with `unshare -Urn` \u2014 exactly how the syzbot reproducer reached it.\nUI:N - The attacker performs the entire sequence \u2014 create netns, add an nftables rule with an xt LED target \u2014 with no action by any other user, and reads the leaked bytes back from sysfs itself.\nS:U - The out-of-bounds read stays within the kernel's own heap and the disclosed data is exposed through kernel-managed interfaces; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is an unbounded slab out-of-bounds read whose contents are not merely touched but `kstrdup()`'d into a globally registered LED trigger name, then printed into the world-readable (0644) `/sys/class/leds/*/trigger` file, plus an `-EEXIST` collision oracle from `led_trigger_register()` \u2014 giving an unprivileged user a practical adjacent-kernel-heap disclosure primitive that can leak pointers and defeat KASLR/heap-layout hardening.\nI:N - `kstrdup()` allocates exactly `strlen()+1` bytes and the sysfs printer clamps with `vscnprintf`, so no memory is written out of bounds and no kernel data structure is corrupted by the flaw.\nA:H - The `strlen()` walk continues until it happens to find a zero byte and can fault on a KFENCE guard page \u2014 enabled by default in production distro and Android kernels \u2014 or run past mapped memory, oopsing the kernel; on KASAN builds it panics outright, and the attacker can repeat the attempt arbitrarily."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "268cb38e1802db560c73167e643f14a3dcb4b07c", "lessThan": "147a42bb02de8735cb08476be6d0917987d022c2", "versionType": "git"}, {"status": "affected", "version": "268cb38e1802db560c73167e643f14a3dcb4b07c", "lessThan": "ad28612ebae1fcc1104bd432e99e99d87f6bfe09", "versionType": "git"}, {"status": "affected", "version": "268cb38e1802db560c73167e643f14a3dcb4b07c", "lessThan": "36a9d94dac28beef6b8abba46ba8874320d3e800", "versionType": "git"}, {"status": "affected", "version": "268cb38e1802db560c73167e643f14a3dcb4b07c", "lessThan": "ab9916321c95f5280b72b4c5055e269f98627efe", "versionType": "git"}, {"status": "affected", "version": "268cb38e1802db560c73167e643f14a3dcb4b07c", "lessThan": "a9bcc0b70d9baf3ff005874489a0dc9d023b54c3", "versionType": "git"}, {"status": "affected", "version": "268cb38e1802db560c73167e643f14a3dcb4b07c", "lessThan": "c40c96d98e536fc1daaa125c2332b988615e30a4", "versionType": "git"}, {"status": "affected", "version": "268cb38e1802db560c73167e643f14a3dcb4b07c", "lessThan": "04317f4eb2aad312ad85c1a17ad81fe75f1f9bc7", "versionType": "git"}], "programFiles": ["net/netfilter/xt_LED.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2.6.30"}, {"status": "unaffected", "version": "0", "lessThan": "2.6.30", "versionType": "semver"}, {"status": "unaffected", "version": "5.4.287", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.231", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.174", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.120", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.66", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.5", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.13", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/netfilter/xt_LED.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/147a42bb02de8735cb08476be6d0917987d022c2"}, {"url": "https://git.kernel.org/stable/c/ad28612ebae1fcc1104bd432e99e99d87f6bfe09"}, {"url": "https://git.kernel.org/stable/c/36a9d94dac28beef6b8abba46ba8874320d3e800"}, {"url": "https://git.kernel.org/stable/c/ab9916321c95f5280b72b4c5055e269f98627efe"}, {"url": "https://git.kernel.org/stable/c/a9bcc0b70d9baf3ff005874489a0dc9d023b54c3"}, {"url": "https://git.kernel.org/stable/c/c40c96d98e536fc1daaa125c2332b988615e30a4"}, {"url": "https://git.kernel.org/stable/c/04317f4eb2aad312ad85c1a17ad81fe75f1f9bc7"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: x_tables: fix LED ID check in led_tg_check()\n\nSyzbot has reported the following BUG detected by KASAN:\n\nBUG: KASAN: slab-out-of-bounds in strlen+0x58/0x70\nRead of size 1 at addr ffff8881022da0c8 by task repro/5879\n...\nCall Trace:\n <TASK>\n dump_stack_lvl+0x241/0x360\n ? __pfx_dump_stack_lvl+0x10/0x10\n ? __pfx__printk+0x10/0x10\n ? _printk+0xd5/0x120\n ? __virt_addr_valid+0x183/0x530\n ? __virt_addr_valid+0x183/0x530\n print_report+0x169/0x550\n ? __virt_addr_valid+0x183/0x530\n ? __virt_addr_valid+0x183/0x530\n ? __virt_addr_valid+0x45f/0x530\n ? __phys_addr+0xba/0x170\n ? strlen+0x58/0x70\n kasan_report+0x143/0x180\n ? strlen+0x58/0x70\n strlen+0x58/0x70\n kstrdup+0x20/0x80\n led_tg_check+0x18b/0x3c0\n xt_check_target+0x3bb/0xa40\n ? __pfx_xt_check_target+0x10/0x10\n ? stack_depot_save_flags+0x6e4/0x830\n ? nft_target_init+0x174/0xc30\n nft_target_init+0x82d/0xc30\n ? __pfx_nft_target_init+0x10/0x10\n ? nf_tables_newrule+0x1609/0x2980\n ? nf_tables_newrule+0x1609/0x2980\n ? rcu_is_watching+0x15/0xb0\n ? nf_tables_newrule+0x1609/0x2980\n ? nf_tables_newrule+0x1609/0x2980\n ? __kmalloc_noprof+0x21a/0x400\n nf_tables_newrule+0x1860/0x2980\n ? __pfx_nf_tables_newrule+0x10/0x10\n ? __nla_parse+0x40/0x60\n nfnetlink_rcv+0x14e5/0x2ab0\n ? __pfx_validate_chain+0x10/0x10\n ? __pfx_nfnetlink_rcv+0x10/0x10\n ? __lock_acquire+0x1384/0x2050\n ? netlink_deliver_tap+0x2e/0x1b0\n ? __pfx_lock_release+0x10/0x10\n ? netlink_deliver_tap+0x2e/0x1b0\n netlink_unicast+0x7f8/0x990\n ? __pfx_netlink_unicast+0x10/0x10\n ? __virt_addr_valid+0x183/0x530\n ? __check_object_size+0x48e/0x900\n netlink_sendmsg+0x8e4/0xcb0\n ? __pfx_netlink_sendmsg+0x10/0x10\n ? aa_sock_msg_perm+0x91/0x160\n ? __pfx_netlink_sendmsg+0x10/0x10\n __sock_sendmsg+0x223/0x270\n ____sys_sendmsg+0x52a/0x7e0\n ? __pfx_____sys_sendmsg+0x10/0x10\n __sys_sendmsg+0x292/0x380\n ? __pfx___sys_sendmsg+0x10/0x10\n ? lockdep_hardirqs_on_prepare+0x43d/0x780\n ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10\n ? exc_page_fault+0x590/0x8c0\n ? do_syscall_64+0xb6/0x230\n do_syscall_64+0xf3/0x230\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n...\n </TASK>\n\nSince an invalid (without '\\0' byte at all) byte sequence may be passed\nfrom userspace, add an extra check to ensure that such a sequence is\nrejected as possible ID and so never passed to 'kstrdup()' and further."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.287", "versionStartIncluding": "2.6.30"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.231", "versionStartIncluding": "2.6.30"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.174", "versionStartIncluding": "2.6.30"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.120", "versionStartIncluding": "2.6.30"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.66", "versionStartIncluding": "2.6.30"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.5", "versionStartIncluding": "2.6.30"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.13", "versionStartIncluding": "2.6.30"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:45:47.823Z"}}}, "cveMetadata": {"cveId": "CVE-2024-56650", "state": "PUBLISHED", "dateUpdated": "2026-10-15T01:00:07.163Z", "dateReserved": "2024-12-27T15:00:39.840Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-12-27T15:02:50.098Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/netfilter/xt_LED.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "147a42bb02de8735cb08476be6d0917987d022c2", "status": "affected", "version": "268cb38e1802db560c73167e643f14a3dcb4b07c", "versionType": "git"}, {"lessThan": "ad28612ebae1fcc1104bd432e99e99d87f6bfe09", "status": "affected", "version": "268cb38e1802db560c73167e643f14a3dcb4b07c", "versionType": "git"}, {"lessThan": "36a9d94dac28beef6b8abba46ba8874320d3e800", "status": "affected", "version": "268cb38e1802db560c73167e643f14a3dcb4b07c", "versionType": "git"}, {"lessThan": "ab9916321c95f5280b72b4c5055e269f98627efe", "status": "affected", "version": "268cb38e1802db560c73167e643f14a3dcb4b07c", "versionType": "git"}, {"lessThan": "a9bcc0b70d9baf3ff005874489a0dc9d023b54c3", "status": "affected", "version": "268cb38e1802db560c73167e643f14a3dcb4b07c", "versionType": "git"}, {"lessThan": "c40c96d98e536fc1daaa125c2332b988615e30a4", "status": "affected", "version": "268cb38e1802db560c73167e643f14a3dcb4b07c", "versionType": "git"}, {"lessThan": "04317f4eb2aad312ad85c1a17ad81fe75f1f9bc7", "status": "affected", "version": "268cb38e1802db560c73167e643f14a3dcb4b07c", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/netfilter/xt_LED.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.30"}, {"lessThan": "2.6.30", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.287", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.231", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.174", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.120", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.66", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.13", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "vendor": "Siemens", "versions": [{"lessThan": "V3.1.5", "status": "affected", "version": "V3.1.0", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "vendor": "Siemens", "versions": [{"lessThan": "V3.1.5", "status": "affected", "version": "V3.1.0", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "vendor": "Siemens", "versions": [{"lessThan": "V3.1.5", "status": "affected", "version": "V3.1.0", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "vendor": "Siemens", "versions": [{"lessThan": "V3.1.5", "status": "affected", "version": "V3.1.0", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP", "vendor": "Siemens", "versions": [{"lessThan": "V3.1.5", "status": "affected", "version": "V3.1.0", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "RUGGEDCOM RST2428P", "vendor": "Siemens", "versions": [{"lessThan": "V3.2", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family", "vendor": "Siemens", "versions": [{"lessThan": "V3.2", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SCALANCE XCM-/XRM-/XCH-/XRH-300 family", "vendor": "Siemens", "versions": [{"lessThan": "V3.2", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "2D46A016-4FC6-416B-92D5-0A3833B3F57C", "versionEndExcluding": "5.4.287", "versionStartIncluding": "2.6.30", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "B5C644CC-2BD7-4E32-BC54-8DCC7ABE9935", "versionEndExcluding": "5.10.231", "versionStartIncluding": "5.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "419FD073-1517-4FD5-8158-F94BC68A1E89", "versionEndExcluding": "5.15.174", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "09AC6122-E2A4-40FE-9D33-268A1B2EC265", "versionEndExcluding": "6.1.120", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "29A976AD-B9AB-4A95-9F08-7669F8847EB9", "versionEndExcluding": "6.6.66", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9501D045-7A94-42CA-8B03-821BE94A65B7", "versionEndExcluding": "6.12.5", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*", "matchCriteriaId": "62567B3C-6CEE-46D0-BC2E-B3717FBF7D13", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: x_tables: fix LED ID check in led_tg_check()\n\nSyzbot has reported the following BUG detected by KASAN:\n\nBUG: KASAN: slab-out-of-bounds in strlen+0x58/0x70\nRead of size 1 at addr ffff8881022da0c8 by task repro/5879\n...\nCall Trace:\n <TASK>\n dump_stack_lvl+0x241/0x360\n ? __pfx_dump_stack_lvl+0x10/0x10\n ? __pfx__printk+0x10/0x10\n ? _printk+0xd5/0x120\n ? __virt_addr_valid+0x183/0x530\n ? __virt_addr_valid+0x183/0x530\n print_report+0x169/0x550\n ? __virt_addr_valid+0x183/0x530\n ? __virt_addr_valid+0x183/0x530\n ? __virt_addr_valid+0x45f/0x530\n ? __phys_addr+0xba/0x170\n ? strlen+0x58/0x70\n kasan_report+0x143/0x180\n ? strlen+0x58/0x70\n strlen+0x58/0x70\n kstrdup+0x20/0x80\n led_tg_check+0x18b/0x3c0\n xt_check_target+0x3bb/0xa40\n ? __pfx_xt_check_target+0x10/0x10\n ? stack_depot_save_flags+0x6e4/0x830\n ? nft_target_init+0x174/0xc30\n nft_target_init+0x82d/0xc30\n ? __pfx_nft_target_init+0x10/0x10\n ? nf_tables_newrule+0x1609/0x2980\n ? nf_tables_newrule+0x1609/0x2980\n ? rcu_is_watching+0x15/0xb0\n ? nf_tables_newrule+0x1609/0x2980\n ? nf_tables_newrule+0x1609/0x2980\n ? __kmalloc_noprof+0x21a/0x400\n nf_tables_newrule+0x1860/0x2980\n ? __pfx_nf_tables_newrule+0x10/0x10\n ? __nla_parse+0x40/0x60\n nfnetlink_rcv+0x14e5/0x2ab0\n ? __pfx_validate_chain+0x10/0x10\n ? __pfx_nfnetlink_rcv+0x10/0x10\n ? __lock_acquire+0x1384/0x2050\n ? netlink_deliver_tap+0x2e/0x1b0\n ? __pfx_lock_release+0x10/0x10\n ? netlink_deliver_tap+0x2e/0x1b0\n netlink_unicast+0x7f8/0x990\n ? __pfx_netlink_unicast+0x10/0x10\n ? __virt_addr_valid+0x183/0x530\n ? __check_object_size+0x48e/0x900\n netlink_sendmsg+0x8e4/0xcb0\n ? __pfx_netlink_sendmsg+0x10/0x10\n ? aa_sock_msg_perm+0x91/0x160\n ? __pfx_netlink_sendmsg+0x10/0x10\n __sock_sendmsg+0x223/0x270\n ____sys_sendmsg+0x52a/0x7e0\n ? __pfx_____sys_sendmsg+0x10/0x10\n __sys_sendmsg+0x292/0x380\n ? __pfx___sys_sendmsg+0x10/0x10\n ? lockdep_hardirqs_on_prepare+0x43d/0x780\n ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10\n ? exc_page_fault+0x590/0x8c0\n ? do_syscall_64+0xb6/0x230\n do_syscall_64+0xf3/0x230\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n...\n </TASK>\n\nSince an invalid (without '\\0' byte at all) byte sequence may be passed\nfrom userspace, add an extra check to ensure that such a sequence is\nrejected as possible ID and so never passed to 'kstrdup()' and further."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: netfilter: x_tables: correcci\u00f3n de la comprobaci\u00f3n del ID del LED en led_tg_check() Syzbot ha informado del siguiente ERROR detectado por KASAN: ERROR: KASAN: slab-out-of-bounds en strlen+0x58/0x70 Lectura de tama\u00f1o 1 en la direcci\u00f3n ffff8881022da0c8 por la tarea repro/5879 ... Seguimiento de llamadas: dump_stack_lvl+0x241/0x360 ? __pfx_dump_stack_lvl+0x10/0x10 ? __pfx__printk+0x10/0x10 ? _printk+0xd5/0x120 ? __virt_addr_valid+0x183/0x530 ? __virt_addr_valid+0x183/0x530 imprimir_informe+0x169/0x550 ? __virt_addr_valid+0x183/0x530 ? __virt_addr_valid+0x183/0x530 ? __virt_addr_valid+0x45f/0x530 ? __phys_addr+0xba/0x170 ? strlen+0x58/0x70 kasan_informe+0x143/0x180 ? strlen+0x58/0x70 strlen+0x58/0x70 kstrdup+0x20/0x80 led_tg_check+0x18b/0x3c0 xt_check_target+0x3bb/0xa40 ? __pfx_xt_check_target+0x10/0x10 ? stack_depot_save_flags+0x6e4/0x830 ? nft_target_init+0x174/0xc30 nft_target_init+0x82d/0xc30 ? __pfx_nft_target_init+0x10/0x10 ? nf_tables_newrule+0x1609/0x2980 ? nf_tables_newrule+0x1609/0x2980 ? rcu_is_watching+0x15/0xb0 ? nf_tables_newrule+0x1609/0x2980 ? nf_tables_newrule+0x1609/0x2980 ? __kmalloc_noprof+0x21a/0x400 nf_tables_newrule+0x1860/0x2980 ? __pfx_nf_tables_newrule+0x10/0x10 ? __nla_parse+0x40/0x60 nfnetlink_rcv+0x14e5/0x2ab0 ? __pfx_validate_chain+0x10/0x10 ? __pfx_nfnetlink_rcv+0x10/0x10 ? __lock_acquire+0x1384/0x2050 ? netlink_deliver_tap+0x2e/0x1b0 ? __pfx_lock_release+0x10/0x10 ? aa_sock_msg_perm+0x91/0x160 ? __pfx_netlink_sendmsg+0x10/0x10 __sock_sendmsg+0x223/0x270 ____sys_sendmsg+0x52a/0x7e0 ? exc_page_fault+0x590/0x8c0 ? Dado que una secuencia de bytes no v\u00e1lida (sin el byte '\\0' en absoluto) puede pasarse desde el espacio de usuario, agregue una verificaci\u00f3n adicional para garantizar que dicha secuencia se rechace como posible ID y, por lo tanto, nunca se pase a 'kstrdup()' ni a nada m\u00e1s."}], "id": "CVE-2024-56650", "lastModified": "2026-10-15T02:17:08.870", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.2, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-56650", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-01T20:00:22.683789Z", "version": "2.0.3"}}]}, "published": "2024-12-27T15:15:24.783", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/04317f4eb2aad312ad85c1a17ad81fe75f1f9bc7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/147a42bb02de8735cb08476be6d0917987d022c2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/36a9d94dac28beef6b8abba46ba8874320d3e800"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a9bcc0b70d9baf3ff005874489a0dc9d023b54c3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ab9916321c95f5280b72b4c5055e269f98627efe"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ad28612ebae1fcc1104bd432e99e99d87f6bfe09"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c40c96d98e536fc1daaa125c2332b988615e30a4"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-355557.html"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-398330.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-125"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: netfilter: x_tables: fix LED ID check in led_tg_check()", "id": "2334554", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2334554"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnetfilter: x_tables: fix LED ID check in led_tg_check()\nSyzbot has reported the following BUG detected by KASAN:\nBUG: KASAN: slab-out-of-bounds in strlen+0x58/0x70\nRead of size 1 at addr ffff8881022da0c8 by task repro/5879\n...\nCall Trace:\n<TASK>\ndump_stack_lvl+0x241/0x360\n? __pfx_dump_stack_lvl+0x10/0x10\n? __pfx__printk+0x10/0x10\n? _printk+0xd5/0x120\n? __virt_addr_valid+0x183/0x530\n? __virt_addr_valid+0x183/0x530\nprint_report+0x169/0x550\n? __virt_addr_valid+0x183/0x530\n? __virt_addr_valid+0x183/0x530\n? __virt_addr_valid+0x45f/0x530\n? __phys_addr+0xba/0x170\n? strlen+0x58/0x70\nkasan_report+0x143/0x180\n? strlen+0x58/0x70\nstrlen+0x58/0x70\nkstrdup+0x20/0x80\nled_tg_check+0x18b/0x3c0\nxt_check_target+0x3bb/0xa40\n? __pfx_xt_check_target+0x10/0x10\n? stack_depot_save_flags+0x6e4/0x830\n? nft_target_init+0x174/0xc30\nnft_target_init+0x82d/0xc30\n? __pfx_nft_target_init+0x10/0x10\n? nf_tables_newrule+0x1609/0x2980\n? nf_tables_newrule+0x1609/0x2980\n? rcu_is_watching+0x15/0xb0\n? nf_tables_newrule+0x1609/0x2980\n? nf_tables_newrule+0x1609/0x2980\n? __kmalloc_noprof+0x21a/0x400\nnf_tables_newrule+0x1860/0x2980\n? __pfx_nf_tables_newrule+0x10/0x10\n? __nla_parse+0x40/0x60\nnfnetlink_rcv+0x14e5/0x2ab0\n? __pfx_validate_chain+0x10/0x10\n? __pfx_nfnetlink_rcv+0x10/0x10\n? __lock_acquire+0x1384/0x2050\n? netlink_deliver_tap+0x2e/0x1b0\n? __pfx_lock_release+0x10/0x10\n? netlink_deliver_tap+0x2e/0x1b0\nnetlink_unicast+0x7f8/0x990\n? __pfx_netlink_unicast+0x10/0x10\n? __virt_addr_valid+0x183/0x530\n? __check_object_size+0x48e/0x900\nnetlink_sendmsg+0x8e4/0xcb0\n? __pfx_netlink_sendmsg+0x10/0x10\n? aa_sock_msg_perm+0x91/0x160\n? __pfx_netlink_sendmsg+0x10/0x10\n__sock_sendmsg+0x223/0x270\n____sys_sendmsg+0x52a/0x7e0\n? __pfx_____sys_sendmsg+0x10/0x10\n__sys_sendmsg+0x292/0x380\n? __pfx___sys_sendmsg+0x10/0x10\n? lockdep_hardirqs_on_prepare+0x43d/0x780\n? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10\n? exc_page_fault+0x590/0x8c0\n? do_syscall_64+0xb6/0x230\ndo_syscall_64+0xf3/0x230\nentry_SYSCALL_64_after_hwframe+0x77/0x7f\n...\n</TASK>\nSince an invalid (without '\\0' byte at all) byte sequence may be passed\nfrom userspace, add an extra check to ensure that such a sequence is\nrejected as possible ID and so never passed to 'kstrdup()' and further."], "name": "CVE-2024-56650", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-12-27T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-56650\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-56650\nhttps://lore.kernel.org/linux-cve-announce/2024122740-CVE-2024-56650-4d51@gregkh/T"], "threat_severity": "Moderate"}

{}