CVE-2024-50142: xfrm: validate new SA's prefixlen using SA family when sel.family is unset
In the Linux kernel, the following vulnerability has been resolved:
xfrm: validate new SA's prefixlen using SA family when sel.family is unset
This expands the validation introduced in commit 07bf7908950a ("xfrm: Validate address prefix lengths in the xfrm selector.")
syzbot created an SA with usersa.sel.family = AFUNSPEC usersa.sel.prefixlens = 128 usersa.family = AFINET
Because of the AFUNSPEC selector, verifynewsainfo doesn't put limits on prefixlen{s,d}. But then copyfromuserstate sets x->sel.family to usersa.family (AFINET). Do the same conversion in verifynewsainfo before validating prefixlen{s,d}, since that's how prefixlen is going to be used later on.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.251-5Fixed in 6.1.170-3Fixed in 6.1.172-1Fixed in 6.12.86-1Fixed in 6.12.88-1Fixed in 7.0.7-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.172-1~deb11u1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.15.173.1-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.64.2-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch commit 07bf7908950a ( - Configuration
In verify_newsa_info, before validating prefixlen_{s,d}, perform the same conversion so x->sel.family is set from usersa.family (e.g., AF_INET) when sel.family is unset (AF_UNSPEC), and then validate prefixlen_{s,d} using the resulting SA family.
Linux kernel xfrm (validate new SA prefixlen using SA family when sel.family is unset) AF_UNSPEC selector handling in verify_newsa_info = Use usersa.family to validate prefixlen_{s,d} when sel.family is unset (AF_UNSPEC)
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50142?
CVE-2024-50142 has a moderate severity rating due to its potential impact on the Linux kernel's security mechanism.
How do I fix CVE-2024-50142?
To fix CVE-2024-50142, update the Linux kernel to version 6.1.123-1 or higher.
Which versions of the Linux kernel are affected by CVE-2024-50142?
CVE-2024-50142 affects multiple versions of the Linux kernel, including versions between 2.6.12 and 6.12-rc4.
Are there any specific distributions that need to patch CVE-2024-50142?
Yes, Debian distributions need to apply the patch for CVE-2024-50142 in related Linux kernel packages.
What is the nature of the vulnerability described in CVE-2024-50142?
CVE-2024-50142 pertains to improper validation of the new Security Association's prefix length in the Linux kernel's xfrm module.