CVE-2024-50264: vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans
In the Linux kernel, the following vulnerability has been resolved:
vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans
During loopback communication, a dangling pointer can be created in vsk->trans, potentially leading to a Use-After-Free condition. This issue is resolved by initializing vsk->trans to NULL.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1 - Configuration
Resolve the potential dangling pointer/use-after-free during loopback communication by initializing vsk->trans to NULL.
Linux kernel (vsock/virtio) vsk->trans initialization = NULL
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50264?
CVE-2024-50264 is classified as a high-severity vulnerability due to the potential for a Use-After-Free condition.
How do I fix CVE-2024-50264?
To fix CVE-2024-50264, update the Linux kernel to versions 6.1.123-1, 6.1.119-1, or higher.
Which versions of the Linux kernel are affected by CVE-2024-50264?
CVE-2024-50264 affects Linux kernel versions from 4.8 to 6.11.8, as well as specific release candidates.
Is CVE-2024-50264 related to loopback communication?
Yes, CVE-2024-50264 involves a dangling pointer created during loopback communication in the Linux kernel.
What are the potential consequences of CVE-2024-50264?
Users impacted by CVE-2024-50264 may experience system instability or crashes due to the Use-After-Free condition.