CVE-2024-50169

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-50169

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

I

n the Linux kernel, the following vulnerability has been resolved: vsock: Update rx_bytes on read_skb() Make sure virtio_transport_inc_rx_pkt() and virtio_transport_dec_rx_pkt() calls are balanced (i.e. virtio_vsock_sock::rx_bytes doesn't lie) after vsock_transport::read_skb(). While here, also inform the peer that we've freed up space and it has more credit. Failing to update rx_bytes after packet is dequeued leads to a warning on SOCK_STREAM recv(): [ 233.396654] rx_queue is empty, but rx_bytes is non-zero [ 233.396702] WARNING: CPU: 11 PID: 40601 at net/vmw_vsock/virtio_transport_common.c:589

References
Link Resource
https://git.kernel.org/stable/c/3543152f2d330141d9394d28855cb90b860091d2 Patch
https://git.kernel.org/stable/c/66cd51de31c682a311c2fa25c580b7ea45859dd9 Patch
https://git.kernel.org/stable/c/e5ca2b98090b4bb1c393088c724af6c37812a829 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*
History

22 Nov 2024, 16:58

Type Values Removed Values Added
CWE NVD-CWE-noinfo
First Time Linux
Linux linux Kernel
References () https://git.kernel.org/stable/c/3543152f2d330141d9394d28855cb90b860091d2 - () https://git.kernel.org/stable/c/3543152f2d330141d9394d28855cb90b860091d2 - Patch
References () https://git.kernel.org/stable/c/66cd51de31c682a311c2fa25c580b7ea45859dd9 - () https://git.kernel.org/stable/c/66cd51de31c682a311c2fa25c580b7ea45859dd9 - Patch
References () https://git.kernel.org/stable/c/e5ca2b98090b4bb1c393088c724af6c37812a829 - () https://git.kernel.org/stable/c/e5ca2b98090b4bb1c393088c724af6c37812a829 - Patch
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CPE cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

08 Nov 2024, 19:01

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: vsock: Actualizar rx_bytes en read_skb() Asegúrese de que las llamadas a virtio_transport_inc_rx_pkt() y virtio_transport_dec_rx_pkt() estén equilibradas (es decir, virtio_vsock_sock::rx_bytes no mienta) después de vsock_transport::read_skb(). Mientras esté aquí, también informe al par que hemos liberado espacio y que tiene más crédito. Si no se actualiza rx_bytes después de que se saca el paquete de la cola, se genera una advertencia en SOCK_STREAM recv(): [ 233.396654] rx_queue está vacío, pero rx_bytes no es cero [ 233.396702] ADVERTENCIA: CPU: 11 PID: 40601 en net/vmw_vsock/virtio_transport_common.c:589

07 Nov 2024, 10:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-11-07 10:15

Updated : 2025-10-01 21:15

NVD link : CVE-2024-50169

Mitre link : CVE-2024-50169

CVE.ORG link : CVE-2024-50169

JSON object : View

Products Affected

linux

CWE
NVD-CWE-noinfo