Junglewise Threat Intelligence

CVE-2024-50035: Linux Kernel illegal memory access in ppp_async_encode

CVE-2024-50035 · Severity: high · CVSS 7.1 · Published 2024-10-21

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's Point-to-Point Protocol (PPP) implementation could allow a local attacker to cause a system crash or potentially access sensitive information from the system's memory. The issue occurs when the system processes network messages of zero length, leading to an improper memory access. This affects various Linux distributions and systems using PPP for network connections, such as DSL or VPN services.

Technical details

A use-of-uninitialized-resource vulnerability (CWE-908) exists in the Linux kernel's PPP async driver (drivers/net/ppp/ppp_async.c). The root cause is in ppp_async_encode(), which fails to validate the length of the socket buffer (skb) before accessing its data. When pppoe_sendmsg() is called with a zero size, it passes an empty skb to the encoding function, which then attempts to read protocol data from uninitialized memory. A local attacker with low privileges can exploit this to trigger a kernel panic (DoS) or leak uninitialized kernel memory. Patches have been released across multiple stable kernel branches to ensure the data count is at least 3 bytes before accessing the LCP protocol fields.

Affected products

  • Linux Linux Kernel 2.6.12 to 5.10.227, 5.11 to 5.15.168, 5.16 to 6.1.113, 6.2 to 6.6.57, 6.7 to 6.11.4, 6.12-rc1

Timeline

  • 2024-10-09: patched: Initial fix authored by Eric Dumazet
  • 2024-10-21: disclosed: CVE-2024-50035 published

References

Related threats