cbcvebase.
CVE-2024-50045
published 2024-10-21

CVE-2024-50045: In the Linux kernel, the following vulnerability has been resolved: netfilter: br_netfilter: fix panic with metadata_dst skb Fix a kernel panic in the…

PriorityP422medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.26%
17.4th percentile
In the Linux kernel, the following vulnerability has been resolved: netfilter: br_netfilter: fix panic with metadata_dst skb Fix a kernel panic in the br_netfilter module when sending untagged traffic via a VxLAN device. This happens during the check for fragmentation in br_nf_dev_queue_xmit. It is dependent on: 1) the br_netfilter module being loaded; 2) net.bridge.bridge-nf-call-iptables set to 1; 3) a bridge with a VxLAN (single-vxlan-device) netdevice as a bridge port; 4) untagged frames with size higher than the VxLAN MTU forwarded/flooded When forwarding the untagged packet to the VxLAN bridge port, before the netfilter hooks are called, br_handle_egress_vlan_tunnel is called and changes the skb_dst to the tunnel dst. The tunnel_dst is a metadata type of dst, i.e., skb_valid_dst(skb) is false, and metadata->dst.dev is NULL. Then in the br_netfilter hooks, in br_nf_dev_queue_xmit, there's a check for frames that needs to be fragmented: frames with higher MTU than the VxLAN device end up calling br_nf_ip_fragment, which in turns call ip_skb_dst_mtu. The ip_dst_mtu tries to use the skb_dst(skb) as if it was a valid dst with valid dst->dev, thus the crash. This case was never supported in the first place, so drop the packet instead. PING 10.0.0.2 (10.0.0.2) from 0.0.0.0 h1-eth0: 2000(2028) bytes of data. [ 176.291791] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000110 [ 176.292101] Mem abort info: [ 176.292184] ESR = 0x0000000096000004 [ 176.292322] EC = 0x25: DABT (current EL), IL = 32 bits [ 176.292530] SET = 0, FnV = 0 [ 176.292709] EA = 0, S1PTW = 0 [ 176.292862] FSC = 0x04: level 0 translation fault [ 176.293013] Data abort info: [ 176.293104] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 [ 176.293488] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 176.293787] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 176.293995] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000043ef5000 [ 176.294166] [0000000000000110] pgd=00000000000000

Affected

34 ranges· showing 25
VendorProductVersion rangeFixed in
debianlinux< linux 6.1.115-1 (bookworm)linux 6.1.115-1 (bookworm)
debianlinux-6.1< linux 6.1.115-1 (bookworm)linux 6.1.115-1 (bookworm)
linuxlinux
linuxlinux>= 11538d039ac6efcf4f1a6c536e1b87cd3668a9fd < f07131239a76cc10d5e82c19d91f53cb55727297f07131239a76cc10d5e82c19d91f53cb55727297
linuxlinux>= 11538d039ac6efcf4f1a6c536e1b87cd3668a9fd < 75dfcb758015c97e1accd6340691fca67d363bed75dfcb758015c97e1accd6340691fca67d363bed
linuxlinux>= 11538d039ac6efcf4f1a6c536e1b87cd3668a9fd < cce8419b8168f6e7eb637103a47f916f3de8bc81cce8419b8168f6e7eb637103a47f916f3de8bc81
linuxlinux>= 11538d039ac6efcf4f1a6c536e1b87cd3668a9fd < 95c0cff5a1a5d28bf623b92eb5d1a8f56ed3080395c0cff5a1a5d28bf623b92eb5d1a8f56ed30803
linuxlinux>= 11538d039ac6efcf4f1a6c536e1b87cd3668a9fd < 78ed917133b118661e1fe62d4a85d5d428ee956878ed917133b118661e1fe62d4a85d5d428ee9568
linuxlinux>= 11538d039ac6efcf4f1a6c536e1b87cd3668a9fd < 3453f5839420bfbb85c86c61e49f49ffd0f041c43453f5839420bfbb85c86c61e49f49ffd0f041c4
linuxlinux>= 11538d039ac6efcf4f1a6c536e1b87cd3668a9fd < 915717e0bb9837cc5c101bc545af487bd787239e915717e0bb9837cc5c101bc545af487bd787239e
linuxlinux>= 11538d039ac6efcf4f1a6c536e1b87cd3668a9fd < f9ff7665cd128012868098bbd07e28993e314fdbf9ff7665cd128012868098bbd07e28993e314fdb
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel>= 0 < 5.10.234-15.10.234-1
linuxlinux_kernel>= 0 < 6.1.115-16.1.115-1
linuxlinux_kernel>= 0 < 6.11.4-16.11.4-1
linuxlinux_kernel>= 0 < 6.11.4-16.11.4-1
linuxlinux_kernel>= 0 < 5.4.0-208.2285.4.0-208.228
linuxlinux_kernel>= 0 < 5.15.0-127.1375.15.0-127.137
linuxlinux_kernel>= 0 < 6.8.0-56.586.8.0-56.58
linuxlinux_kernel>= 0 < 6.11.0-18.186.11.0-18.18
linuxlinux_kernel>= 4.11 < 5.10.2275.10.227
linuxlinux_kernel>= 5.11 < 5.15.1685.15.168
linuxlinux_kernel>= 5.16 < 6.1.1136.1.113
linuxlinux_kernel>= 6.2 < 6.6.576.6.57

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv8.8HIGH
vendor_ubuntu8.8HIGH
vendor_debian5.5MEDIUM
vendor_msrc5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.