{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-50281", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-10-21T19:36:19.983Z", "datePublished": "2024-11-19T01:30:23.275Z", "dateUpdated": "2026-08-05T11:43:00.504Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:43:00.504Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKEYS: trusted: dcp: fix NULL dereference in AEAD crypto operation\n\nWhen sealing or unsealing a key blob we currently do not wait for\nthe AEAD cipher operation to finish and simply return after submitting\nthe request. If there is some load on the system we can exit before\nthe cipher operation is done and the buffer we read from/write to\nis already removed from the stack. This will e.g. result in NULL\npointer dereference errors in the DCP driver during blob creation.\n\nFix this by waiting for the AEAD cipher operation to finish before\nresuming the seal and unseal calls." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable code is reached only through the `add_key()`/`keyctl()` syscalls on the \"trusted\" key type, requiring local access to the system. There is no network or remote-peer path into `trusted_dcp_seal()`/`trusted_dcp_unseal()`.\nAC:L - The attacker controls both sides of the race — they submit the AEAD requests via repeated `add_key()` calls and can generate the system load that delays async completion past the function's return, and they control what reuses the freed stack frame. No condition outside the attacker's influence is required on affected i.MX DCP hardware.\nPR:L - `trusted_instantiate()` and `trusted_update()` contain no capability or privilege checks, so any unprivileged local user can add or load a trusted key into their own keyring and drive `do_aead_crypto()`. Only basic local user access is needed.\nUI:N - The attacker triggers the bug entirely through their own syscalls; no victim action, mount, or file open is involved.\nS:U - The corruption and crash occur inside the kernel that the attacker is already interacting with, with no crossing into another security authority such as a hypervisor or IOMMU boundary.\nC:H - The in-flight operation reads from a scatterlist pointing into a reclaimed stack frame and uses a freed `aead_request`/tfm holding the AES-GCM blob key, so plaintext key material and adjacent memory can be written into reused allocations and exposed. This memory corruption is leverageable for information disclosure.\nI:H - After `aead_request_free()`/`crypto_free_aead()` return, the asynchronous DCP engine still writes its output through stale stack-resident scatterlists into memory that has been reclaimed and reused, giving an attacker-influenceable write into unrelated kernel objects — classic use-after-free/stack-corruption primitives for control-flow hijack.\nA:H - The commit documents that this produces NULL pointer dereference oopses in the DCP driver during blob creation, and use of the freed request/tfm crashes the kernel. An unprivileged user can trigger it repeatedly, causing denial of service." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "security/keys/trusted-keys/trusted_dcp.c" ], "versions": [ { "version": "0e28bf61a5f9ab30be3f3b4eafb8d097e39446bb", "lessThan": "c75e0272289eae18c5379518a9c56ef31d65cc7d", "status": "affected", "versionType": "git" }, { "version": "0e28bf61a5f9ab30be3f3b4eafb8d097e39446bb", "lessThan": "04de7589e0a95167d803ecadd115235ba2c14997", "status": "affected", "versionType": "git" }, { "version": "9e3b266afcfe4294e84496f50f006f029d3100db", "status": "affected", "versionType": "git" }, { "version": "6.10.7", "lessThan": "6.11", "status": "affected", "versionType": "semver" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "security/keys/trusted-keys/trusted_dcp.c" ], "versions": [ { "version": "6.11", "status": "affected" }, { "version": "0", "lessThan": "6.11", "status": "unaffected", "versionType": "semver" }, { "version": "6.11.8", "lessThanOrEqual": "6.11.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.11.8" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.12" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10.7" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/c75e0272289eae18c5379518a9c56ef31d65cc7d" }, { "url": "https://git.kernel.org/stable/c/04de7589e0a95167d803ecadd115235ba2c14997" } ], "title": "KEYS: trusted: dcp: fix NULL dereference in AEAD crypto operation", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE" } }, { "other": { "type": "ssvc", "content": { "id": "CVE-2024-50281", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2025-10-01T20:14:40.365722Z" } } } ], "problemTypes": [ { "descriptions": [ { "lang": "en", "type": "CWE", "cweId": "CWE-476", "description": "CWE-476 NULL Pointer Dereference" } ] } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-01T20:17:22.242Z" } } ] } }