CVE-2024-50145 (GCVE-0-2024-50145)
Vulnerability from cvelistv5
Published
2024-11-07 09:31
Modified
2026-08-05 11:42
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: octeon_ep: Add SKB allocation failures handling in __octep_oq_process_rx() build_skb() returns NULL in case of a memory allocation failure so handle it inside __octep_oq_process_rx() to avoid NULL pointer dereference. __octep_oq_process_rx() is called during NAPI polling by the driver. If skb allocation fails, keep on pulling packets out of the Rx DMA queue: we shouldn't break the polling immediately and thus falsely indicate to the octep_napi_poll() that the Rx pressure is going down. As there is no associated skb in this case, don't process the packets and don't push them up the network stack - they are skipped. Helper function is implemented to unmmap/flush all the fragment buffers used by the dropped packet. 'alloc_failures' counter is incremented to mark the skb allocation error in driver statistics. Found by Linux Verification Center (linuxtesting.org) with SVACE.
References
Impacted products
Vendor Product Version
Linux Linux Version: 37d79d0596062057f588bdbb2ebad5455a43d353
Version: 37d79d0596062057f588bdbb2ebad5455a43d353
Version: 37d79d0596062057f588bdbb2ebad5455a43d353
Version: 37d79d0596062057f588bdbb2ebad5455a43d353
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-50145",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T20:20:53.967955Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-476",
                "description": "CWE-476 NULL Pointer Dereference",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T20:27:13.740Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:26:04.314Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/marvell/octeon_ep/octep_rx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "09ce491112bbf0b866e2638d3e961c1c73d1f00b",
              "status": "affected",
              "version": "37d79d0596062057f588bdbb2ebad5455a43d353",
              "versionType": "git"
            },
            {
              "lessThan": "c2d2dc4f88bb3cfc4f3cc320fd3ff51b0ae5b0ea",
              "status": "affected",
              "version": "37d79d0596062057f588bdbb2ebad5455a43d353",
              "versionType": "git"
            },
            {
              "lessThan": "2dedcb6f99f4c1a11944e7cc35dbeb9b18a5cbac",
              "status": "affected",
              "version": "37d79d0596062057f588bdbb2ebad5455a43d353",
              "versionType": "git"
            },
            {
              "lessThan": "eb592008f79be52ccef88cd9a5249b3fc0367278",
              "status": "affected",
              "version": "37d79d0596062057f588bdbb2ebad5455a43d353",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/marvell/octeon_ep/octep_rx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.19"
            },
            {
              "lessThan": "5.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.115",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.59",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.115",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.59",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.6",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocteon_ep: Add SKB allocation failures handling in __octep_oq_process_rx()\n\nbuild_skb() returns NULL in case of a memory allocation failure so handle\nit inside __octep_oq_process_rx() to avoid NULL pointer dereference.\n\n__octep_oq_process_rx() is called during NAPI polling by the driver. If\nskb allocation fails, keep on pulling packets out of the Rx DMA queue: we\nshouldn\u0027t break the polling immediately and thus falsely indicate to the\noctep_napi_poll() that the Rx pressure is going down. As there is no\nassociated skb in this case, don\u0027t process the packets and don\u0027t push them\nup the network stack - they are skipped.\n\nHelper function is implemented to unmmap/flush all the fragment buffers\nused by the dropped packet. \u0027alloc_failures\u0027 counter is incremented to\nmark the skb allocation error in driver statistics.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable code is the NIC receive path (`__octep_oq_process_rx()`) invoked from NAPI polling to process network frames delivered by the Marvell Octeon PCIe endpoint NIC, a DPU/SmartNIC deployed on internet-facing cloud servers. A remote attacker reaches the code purely by sending packets to the host, with no local access.\nAC:L - `build_skb()` uses GFP_ATOMIC, which cannot sleep or reclaim and therefore fails readily under the atomic-allocation pressure a high-rate packet flood creates \u2014 an attacker can drive this condition with sustained line-rate traffic rather than waiting on it. Since the attacker meaningfully influences the memory-pressure precondition, the lower complexity applies.\nPR:N - The receive path executes in softirq context on every incoming frame with no capability check, no authentication, and no privileged setup step of any kind. An entirely unauthenticated remote sender reaches the vulnerable code.\nUI:N - Packet reception and NAPI polling are fully automatic on any interface that is simply up; no victim action, configuration change, or interaction is required.\nS:U - The NULL dereference faults within the host kernel, and the resulting oops affects only that kernel\u0027s own security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:N - The fault is a write to a fixed NULL + small-struct-offset address that is unmapped below mmap_min_addr; nothing is read back and no packet or kernel data is disclosed to the attacker.\nI:N - The store target is a constant low address rather than an attacker-influenced pointer, so it faults immediately and modifies no kernel memory \u2014 there is no write primitive or control-flow influence.\nA:H - The NULL pointer dereference in `skb_reserve()` triggers a kernel oops in softirq/NAPI context, killing the interrupt thread and the network interface, and causing a full panic on `panic_on_oops` systems typical of embedded, automotive, and appliance deployments."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:42:01.754Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/09ce491112bbf0b866e2638d3e961c1c73d1f00b"
        },
        {
          "url": "https://git.kernel.org/stable/c/c2d2dc4f88bb3cfc4f3cc320fd3ff51b0ae5b0ea"
        },
        {
          "url": "https://git.kernel.org/stable/c/2dedcb6f99f4c1a11944e7cc35dbeb9b18a5cbac"
        },
        {
          "url": "https://git.kernel.org/stable/c/eb592008f79be52ccef88cd9a5249b3fc0367278"
        }
      ],
      "title": "octeon_ep: Add SKB allocation failures handling in __octep_oq_process_rx()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-50145",
    "datePublished": "2024-11-07T09:31:22.202Z",
    "dateReserved": "2024-10-21T19:36:19.956Z",
    "dateUpdated": "2026-08-05T11:42:01.754Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-50145\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-01T20:20:53.967955Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-476\", \"description\": \"CWE-476 NULL Pointer Dereference\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-01T15:17:40.252Z\"}}], \"cna\": {\"title\": \"octeon_ep: Add SKB allocation failures handling in __octep_oq_process_rx()\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"37d79d0596062057f588bdbb2ebad5455a43d353\", \"lessThan\": \"09ce491112bbf0b866e2638d3e961c1c73d1f00b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"37d79d0596062057f588bdbb2ebad5455a43d353\", \"lessThan\": \"c2d2dc4f88bb3cfc4f3cc320fd3ff51b0ae5b0ea\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"37d79d0596062057f588bdbb2ebad5455a43d353\", \"lessThan\": \"2dedcb6f99f4c1a11944e7cc35dbeb9b18a5cbac\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"37d79d0596062057f588bdbb2ebad5455a43d353\", \"lessThan\": \"eb592008f79be52ccef88cd9a5249b3fc0367278\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/ethernet/marvell/octeon_ep/octep_rx.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.19\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.19\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.115\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.59\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.6\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/ethernet/marvell/octeon_ep/octep_rx.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/09ce491112bbf0b866e2638d3e961c1c73d1f00b\"}, {\"url\": \"https://git.kernel.org/stable/c/c2d2dc4f88bb3cfc4f3cc320fd3ff51b0ae5b0ea\"}, {\"url\": \"https://git.kernel.org/stable/c/2dedcb6f99f4c1a11944e7cc35dbeb9b18a5cbac\"}, {\"url\": \"https://git.kernel.org/stable/c/eb592008f79be52ccef88cd9a5249b3fc0367278\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nocteon_ep: Add SKB allocation failures handling in __octep_oq_process_rx()\\n\\nbuild_skb() returns NULL in case of a memory allocation failure so handle\\nit inside __octep_oq_process_rx() to avoid NULL pointer dereference.\\n\\n__octep_oq_process_rx() is called during NAPI polling by the driver. If\\nskb allocation fails, keep on pulling packets out of the Rx DMA queue: we\\nshouldn\u0027t break the polling immediately and thus falsely indicate to the\\noctep_napi_poll() that the Rx pressure is going down. As there is no\\nassociated skb in this case, don\u0027t process the packets and don\u0027t push them\\nup the network stack - they are skipped.\\n\\nHelper function is implemented to unmmap/flush all the fragment buffers\\nused by the dropped packet. \u0027alloc_failures\u0027 counter is incremented to\\nmark the skb allocation error in driver statistics.\\n\\nFound by Linux Verification Center (linuxtesting.org) with SVACE.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.115\", \"versionStartIncluding\": \"5.19\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.59\", \"versionStartIncluding\": \"5.19\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.6\", \"versionStartIncluding\": \"5.19\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"5.19\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T09:47:12.475Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-50145\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-10-01T20:27:13.740Z\", \"dateReserved\": \"2024-10-21T19:36:19.956Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-11-07T09:31:22.202Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.