CVE-2024-50281 (GCVE-0-2024-50281)
Vulnerability from cvelistv5
Published
2024-11-19 01:30
Modified
2026-08-05 11:43
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: dcp: fix NULL dereference in AEAD crypto operation When sealing or unsealing a key blob we currently do not wait for the AEAD cipher operation to finish and simply return after submitting the request. If there is some load on the system we can exit before the cipher operation is done and the buffer we read from/write to is already removed from the stack. This will e.g. result in NULL pointer dereference errors in the DCP driver during blob creation. Fix this by waiting for the AEAD cipher operation to finish before resuming the seal and unseal calls.
References
Impacted products
Vendor Product Version
Linux Linux Version: 0e28bf61a5f9ab30be3f3b4eafb8d097e39446bb
Version: 0e28bf61a5f9ab30be3f3b4eafb8d097e39446bb
Version: 9e3b266afcfe4294e84496f50f006f029d3100db
Version: 6.10.7   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-50281",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T20:14:40.365722Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-476",
                "description": "CWE-476 NULL Pointer Dereference",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T20:17:22.242Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "security/keys/trusted-keys/trusted_dcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c75e0272289eae18c5379518a9c56ef31d65cc7d",
              "status": "affected",
              "version": "0e28bf61a5f9ab30be3f3b4eafb8d097e39446bb",
              "versionType": "git"
            },
            {
              "lessThan": "04de7589e0a95167d803ecadd115235ba2c14997",
              "status": "affected",
              "version": "0e28bf61a5f9ab30be3f3b4eafb8d097e39446bb",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9e3b266afcfe4294e84496f50f006f029d3100db",
              "versionType": "git"
            },
            {
              "lessThan": "6.11",
              "status": "affected",
              "version": "6.10.7",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "security/keys/trusted-keys/trusted_dcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.8",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.10.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKEYS: trusted: dcp: fix NULL dereference in AEAD crypto operation\n\nWhen sealing or unsealing a key blob we currently do not wait for\nthe AEAD cipher operation to finish and simply return after submitting\nthe request. If there is some load on the system we can exit before\nthe cipher operation is done and the buffer we read from/write to\nis already removed from the stack. This will e.g. result in NULL\npointer dereference errors in the DCP driver during blob creation.\n\nFix this by waiting for the AEAD cipher operation to finish before\nresuming the seal and unseal calls."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached only through the `add_key()`/`keyctl()` syscalls on the \"trusted\" key type, requiring local access to the system. There is no network or remote-peer path into `trusted_dcp_seal()`/`trusted_dcp_unseal()`.\nAC:L - The attacker controls both sides of the race \u2014 they submit the AEAD requests via repeated `add_key()` calls and can generate the system load that delays async completion past the function\u0027s return, and they control what reuses the freed stack frame. No condition outside the attacker\u0027s influence is required on affected i.MX DCP hardware.\nPR:L - `trusted_instantiate()` and `trusted_update()` contain no capability or privilege checks, so any unprivileged local user can add or load a trusted key into their own keyring and drive `do_aead_crypto()`. Only basic local user access is needed.\nUI:N - The attacker triggers the bug entirely through their own syscalls; no victim action, mount, or file open is involved.\nS:U - The corruption and crash occur inside the kernel that the attacker is already interacting with, with no crossing into another security authority such as a hypervisor or IOMMU boundary.\nC:H - The in-flight operation reads from a scatterlist pointing into a reclaimed stack frame and uses a freed `aead_request`/tfm holding the AES-GCM blob key, so plaintext key material and adjacent memory can be written into reused allocations and exposed. This memory corruption is leverageable for information disclosure.\nI:H - After `aead_request_free()`/`crypto_free_aead()` return, the asynchronous DCP engine still writes its output through stale stack-resident scatterlists into memory that has been reclaimed and reused, giving an attacker-influenceable write into unrelated kernel objects \u2014 classic use-after-free/stack-corruption primitives for control-flow hijack.\nA:H - The commit documents that this produces NULL pointer dereference oopses in the DCP driver during blob creation, and use of the freed request/tfm crashes the kernel. An unprivileged user can trigger it repeatedly, causing denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:43:00.504Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c75e0272289eae18c5379518a9c56ef31d65cc7d"
        },
        {
          "url": "https://git.kernel.org/stable/c/04de7589e0a95167d803ecadd115235ba2c14997"
        }
      ],
      "title": "KEYS: trusted: dcp: fix NULL dereference in AEAD crypto operation",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-50281",
    "datePublished": "2024-11-19T01:30:23.275Z",
    "dateReserved": "2024-10-21T19:36:19.983Z",
    "dateUpdated": "2026-08-05T11:43:00.504Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-50281\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-01T20:14:40.365722Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-476\", \"description\": \"CWE-476 NULL Pointer Dereference\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-01T15:26:44.665Z\"}}], \"cna\": {\"title\": \"KEYS: trusted: dcp: fix NULL dereference in AEAD crypto operation\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable code is reached only through the `add_key()`/`keyctl()` syscalls on the \\\"trusted\\\" key type, requiring local access to the system. There is no network or remote-peer path into `trusted_dcp_seal()`/`trusted_dcp_unseal()`.\\nAC:L - The attacker controls both sides of the race \\u2014 they submit the AEAD requests via repeated `add_key()` calls and can generate the system load that delays async completion past the function\u0027s return, and they control what reuses the freed stack frame. No condition outside the attacker\u0027s influence is required on affected i.MX DCP hardware.\\nPR:L - `trusted_instantiate()` and `trusted_update()` contain no capability or privilege checks, so any unprivileged local user can add or load a trusted key into their own keyring and drive `do_aead_crypto()`. Only basic local user access is needed.\\nUI:N - The attacker triggers the bug entirely through their own syscalls; no victim action, mount, or file open is involved.\\nS:U - The corruption and crash occur inside the kernel that the attacker is already interacting with, with no crossing into another security authority such as a hypervisor or IOMMU boundary.\\nC:H - The in-flight operation reads from a scatterlist pointing into a reclaimed stack frame and uses a freed `aead_request`/tfm holding the AES-GCM blob key, so plaintext key material and adjacent memory can be written into reused allocations and exposed. This memory corruption is leverageable for information disclosure.\\nI:H - After `aead_request_free()`/`crypto_free_aead()` return, the asynchronous DCP engine still writes its output through stale stack-resident scatterlists into memory that has been reclaimed and reused, giving an attacker-influenceable write into unrelated kernel objects \\u2014 classic use-after-free/stack-corruption primitives for control-flow hijack.\\nA:H - The commit documents that this produces NULL pointer dereference oopses in the DCP driver during blob creation, and use of the freed request/tfm crashes the kernel. An unprivileged user can trigger it repeatedly, causing denial of service.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"0e28bf61a5f9ab30be3f3b4eafb8d097e39446bb\", \"lessThan\": \"c75e0272289eae18c5379518a9c56ef31d65cc7d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0e28bf61a5f9ab30be3f3b4eafb8d097e39446bb\", \"lessThan\": \"04de7589e0a95167d803ecadd115235ba2c14997\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9e3b266afcfe4294e84496f50f006f029d3100db\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6.10.7\", \"lessThan\": \"6.11\", \"versionType\": \"semver\"}], \"programFiles\": [\"security/keys/trusted-keys/trusted_dcp.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.11\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.11\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.11.8\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"security/keys/trusted-keys/trusted_dcp.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/c75e0272289eae18c5379518a9c56ef31d65cc7d\"}, {\"url\": \"https://git.kernel.org/stable/c/04de7589e0a95167d803ecadd115235ba2c14997\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nKEYS: trusted: dcp: fix NULL dereference in AEAD crypto operation\\n\\nWhen sealing or unsealing a key blob we currently do not wait for\\nthe AEAD cipher operation to finish and simply return after submitting\\nthe request. If there is some load on the system we can exit before\\nthe cipher operation is done and the buffer we read from/write to\\nis already removed from the stack. This will e.g. result in NULL\\npointer dereference errors in the DCP driver during blob creation.\\n\\nFix this by waiting for the AEAD cipher operation to finish before\\nresuming the seal and unseal calls.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.8\", \"versionStartIncluding\": \"6.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"6.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"6.10.7\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:43:00.504Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-50281\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:43:00.504Z\", \"dateReserved\": \"2024-10-21T19:36:19.983Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-11-19T01:30:23.275Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.