CVE-2024-56650 (GCVE-0-2024-56650)
Vulnerability from cvelistv5
Published
2024-12-27 15:02
Modified
2026-08-05 11:45
Severity ?
7.1 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: netfilter: x_tables: fix LED ID check in led_tg_check() Syzbot has reported the following BUG detected by KASAN: BUG: KASAN: slab-out-of-bounds in strlen+0x58/0x70 Read of size 1 at addr ffff8881022da0c8 by task repro/5879 ... Call Trace: <TASK> dump_stack_lvl+0x241/0x360 ? __pfx_dump_stack_lvl+0x10/0x10 ? __pfx__printk+0x10/0x10 ? _printk+0xd5/0x120 ? __virt_addr_valid+0x183/0x530 ? __virt_addr_valid+0x183/0x530 print_report+0x169/0x550 ? __virt_addr_valid+0x183/0x530 ? __virt_addr_valid+0x183/0x530 ? __virt_addr_valid+0x45f/0x530 ? __phys_addr+0xba/0x170 ? strlen+0x58/0x70 kasan_report+0x143/0x180 ? strlen+0x58/0x70 strlen+0x58/0x70 kstrdup+0x20/0x80 led_tg_check+0x18b/0x3c0 xt_check_target+0x3bb/0xa40 ? __pfx_xt_check_target+0x10/0x10 ? stack_depot_save_flags+0x6e4/0x830 ? nft_target_init+0x174/0xc30 nft_target_init+0x82d/0xc30 ? __pfx_nft_target_init+0x10/0x10 ? nf_tables_newrule+0x1609/0x2980 ? nf_tables_newrule+0x1609/0x2980 ? rcu_is_watching+0x15/0xb0 ? nf_tables_newrule+0x1609/0x2980 ? nf_tables_newrule+0x1609/0x2980 ? __kmalloc_noprof+0x21a/0x400 nf_tables_newrule+0x1860/0x2980 ? __pfx_nf_tables_newrule+0x10/0x10 ? __nla_parse+0x40/0x60 nfnetlink_rcv+0x14e5/0x2ab0 ? __pfx_validate_chain+0x10/0x10 ? __pfx_nfnetlink_rcv+0x10/0x10 ? __lock_acquire+0x1384/0x2050 ? netlink_deliver_tap+0x2e/0x1b0 ? __pfx_lock_release+0x10/0x10 ? netlink_deliver_tap+0x2e/0x1b0 netlink_unicast+0x7f8/0x990 ? __pfx_netlink_unicast+0x10/0x10 ? __virt_addr_valid+0x183/0x530 ? __check_object_size+0x48e/0x900 netlink_sendmsg+0x8e4/0xcb0 ? __pfx_netlink_sendmsg+0x10/0x10 ? aa_sock_msg_perm+0x91/0x160 ? __pfx_netlink_sendmsg+0x10/0x10 __sock_sendmsg+0x223/0x270 ____sys_sendmsg+0x52a/0x7e0 ? __pfx_____sys_sendmsg+0x10/0x10 __sys_sendmsg+0x292/0x380 ? __pfx___sys_sendmsg+0x10/0x10 ? lockdep_hardirqs_on_prepare+0x43d/0x780 ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 ? exc_page_fault+0x590/0x8c0 ? do_syscall_64+0xb6/0x230 do_syscall_64+0xf3/0x230 entry_SYSCALL_64_after_hwframe+0x77/0x7f ... </TASK> Since an invalid (without '\0' byte at all) byte sequence may be passed from userspace, add an extra check to ensure that such a sequence is rejected as possible ID and so never passed to 'kstrdup()' and further.
References
Impacted products
Vendor Product Version
Linux Linux Version: 268cb38e1802db560c73167e643f14a3dcb4b07c
Version: 268cb38e1802db560c73167e643f14a3dcb4b07c
Version: 268cb38e1802db560c73167e643f14a3dcb4b07c
Version: 268cb38e1802db560c73167e643f14a3dcb4b07c
Version: 268cb38e1802db560c73167e643f14a3dcb4b07c
Version: 268cb38e1802db560c73167e643f14a3dcb4b07c
Version: 268cb38e1802db560c73167e643f14a3dcb4b07c
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-56650",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T20:00:22.683789Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-125",
                "description": "CWE-125 Out-of-bounds Read",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T20:07:11.150Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:51:56.813Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/xt_LED.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "147a42bb02de8735cb08476be6d0917987d022c2",
              "status": "affected",
              "version": "268cb38e1802db560c73167e643f14a3dcb4b07c",
              "versionType": "git"
            },
            {
              "lessThan": "ad28612ebae1fcc1104bd432e99e99d87f6bfe09",
              "status": "affected",
              "version": "268cb38e1802db560c73167e643f14a3dcb4b07c",
              "versionType": "git"
            },
            {
              "lessThan": "36a9d94dac28beef6b8abba46ba8874320d3e800",
              "status": "affected",
              "version": "268cb38e1802db560c73167e643f14a3dcb4b07c",
              "versionType": "git"
            },
            {
              "lessThan": "ab9916321c95f5280b72b4c5055e269f98627efe",
              "status": "affected",
              "version": "268cb38e1802db560c73167e643f14a3dcb4b07c",
              "versionType": "git"
            },
            {
              "lessThan": "a9bcc0b70d9baf3ff005874489a0dc9d023b54c3",
              "status": "affected",
              "version": "268cb38e1802db560c73167e643f14a3dcb4b07c",
              "versionType": "git"
            },
            {
              "lessThan": "c40c96d98e536fc1daaa125c2332b988615e30a4",
              "status": "affected",
              "version": "268cb38e1802db560c73167e643f14a3dcb4b07c",
              "versionType": "git"
            },
            {
              "lessThan": "04317f4eb2aad312ad85c1a17ad81fe75f1f9bc7",
              "status": "affected",
              "version": "268cb38e1802db560c73167e643f14a3dcb4b07c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/xt_LED.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.30"
            },
            {
              "lessThan": "2.6.30",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.287",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.231",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.174",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.120",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.66",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.287",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.231",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.174",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.120",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.66",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.5",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: x_tables: fix LED ID check in led_tg_check()\n\nSyzbot has reported the following BUG detected by KASAN:\n\nBUG: KASAN: slab-out-of-bounds in strlen+0x58/0x70\nRead of size 1 at addr ffff8881022da0c8 by task repro/5879\n...\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x241/0x360\n ? __pfx_dump_stack_lvl+0x10/0x10\n ? __pfx__printk+0x10/0x10\n ? _printk+0xd5/0x120\n ? __virt_addr_valid+0x183/0x530\n ? __virt_addr_valid+0x183/0x530\n print_report+0x169/0x550\n ? __virt_addr_valid+0x183/0x530\n ? __virt_addr_valid+0x183/0x530\n ? __virt_addr_valid+0x45f/0x530\n ? __phys_addr+0xba/0x170\n ? strlen+0x58/0x70\n kasan_report+0x143/0x180\n ? strlen+0x58/0x70\n strlen+0x58/0x70\n kstrdup+0x20/0x80\n led_tg_check+0x18b/0x3c0\n xt_check_target+0x3bb/0xa40\n ? __pfx_xt_check_target+0x10/0x10\n ? stack_depot_save_flags+0x6e4/0x830\n ? nft_target_init+0x174/0xc30\n nft_target_init+0x82d/0xc30\n ? __pfx_nft_target_init+0x10/0x10\n ? nf_tables_newrule+0x1609/0x2980\n ? nf_tables_newrule+0x1609/0x2980\n ? rcu_is_watching+0x15/0xb0\n ? nf_tables_newrule+0x1609/0x2980\n ? nf_tables_newrule+0x1609/0x2980\n ? __kmalloc_noprof+0x21a/0x400\n nf_tables_newrule+0x1860/0x2980\n ? __pfx_nf_tables_newrule+0x10/0x10\n ? __nla_parse+0x40/0x60\n nfnetlink_rcv+0x14e5/0x2ab0\n ? __pfx_validate_chain+0x10/0x10\n ? __pfx_nfnetlink_rcv+0x10/0x10\n ? __lock_acquire+0x1384/0x2050\n ? netlink_deliver_tap+0x2e/0x1b0\n ? __pfx_lock_release+0x10/0x10\n ? netlink_deliver_tap+0x2e/0x1b0\n netlink_unicast+0x7f8/0x990\n ? __pfx_netlink_unicast+0x10/0x10\n ? __virt_addr_valid+0x183/0x530\n ? __check_object_size+0x48e/0x900\n netlink_sendmsg+0x8e4/0xcb0\n ? __pfx_netlink_sendmsg+0x10/0x10\n ? aa_sock_msg_perm+0x91/0x160\n ? __pfx_netlink_sendmsg+0x10/0x10\n __sock_sendmsg+0x223/0x270\n ____sys_sendmsg+0x52a/0x7e0\n ? __pfx_____sys_sendmsg+0x10/0x10\n __sys_sendmsg+0x292/0x380\n ? __pfx___sys_sendmsg+0x10/0x10\n ? lockdep_hardirqs_on_prepare+0x43d/0x780\n ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10\n ? exc_page_fault+0x590/0x8c0\n ? do_syscall_64+0xb6/0x230\n do_syscall_64+0xf3/0x230\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n...\n \u003c/TASK\u003e\n\nSince an invalid (without \u0027\\0\u0027 byte at all) byte sequence may be passed\nfrom userspace, add an extra check to ensure that such a sequence is\nrejected as possible ID and so never passed to \u0027kstrdup()\u0027 and further."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is entered only through local syscalls \u2014 `sendmsg()` on a NETLINK_NETFILTER socket (nf_tables/nft_compat) or `setsockopt(IPT_SO_SET_REPLACE)` on the legacy iptables interface. No remote peer can supply the malformed `xt_led_info` blob.\nAC:L - The attacker fully controls all 40 bytes of the target info blob and simply omits any NUL byte, making `strlen()` read out of bounds deterministically on every attempt; there is no race, no memory-layout precondition, and the required xt_LED module is present in stock distro and embedded kernel configs.\nPR:L - `nf_tables_newrule` requires CAP_NET_ADMIN only in the network namespace\u0027s owning user namespace, which any unprivileged user obtains with `unshare -Urn` \u2014 exactly how the syzbot reproducer reached it.\nUI:N - The attacker performs the entire sequence \u2014 create netns, add an nftables rule with an xt LED target \u2014 with no action by any other user, and reads the leaked bytes back from sysfs itself.\nS:U - The out-of-bounds read stays within the kernel\u0027s own heap and the disclosed data is exposed through kernel-managed interfaces; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is an unbounded slab out-of-bounds read whose contents are not merely touched but `kstrdup()`\u0027d into a globally registered LED trigger name, then printed into the world-readable (0644) `/sys/class/leds/*/trigger` file, plus an `-EEXIST` collision oracle from `led_trigger_register()` \u2014 giving an unprivileged user a practical adjacent-kernel-heap disclosure primitive that can leak pointers and defeat KASLR/heap-layout hardening.\nI:N - `kstrdup()` allocates exactly `strlen()+1` bytes and the sysfs printer clamps with `vscnprintf`, so no memory is written out of bounds and no kernel data structure is corrupted by the flaw.\nA:H - The `strlen()` walk continues until it happens to find a zero byte and can fault on a KFENCE guard page \u2014 enabled by default in production distro and Android kernels \u2014 or run past mapped memory, oopsing the kernel; on KASAN builds it panics outright, and the attacker can repeat the attempt arbitrarily."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:45:47.823Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/147a42bb02de8735cb08476be6d0917987d022c2"
        },
        {
          "url": "https://git.kernel.org/stable/c/ad28612ebae1fcc1104bd432e99e99d87f6bfe09"
        },
        {
          "url": "https://git.kernel.org/stable/c/36a9d94dac28beef6b8abba46ba8874320d3e800"
        },
        {
          "url": "https://git.kernel.org/stable/c/ab9916321c95f5280b72b4c5055e269f98627efe"
        },
        {
          "url": "https://git.kernel.org/stable/c/a9bcc0b70d9baf3ff005874489a0dc9d023b54c3"
        },
        {
          "url": "https://git.kernel.org/stable/c/c40c96d98e536fc1daaa125c2332b988615e30a4"
        },
        {
          "url": "https://git.kernel.org/stable/c/04317f4eb2aad312ad85c1a17ad81fe75f1f9bc7"
        }
      ],
      "title": "netfilter: x_tables: fix LED ID check in led_tg_check()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-56650",
    "datePublished": "2024-12-27T15:02:50.098Z",
    "dateReserved": "2024-12-27T15:00:39.840Z",
    "dateUpdated": "2026-08-05T11:45:47.823Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T20:51:56.813Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.1, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-56650\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-01T20:00:22.683789Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-125\", \"description\": \"CWE-125 Out-of-bounds Read\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-01T15:44:39.351Z\"}}], \"cna\": {\"title\": \"netfilter: x_tables: fix LED ID check in led_tg_check()\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.1, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable path is entered only through local syscalls \\u2014 `sendmsg()` on a NETLINK_NETFILTER socket (nf_tables/nft_compat) or `setsockopt(IPT_SO_SET_REPLACE)` on the legacy iptables interface. No remote peer can supply the malformed `xt_led_info` blob.\\nAC:L - The attacker fully controls all 40 bytes of the target info blob and simply omits any NUL byte, making `strlen()` read out of bounds deterministically on every attempt; there is no race, no memory-layout precondition, and the required xt_LED module is present in stock distro and embedded kernel configs.\\nPR:L - `nf_tables_newrule` requires CAP_NET_ADMIN only in the network namespace\u0027s owning user namespace, which any unprivileged user obtains with `unshare -Urn` \\u2014 exactly how the syzbot reproducer reached it.\\nUI:N - The attacker performs the entire sequence \\u2014 create netns, add an nftables rule with an xt LED target \\u2014 with no action by any other user, and reads the leaked bytes back from sysfs itself.\\nS:U - The out-of-bounds read stays within the kernel\u0027s own heap and the disclosed data is exposed through kernel-managed interfaces; no VM, IOMMU, or sandbox boundary is crossed.\\nC:H - This is an unbounded slab out-of-bounds read whose contents are not merely touched but `kstrdup()`\u0027d into a globally registered LED trigger name, then printed into the world-readable (0644) `/sys/class/leds/*/trigger` file, plus an `-EEXIST` collision oracle from `led_trigger_register()` \\u2014 giving an unprivileged user a practical adjacent-kernel-heap disclosure primitive that can leak pointers and defeat KASLR/heap-layout hardening.\\nI:N - `kstrdup()` allocates exactly `strlen()+1` bytes and the sysfs printer clamps with `vscnprintf`, so no memory is written out of bounds and no kernel data structure is corrupted by the flaw.\\nA:H - The `strlen()` walk continues until it happens to find a zero byte and can fault on a KFENCE guard page \\u2014 enabled by default in production distro and Android kernels \\u2014 or run past mapped memory, oopsing the kernel; on KASAN builds it panics outright, and the attacker can repeat the attempt arbitrarily.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"268cb38e1802db560c73167e643f14a3dcb4b07c\", \"lessThan\": \"147a42bb02de8735cb08476be6d0917987d022c2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"268cb38e1802db560c73167e643f14a3dcb4b07c\", \"lessThan\": \"ad28612ebae1fcc1104bd432e99e99d87f6bfe09\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"268cb38e1802db560c73167e643f14a3dcb4b07c\", \"lessThan\": \"36a9d94dac28beef6b8abba46ba8874320d3e800\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"268cb38e1802db560c73167e643f14a3dcb4b07c\", \"lessThan\": \"ab9916321c95f5280b72b4c5055e269f98627efe\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"268cb38e1802db560c73167e643f14a3dcb4b07c\", \"lessThan\": \"a9bcc0b70d9baf3ff005874489a0dc9d023b54c3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"268cb38e1802db560c73167e643f14a3dcb4b07c\", \"lessThan\": \"c40c96d98e536fc1daaa125c2332b988615e30a4\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"268cb38e1802db560c73167e643f14a3dcb4b07c\", \"lessThan\": \"04317f4eb2aad312ad85c1a17ad81fe75f1f9bc7\", \"versionType\": \"git\"}], \"programFiles\": [\"net/netfilter/xt_LED.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.6.30\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"2.6.30\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.4.287\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.231\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.174\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.120\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.66\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.5\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.13\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/netfilter/xt_LED.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/147a42bb02de8735cb08476be6d0917987d022c2\"}, {\"url\": \"https://git.kernel.org/stable/c/ad28612ebae1fcc1104bd432e99e99d87f6bfe09\"}, {\"url\": \"https://git.kernel.org/stable/c/36a9d94dac28beef6b8abba46ba8874320d3e800\"}, {\"url\": \"https://git.kernel.org/stable/c/ab9916321c95f5280b72b4c5055e269f98627efe\"}, {\"url\": \"https://git.kernel.org/stable/c/a9bcc0b70d9baf3ff005874489a0dc9d023b54c3\"}, {\"url\": \"https://git.kernel.org/stable/c/c40c96d98e536fc1daaa125c2332b988615e30a4\"}, {\"url\": \"https://git.kernel.org/stable/c/04317f4eb2aad312ad85c1a17ad81fe75f1f9bc7\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnetfilter: x_tables: fix LED ID check in led_tg_check()\\n\\nSyzbot has reported the following BUG detected by KASAN:\\n\\nBUG: KASAN: slab-out-of-bounds in strlen+0x58/0x70\\nRead of size 1 at addr ffff8881022da0c8 by task repro/5879\\n...\\nCall Trace:\\n \u003cTASK\u003e\\n dump_stack_lvl+0x241/0x360\\n ? __pfx_dump_stack_lvl+0x10/0x10\\n ? __pfx__printk+0x10/0x10\\n ? _printk+0xd5/0x120\\n ? __virt_addr_valid+0x183/0x530\\n ? __virt_addr_valid+0x183/0x530\\n print_report+0x169/0x550\\n ? __virt_addr_valid+0x183/0x530\\n ? __virt_addr_valid+0x183/0x530\\n ? __virt_addr_valid+0x45f/0x530\\n ? __phys_addr+0xba/0x170\\n ? strlen+0x58/0x70\\n kasan_report+0x143/0x180\\n ? strlen+0x58/0x70\\n strlen+0x58/0x70\\n kstrdup+0x20/0x80\\n led_tg_check+0x18b/0x3c0\\n xt_check_target+0x3bb/0xa40\\n ? __pfx_xt_check_target+0x10/0x10\\n ? stack_depot_save_flags+0x6e4/0x830\\n ? nft_target_init+0x174/0xc30\\n nft_target_init+0x82d/0xc30\\n ? __pfx_nft_target_init+0x10/0x10\\n ? nf_tables_newrule+0x1609/0x2980\\n ? nf_tables_newrule+0x1609/0x2980\\n ? rcu_is_watching+0x15/0xb0\\n ? nf_tables_newrule+0x1609/0x2980\\n ? nf_tables_newrule+0x1609/0x2980\\n ? __kmalloc_noprof+0x21a/0x400\\n nf_tables_newrule+0x1860/0x2980\\n ? __pfx_nf_tables_newrule+0x10/0x10\\n ? __nla_parse+0x40/0x60\\n nfnetlink_rcv+0x14e5/0x2ab0\\n ? __pfx_validate_chain+0x10/0x10\\n ? __pfx_nfnetlink_rcv+0x10/0x10\\n ? __lock_acquire+0x1384/0x2050\\n ? netlink_deliver_tap+0x2e/0x1b0\\n ? __pfx_lock_release+0x10/0x10\\n ? netlink_deliver_tap+0x2e/0x1b0\\n netlink_unicast+0x7f8/0x990\\n ? __pfx_netlink_unicast+0x10/0x10\\n ? __virt_addr_valid+0x183/0x530\\n ? __check_object_size+0x48e/0x900\\n netlink_sendmsg+0x8e4/0xcb0\\n ? __pfx_netlink_sendmsg+0x10/0x10\\n ? aa_sock_msg_perm+0x91/0x160\\n ? __pfx_netlink_sendmsg+0x10/0x10\\n __sock_sendmsg+0x223/0x270\\n ____sys_sendmsg+0x52a/0x7e0\\n ? __pfx_____sys_sendmsg+0x10/0x10\\n __sys_sendmsg+0x292/0x380\\n ? __pfx___sys_sendmsg+0x10/0x10\\n ? lockdep_hardirqs_on_prepare+0x43d/0x780\\n ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10\\n ? exc_page_fault+0x590/0x8c0\\n ? do_syscall_64+0xb6/0x230\\n do_syscall_64+0xf3/0x230\\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\\n...\\n \u003c/TASK\u003e\\n\\nSince an invalid (without \u0027\\\\0\u0027 byte at all) byte sequence may be passed\\nfrom userspace, add an extra check to ensure that such a sequence is\\nrejected as possible ID and so never passed to \u0027kstrdup()\u0027 and further.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.287\", \"versionStartIncluding\": \"2.6.30\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.231\", \"versionStartIncluding\": \"2.6.30\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.174\", \"versionStartIncluding\": \"2.6.30\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.120\", \"versionStartIncluding\": \"2.6.30\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.66\", \"versionStartIncluding\": \"2.6.30\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.5\", \"versionStartIncluding\": \"2.6.30\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.13\", \"versionStartIncluding\": \"2.6.30\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:45:47.823Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-56650\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:45:47.823Z\", \"dateReserved\": \"2024-12-27T15:00:39.840Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-12-27T15:02:50.098Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.