{
  "threat_severity" : "Moderate",
  "public_date" : "2024-11-05T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: xfrm: fix one more kernel-infoleak in algo dumping",
    "id" : "2323930",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2323930"
  },
  "cvss3" : {
    "cvss3_base_score" : "5.5",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
    "status" : "verified"
  },
  "cwe" : "CWE-908",
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\nxfrm: fix one more kernel-infoleak in algo dumping\nDuring fuzz testing, the following issue was discovered:\nBUG: KMSAN: kernel-infoleak in _copy_to_iter+0x598/0x2a30\n_copy_to_iter+0x598/0x2a30\n__skb_datagram_iter+0x168/0x1060\nskb_copy_datagram_iter+0x5b/0x220\nnetlink_recvmsg+0x362/0x1700\nsock_recvmsg+0x2dc/0x390\n__sys_recvfrom+0x381/0x6d0\n__x64_sys_recvfrom+0x130/0x200\nx64_sys_call+0x32c8/0x3cc0\ndo_syscall_64+0xd8/0x1c0\nentry_SYSCALL_64_after_hwframe+0x79/0x81\nUninit was stored to memory at:\ncopy_to_user_state_extra+0xcc1/0x1e00\ndump_one_state+0x28c/0x5f0\nxfrm_state_walk+0x548/0x11e0\nxfrm_dump_sa+0x1e0/0x840\nnetlink_dump+0x943/0x1c40\n__netlink_dump_start+0x746/0xdb0\nxfrm_user_rcv_msg+0x429/0xc00\nnetlink_rcv_skb+0x613/0x780\nxfrm_netlink_rcv+0x77/0xc0\nnetlink_unicast+0xe90/0x1280\nnetlink_sendmsg+0x126d/0x1490\n__sock_sendmsg+0x332/0x3d0\n____sys_sendmsg+0x863/0xc30\n___sys_sendmsg+0x285/0x3e0\n__x64_sys_sendmsg+0x2d6/0x560\nx64_sys_call+0x1316/0x3cc0\ndo_syscall_64+0xd8/0x1c0\nentry_SYSCALL_64_after_hwframe+0x79/0x81\nUninit was created at:\n__kmalloc+0x571/0xd30\nattach_auth+0x106/0x3e0\nxfrm_add_sa+0x2aa0/0x4230\nxfrm_user_rcv_msg+0x832/0xc00\nnetlink_rcv_skb+0x613/0x780\nxfrm_netlink_rcv+0x77/0xc0\nnetlink_unicast+0xe90/0x1280\nnetlink_sendmsg+0x126d/0x1490\n__sock_sendmsg+0x332/0x3d0\n____sys_sendmsg+0x863/0xc30\n___sys_sendmsg+0x285/0x3e0\n__x64_sys_sendmsg+0x2d6/0x560\nx64_sys_call+0x1316/0x3cc0\ndo_syscall_64+0xd8/0x1c0\nentry_SYSCALL_64_after_hwframe+0x79/0x81\nBytes 328-379 of 732 are uninitialized\nMemory access of size 732 starts at ffff88800e18e000\nData copied to user address 00007ff30f48aff0\nCPU: 2 PID: 18167 Comm: syz-executor.0 Not tainted 6.8.11 #1\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\nFixes copying of xfrm algorithms where some random\ndata of the structure fields can end up in userspace.\nPadding in structures may be filled with random (possibly sensitve)\ndata and should never be given directly to user-space.\nA similar issue was resolved in the commit\n8222d5910dae (\"xfrm: Zero padding when dumping algos and encap\")\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller.", "A vulnerability was found in the `xfrm` module in the Linux Kernel. This issue was discovered during fuzz testing, where uninitialized memory containing potentially sensitive data was inadvertently copied to user-space. This issue occurs when dumping IPsec algorithm data structures, exposing random padding from the structures. This issue could lead to information leaks if uninitialized memory is accessed by user-space applications." ],
  "statement" : "This vulnerability is considered moderate severity. While it involves the leakage of uninitialized kernel memory, it requires specific conditions to be exploited. The information leaked consists of random padding within data structures, which is less likely to contain critical information compared to more sensitive kernel data, such as encryption keys or user credentials.",
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2024-12-11T00:00:00Z",
    "advisory" : "RHSA-2024:10944",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8::nfv",
    "package" : "kernel-rt-0:4.18.0-553.32.1.rt7.373.el8_10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2024-12-11T00:00:00Z",
    "advisory" : "RHSA-2024:10943",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8",
    "package" : "kernel-0:4.18.0-553.32.1.el8_10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2024-12-19T00:00:00Z",
    "advisory" : "RHSA-2024:11486",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-503.19.1.el9_5"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2024-12-19T00:00:00Z",
    "advisory" : "RHSA-2024:11486",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-503.19.1.el9_5"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.4 Extended Update Support",
    "release_date" : "2025-02-19T00:00:00Z",
    "advisory" : "RHSA-2025:1658",
    "cpe" : "cpe:/a:redhat:rhel_eus:9.4",
    "package" : "kernel-0:5.14.0-427.55.1.el9_4"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Out of support scope",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Out of support scope",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Out of support scope",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2024-50110\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-50110\nhttps://lore.kernel.org/linux-cve-announce/2024110554-CVE-2024-50110-b4aa@gregkh/T" ],
  "name" : "CVE-2024-50110",
  "mitigation" : {
    "value" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
    "lang" : "en:us"
  },
  "csaw" : false
}