{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-50062", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-10-21T19:36:19.939Z", "datePublished": "2024-10-21T19:39:51.078Z", "dateUpdated": "2026-08-05T11:41:19.362Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:41:19.362Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rtrs-srv: Avoid null pointer deref during path establishment\n\nFor RTRS path establishment, RTRS client initiates and completes con_num\nof connections. After establishing all its connections, the information\nis exchanged between the client and server through the info_req message.\nDuring this exchange, it is essential that all connections have been\nestablished, and the state of the RTRS srv path is CONNECTED.\n\nSo add these sanity checks, to make sure we detect and abort process in\nerror scenarios to avoid null pointer deref." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:N - The rtrs/rnbd server is a network target service listening on RDMA CM port 1234, reachable by any remote peer over RoCEv2 or iWARP, both of which are IP-routable; the trigger is entirely attacker-supplied connect private data plus a subsequent RDMA send message.\nAC:L - The attacker fully controls `con_num` in the connect request and chooses when to send the info_req message, so establishing only connection cid 0 while advertising con_num > 1 makes `s.con[1]` reliably NULL every time — no race and no memory-layout dependency.\nPR:N - `rtrs_rdma_connect()` validates only magic, protocol version, and cid bounds — there is no authentication, credential check, or access control anywhere on the path establishment sequence, and the bug fires before any device-level authorization in rnbd-srv.\nUI:N - The remote client drives the entire connection handshake and info_req exchange autonomously; no action by a local user or administrator is needed beyond the server already running.\nS:U - The fault occurs in kernel workqueue context within the same security authority; there is no crossing of a VM, IOMMU, or sandbox boundary.\nC:N - The defect is a NULL pointer dereference at a small fixed offset that faults immediately in `ib_post_recv()`; no attacker-influenced memory is read back or disclosed.\nI:N - No out-of-bounds or freed memory is written — execution aborts at the faulting read, and `mmap_min_addr` prevents the low address from being attacker-mapped to gain a write primitive.\nA:H - The dereference produces a kernel oops in `ib-comp-wq` context (a full panic with panic_on_oops), and any unauthenticated remote peer can repeat it at will to permanently deny service on the storage target." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/infiniband/ulp/rtrs/rtrs-srv.c" ], "versions": [ { "version": "9cb837480424e78ed585376f944088246685aec3", "lessThan": "394b2f4d5e014820455af3eb5859eb328eaafcfd", "status": "affected", "versionType": "git" }, { "version": "9cb837480424e78ed585376f944088246685aec3", "lessThan": "b5d4076664465487a9a3d226756995b12fb73d71", "status": "affected", "versionType": "git" }, { "version": "9cb837480424e78ed585376f944088246685aec3", "lessThan": "ccb8e44ae3e2391235f80ffc6be59bec6b889ead", "status": "affected", "versionType": "git" }, { "version": "9cb837480424e78ed585376f944088246685aec3", "lessThan": "b720792d7e8515bc695752e0ed5884e2ea34d12a", "status": "affected", "versionType": "git" }, { "version": "9cb837480424e78ed585376f944088246685aec3", "lessThan": "d0e62bf7b575fbfe591f6f570e7595dd60a2f5eb", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/infiniband/ulp/rtrs/rtrs-srv.c" ], "versions": [ { "version": "5.8", "status": "affected" }, { "version": "0", "lessThan": "5.8", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.168", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.113", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.57", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.11.4", "lessThanOrEqual": "6.11.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "5.15.168" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.1.113" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.6.57" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.11.4" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.12" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/394b2f4d5e014820455af3eb5859eb328eaafcfd" }, { "url": "https://git.kernel.org/stable/c/b5d4076664465487a9a3d226756995b12fb73d71" }, { "url": "https://git.kernel.org/stable/c/ccb8e44ae3e2391235f80ffc6be59bec6b889ead" }, { "url": "https://git.kernel.org/stable/c/b720792d7e8515bc695752e0ed5884e2ea34d12a" }, { "url": "https://git.kernel.org/stable/c/d0e62bf7b575fbfe591f6f570e7595dd60a2f5eb" } ], "title": "RDMA/rtrs-srv: Avoid null pointer deref during path establishment", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2024-50062", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-10-22T13:22:44.962134Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-22T13:28:42.012Z" } }, { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:25:02.147Z" } } ] } }