{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-50188", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-10-21T19:36:19.967Z", "datePublished": "2024-11-08T05:38:29.127Z", "dateUpdated": "2026-08-05T11:42:23.945Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:42:23.945Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: phy: dp83869: fix memory corruption when enabling fiber\n\nWhen configuring the fiber port, the DP83869 PHY driver incorrectly\ncalls linkmode_set_bit() with a bit mask (1 << 10) rather than a bit\nnumber (10). This corrupts some other memory location -- in case of\narm64 the priv pointer in the same structure.\n\nSince the advertising flags are updated from supported at the end of the\nfunction the incorrect line isn't needed at all and can be removed." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable code is a PHY driver init routine reached only through local device probe, interface bring-up, or the SIOCSMIIREG/ethtool local ioctl paths; no network-supplied data reaches it.\nAC:L - On an affected system (DP83869 PHY strapped or DT-configured for fiber, RGMII_100_BASE/RGMII_1000_BASE) the out-of-bounds write is fully deterministic — it executes on every config_init with no race to win and no memory layout to groom.\nPR:L - The corrupting write executes automatically during device probe at boot with no privilege exercised, and re-triggering via interface re-init requires only local presence on the affected board; CAP_NET_ADMIN gates only some of the re-entry paths, so the lowest plausible requirement is an ordinary local user.\nUI:N - The memory corruption occurs during driver probe and PHY hardware initialization with no victim action required.\nS:U - The out-of-bounds write stays inside kernel memory (struct phy_device) and is handled by the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is an out-of-bounds write that corrupts a kernel pointer, and the resulting misaligned/garbage pointer causes the driver to read from unintended kernel memory, which per kernel scoring guidance for memory corruption is treated as High.\nI:H - An out-of-bounds write past the end of the linkmode bitmap corrupts adjacent kernel state — in common configurations the phydev->priv or LED-trigger pointer — which is memory corruption of kernel data structures.\nA:H - Dereferencing the corrupted pointer during routine link-status polling and subsequent config_init calls leads to bogus accesses and kernel oops/alignment faults, taking the network interface and potentially the system down." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/phy/dp83869.c" ], "versions": [ { "version": "a29de52ba2a156873505d8b8cef44e69925b8114", "lessThan": "21b5af7f0c99b3bf1fd02016e6708b613acbcaf4", "status": "affected", "versionType": "git" }, { "version": "a29de52ba2a156873505d8b8cef44e69925b8114", "lessThan": "ad0d76b8ee5db063791cc2e7a30ffc9852ac37c4", "status": "affected", "versionType": "git" }, { "version": "a29de52ba2a156873505d8b8cef44e69925b8114", "lessThan": "c1944b4253649fc6f2fb53e7d6302eb414d2182c", "status": "affected", "versionType": "git" }, { "version": "a29de52ba2a156873505d8b8cef44e69925b8114", "lessThan": "9ca634676ff66e1d616259e136f96f96b2a1759a", "status": "affected", "versionType": "git" }, { "version": "a29de52ba2a156873505d8b8cef44e69925b8114", "lessThan": "e3f2de32dae35bc7d173377dc97b5bc9fcd9fc84", "status": "affected", "versionType": "git" }, { "version": "a29de52ba2a156873505d8b8cef44e69925b8114", "lessThan": "a842e443ca8184f2dc82ab307b43a8b38defd6a5", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/phy/dp83869.c" ], "versions": [ { "version": "5.10", "status": "affected" }, { "version": "0", "lessThan": "5.10", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.227", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.168", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.113", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.57", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.11.4", "lessThanOrEqual": "6.11.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "5.10.227" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "5.15.168" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.1.113" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.6.57" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.11.4" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.12" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/21b5af7f0c99b3bf1fd02016e6708b613acbcaf4" }, { "url": "https://git.kernel.org/stable/c/ad0d76b8ee5db063791cc2e7a30ffc9852ac37c4" }, { "url": "https://git.kernel.org/stable/c/c1944b4253649fc6f2fb53e7d6302eb414d2182c" }, { "url": "https://git.kernel.org/stable/c/9ca634676ff66e1d616259e136f96f96b2a1759a" }, { "url": "https://git.kernel.org/stable/c/e3f2de32dae35bc7d173377dc97b5bc9fcd9fc84" }, { "url": "https://git.kernel.org/stable/c/a842e443ca8184f2dc82ab307b43a8b38defd6a5" } ], "title": "net: phy: dp83869: fix memory corruption when enabling fiber", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE" } }, { "other": { "type": "ssvc", "content": { "id": "CVE-2024-50188", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2025-10-01T20:18:28.121438Z" } } } ], "problemTypes": [ { "descriptions": [ { "lang": "en", "type": "CWE", "description": "CWE-noinfo Not enough information" } ] } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-01T20:27:08.863Z" } }, { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:26:41.710Z" } }, { "x_adpType": "supplier", "providerMetadata": { "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-05-12T12:00:26.496Z" }, "affected": [ { "vendor": "Siemens", "product": "RUGGEDCOM RST2428P", "versions": [ { "status": "affected", "version": "0", "lessThan": "V3.2", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family", "versions": [ { "status": "affected", "version": "0", "lessThan": "V3.2", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SCALANCE XCM-/XRM-/XCH-/XRH-300 family", "versions": [ { "status": "affected", "version": "0", "lessThan": "V3.2", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [ { "status": "affected", "version": "0", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" } ], "references": [ { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-355557.html" } ] } ] } }