CVE-2024-50142: xfrm: validate new SA's prefixlen using SA family when sel.family is unset

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-11-07 · updated 2026-10-15

Description

In the Linux kernel, the following vulnerability has been resolved: xfrm: validate new SA's prefixlen using SA family when sel.family is unset This expands the validation introduced in commit 07bf7908950a ("xfrm: Validate address prefix lengths in the xfrm selector.") syzbot created an SA with usersa.sel.family = AF_UNSPEC usersa.sel.prefixlen_s = 128 usersa.family = AF_INET Because of the AF_UNSPEC selector, verify_newsa_info doesn't put limits on prefixlen_{s,d}. But then copy_from_user_state sets x->sel.family to usersa.family (AF_INET). Do the same conversion in verify_newsa_info before validating prefixlen_{s,d}, since that's how prefixlen is going to be used later on.

Affected products

Linux kernel: from 2.6.12 before 4.19.323; from 4.20 before 5.4.285; from 5.5 before 5.10.229; from 5.11 before 5.15.170; from 5.16 before 6.1.115; from 6.2 before 6.6.59 — fixed in 4.19.323, 5.10.229, 5.15.170, 5.4.285, 6.1.115, 6.11.6

How to fix

Upgrade to a fixed version: Linux kernel 4.19.323, 5.10.229, 5.15.170, 5.4.285. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-50142 or the next vulnerability affects your stack