Security readout for executives and security teams
Plain-English summary
CVE-2024-50142 is a Linux kernel flaw in IPsec/XFRM security association validation. A local privileged path can supply inconsistent address-family and prefix-length values, leading to availability impact. The public record shows fixes in Linux stable commits and downstream Debian advisories; it does not show active exploitation.
Executive priority
Treat as routine but time-bound kernel maintenance. The issue can affect availability, but evidence indicates local access requirements and no confirmed active exploitation. Prioritize exposed shared Linux environments and systems supporting VPN/IPsec functions.
Technical view
The XFRM code validated selector prefix lengths before normalizing an unset selector family to the security association family. A crafted new SA with AF_UNSPEC selector family, IPv6-sized prefix length, and AF_INET SA family could bypass intended limits. The fix performs the same family conversion during verification before prefix-length validation.
Likely exposure
Exposure is mainly Linux systems running affected kernel versions where local users, services, or containers can reach XFRM/IPsec security association management paths. Internet-facing exposure is not indicated by the CVSS vector or sources.
Exploitation context
Sources support local, low-privilege, no-user-interaction availability impact with CVSS 5.5. KEV is false, and the provided sources do not cite public exploitation or weaponized proof-of-concept activity.
Researcher notes
The root issue is validation order in verify_newsa_info versus later copy_from_user_state behavior. The record names syzbot as the discoverer context and links multiple stable backports, but does not provide crash details beyond availability impact.
Mitigation direction
- Apply vendor kernel updates containing the referenced Linux stable fixes.
- Prioritize multi-user, container, VPN, and IPsec-capable Linux hosts.
- Review Debian LTS advisories if using affected Debian kernels.
- Check vendor guidance for any supported temporary mitigations.
- Limit unnecessary access to XFRM/IPsec administration until patched.
Validation and detection
- Inventory Linux kernel versions across servers, appliances, and containers hosts.
- Compare installed kernels against vendor advisories and fixed stable releases.
- Check whether workloads require XFRM/IPsec security association management.
- Confirm patched kernels are booted, not only installed.
- Track exceptions until vendor-fixed kernels are deployed.
Public sources used
- CVE Program
- CVE List V5
- Linux stable commit f31398570acf
- Linux stable commit 401ad99a5ae7
- Linux stable commit 8df5cd51fd70
- Linux stable commit 2d08a6c31c65
- Linux stable commit bce1afaa212e
- Linux stable commit 7d9868180bd1
- Linux stable commit e68dd80ba498
- Linux stable commit 3f0ab59e6537
- Debian LTS advisory January 2025
- Debian LTS advisory March 2025
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-50142 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/f31398570acf0f0804c644006f7bfa9067106b0aCVE reference, Linux
- https://git.kernel.org/stable/c/401ad99a5ae7180dd9449eac104cb755f442e7f3CVE reference, Linux
- https://git.kernel.org/stable/c/8df5cd51fd70c33aa1776e5cbcd82b0a86649d73CVE reference, Linux
- https://git.kernel.org/stable/c/2d08a6c31c65f23db71a5385ee9cf9d8f9a67a71CVE reference, Linux
- https://git.kernel.org/stable/c/bce1afaa212ec380bf971614f70909a27882b862CVE reference, Linux
- https://git.kernel.org/stable/c/7d9868180bd1e4cf37e7c5067362658971162366CVE reference, Linux
- https://git.kernel.org/stable/c/e68dd80ba498265d2266b12dc3459164f4ff0c4aCVE reference, Linux
- https://git.kernel.org/stable/c/3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
- https://cert-portal.siemens.com/productcert/html/ssa-265688.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.