Security readout for executives and security teams
Plain-English summary
A Linux kernel networking flaw can crash an affected host when a particular XDP/eBPF redirect workflow is used. After traffic is redirected through a device map, the next program may receive missing interface data and trigger a kernel NULL-pointer fault. Exposure is specialized, but impact can be serious on systems using this packet-processing configuration.
Executive priority
Prioritize remediation on network appliances, observability hosts, and other systems confirmed to use the affected XDP workflow. Accelerate normal kernel patching elsewhere, but do not infer universal Internet exposure from the critical score alone. The demonstrated business risk is host disruption; broader compromise is not established by the supplied evidence.
Technical view
After BPF_MAP_TYPE_DEVMAP or DEVMAP_HASH redirection, the kernel failed to provide the receive-queue pointer required by the subsequent XDP program. Reading rxq-dependent data such as ingress_ifindex could dereference NULL and produce a kernel oops. Stable kernel commits initialize the missing pointer. The supplied evidence directly demonstrates availability impact, not confidentiality or integrity compromise.
Likely exposure
The bundle identifies affected Linux kernel version ranges beginning with 5.14, but its summarized boundaries are insufficient for exact package decisions. Practical exposure is concentrated on hosts using XDP/eBPF DEVMAP redirects followed by programs accessing receive-queue-dependent metadata. Merely running Linux or exposing a network service does not, from the supplied evidence alone, establish reachability.
Exploitation context
The bundle marks KEV as false, and no supplied source reports active exploitation or a public exploit. The documented trigger is a configured XDP redirect and post-redirect metadata access. The sources do not establish how an unauthenticated remote attacker could create that configuration, despite the bundled CVSS 9.8 network vector. Treat the exploitation path as incompletely evidenced.
Researcher notes
The root cause and crash trace are well supported: rxq was unset after devmap redirection, and ingress_ifindex access caused a NULL dereference. Multiple stable commits indicate branch-specific fixes. Exact affected package boundaries, attacker prerequisites, confidentiality impact, integrity impact, and real-world exploitation are not fully established in the bundle and require vendor-specific verification.
Mitigation direction
- Update to a vendor-supported kernel containing the applicable stable fix, following distribution guidance.
- Prioritize hosts running XDP/eBPF networking, especially DEVMAP redirect chains.
- If patching is delayed, avoid affected post-redirect programs and confirm operational impact with the vendor.
- Apply the relevant Debian LTS kernel update where the cited advisory governs the system.
Validation and detection
- Inventory running kernel versions and compare them with vendor advisories and applicable stable fix commits.
- Identify loaded XDP programs using DEVMAP or DEVMAP_HASH redirects with post-redirect execution.
- Review kernel logs for NULL-pointer oops traces involving post-redirect BPF programs or bq_xmit_all.
- After updating, confirm the running kernel includes the branch-appropriate fix and repeat safe staging tests.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-50162 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9LinuxCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/fe068afb868660fe683a8391c6c17ecbe2254922CVE reference, Linux
- https://git.kernel.org/stable/c/a778fbe087c19f4ece5f5fc14173328f070c3803CVE reference, Linux
- https://git.kernel.org/stable/c/49454f09936a9a96edfb047156889879cb4001ebCVE reference, Linux
- https://git.kernel.org/stable/c/9167d1c274a336e4763eeb3f3f9cb763c55df5aaCVE reference, Linux
- https://git.kernel.org/stable/c/ca9984c5f0ab3690d98b13937b2485a978c8dd73CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.