LiveActive security incident?Get immediate response
CVE Record

CVE-2024-50264: vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans During loopback communication, a dangling pointer can be created in vsk->trans, potentially leading to a Use-After-Free condition. This issue is resolved by initializing vsk->trans to NULL.

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux kernel flaw in virtual-socket loopback communication can leave software referencing freed memory. A local, low-privileged attacker may be able to crash or compromise an affected system, threatening data confidentiality, integrity, and availability. No user interaction is required.

Executive priority

Treat this as a prompt kernel-patching priority, especially on shared or multi-user systems where untrusted users have local access. It is high severity but not documented as actively exploited or directly remotely reachable in the supplied evidence.

Technical view

The virtio-vsock loopback path can leave vsk->trans pointing to freed memory, creating a kernel use-after-free condition classified as CWE-416. The upstream correction initializes vsk->trans to NULL. CVSS 3.1 rates it 7.8: local access, low complexity, low privileges, no user interaction, and high potential impact.

Likely exposure

Linux systems running vulnerable kernels and exercising virtio-vsock loopback communication are candidates. Exploitation requires local, low-privileged access. The supplied version array is flattened and ambiguous, so determine exact exposure through upstream records and distribution backport advisories.

Exploitation context

CISA KEV status is false, and no supplied source establishes active exploitation. A public research article exists, but its presence alone does not demonstrate real-world attacks or mature public exploitation. The CVSS vector describes a local rather than directly remote attack path.

Researcher notes

The core defect is a dangling vsk->trans pointer during loopback communication. Multiple stable commits indicate branch-specific fixes. The extracted version list does not preserve clear range relationships; do not treat every listed value as definitively vulnerable or fixed without checking the authoritative record and vendor backports.

Mitigation direction

  • Install a vendor-supported kernel containing the applicable upstream fix or distribution backport.
  • Follow distribution guidance to identify the corrected package for each deployed kernel branch.
  • Prioritize affected systems allowing untrusted local access and using virtio-vsock loopback communication.
  • Reboot after updating and confirm the corrected kernel is running.
  • If patching is delayed, consult vendor guidance; the supplied sources name no temporary mitigation.

Validation and detection

  • Inventory running kernel versions and identify systems using virtio-vsock functionality.
  • Compare installed packages with distribution advisories and upstream branch-specific fixes.
  • Confirm package documentation references CVE-2024-50264 or an equivalent backport.
  • After rebooting, verify the active kernel matches the corrected package.
  • Repeat vulnerability scanning and document any systems awaiting vendor clarification.
Prepared
Confidence
medium
Sources
12

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-416: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2024-50264 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

2CVSS vectors
3Timeline events
2ADP providers
12Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: total

CVSS vector scores

2 official scores

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADP

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2024-50264Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
cvssV3_1other:ssvc
CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux06a8fc78367d070720af960dcecec917d3ae5f3b, 06a8fc78367d070720af960dcecec917d3ae5f3b, 06a8fc78367d070720af960dcecec917d3ae5f3b, 06a8fc78367d070720af960dcecec917d3ae5f3b, 06a8fc78367d070720af960dcecec917d3ae5f3b, 06a8fc78367d070720af960dcecec917d3ae5f3b, 06a8fc78367d070720af960dcecec917d3ae5f3b, 06a8fc78367d070720af960dcecec917d3ae5f3bunaffected
LinuxLinux4.8, 0, 4.19.324, 5.4.286, 5.10.230, 5.15.172, 6.1.117, 6.6.61, 6.11.8, 6.12affected
Weakness

CWE details

CWE-416

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-416 · source CWE mapping

Use After Free

Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs