Security readout for executives and security teams
Plain-English summary
A Linux kernel timing flaw can let trusted-key sealing or unsealing continue after a temporary memory buffer is gone. Under system load, this can trigger a NULL-pointer dereference in the DCP crypto driver, potentially crashing the system. The supplied CVSS score is 7.8, reflecting high local impact.
Executive priority
Treat this as high priority where affected DCP-backed trusted-key functionality is used, especially on multi-user or locally accessible systems. For other Linux systems, first establish whether the vulnerable path and affected kernel are present before escalating emergency remediation.
Technical view
The trusted-key DCP path submitted an AEAD request asynchronously without waiting for completion. Seal or unseal could return while the operation still referenced a stack buffer, causing unsafe access and observed NULL dereferences during blob creation. The cited kernel changes make these calls wait for AEAD completion.
Likely exposure
Exposure is limited to Linux systems using the affected trusted-key DCP cryptographic path. The bundle marks Linux 6.11, 6.11.8, and 6.12 as affected, but its version formatting is ambiguous. Confirm the status of each distribution kernel and backported fix with its vendor.
Exploitation context
The CVSS vector describes a local, low-complexity attack requiring low privileges and no user interaction. The supplied sources do not establish active exploitation, and the CVE is not identified as being in KEV. Do not interpret that absence as proof exploitation is impossible.
Researcher notes
This is CWE-476 arising from asynchronous completion and stack-buffer lifetime handling, rather than a generic remote flaw. The description documents NULL dereferences, while the CVSS vector assigns high confidentiality, integrity, and availability impacts. The supplied evidence does not explain a demonstrated path to those broader impacts.
Mitigation direction
- Install a vendor kernel release containing the cited upstream fix.
- Prioritize systems using trusted keys with DCP-backed cryptographic operations.
- Check distribution advisories for backported fixes and exact affected package versions.
- Restrict unnecessary local access until affected systems are updated.
Validation and detection
- Inventory kernel versions on systems supporting DCP-backed trusted keys.
- Confirm whether deployed kernels contain either cited corrective commit or an equivalent backport.
- Review kernel logs for DCP NULL dereferences during trusted-key blob operations.
- After updating, verify trusted-key sealing and unsealing complete reliably under normal load.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-476: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-50281 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/c75e0272289eae18c5379518a9c56ef31d65cc7dCVE reference, Linux
- https://git.kernel.org/stable/c/04de7589e0a95167d803ecadd115235ba2c14997CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
NULL Pointer Dereference
NULL Pointer Dereference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.