CVE-2024-50299
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2024-50299
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-50299.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2024-50299
- Downstream
- Related
- Published
- 2024-11-19T01:30:47.362Z
- Modified
- 2025-11-28T02:34:32.764848Z
- Severity
-
- 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- sctp: properly validate chunk size in sctp_sf_ootb()
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
sctp: properly validate chunk size in sctpsfootb()
A size validation fix similar to that in Commit 50619dbf8db7 ("sctp: add size validation when walking chunks") is also required in sctpsfootb() to address a crash reported by syzbot:
BUG: KMSAN: uninit-value in sctpsfootb+0x7f5/0xce0 net/sctp/smstatefuns.c:3712 sctpsfootb+0x7f5/0xce0 net/sctp/smstatefuns.c:3712 sctpdosm+0x181/0x93d0 net/sctp/smsideeffect.c:1166 sctpendpointbhrcv+0xc38/0xf90 net/sctp/endpointola.c:407 sctpinqpush+0x2ef/0x380 net/sctp/inqueue.c:88 sctprcv+0x3831/0x3b20 net/sctp/input.c:243 sctp4rcv+0x42/0x50 net/sctp/protocol.c:1159 ipprotocoldeliverrcu+0xb51/0x13d0 net/ipv4/ipinput.c:205 iplocaldeliverfinish+0x336/0x500 net/ipv4/ipinput.c:233
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/50xxx/CVE-2024-50299.json" }- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/0ead60804b64f5bd6999eec88e503c6a1a242d41
- https://git.kernel.org/stable/c/40b283ba76665437bc2ac72079c51b57b25bff9e
- https://git.kernel.org/stable/c/67b9a278b80f71ec62091ded97c6bcbea33b5ec3
- https://git.kernel.org/stable/c/8820d2d6589f62ee5514793fff9b50c9f8101182
- https://git.kernel.org/stable/c/9b5d42aeaf1a52f73b003a33da6deef7df34685f
- https://git.kernel.org/stable/c/a758aa6a773bb872196bcc3173171ef8996bddf0
- https://git.kernel.org/stable/c/bf9bff13225baf5f658577f7d985fc4933d79527
- https://git.kernel.org/stable/c/d3fb3cc83cf313e4f87063ce0f3fea76b071567b
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/50xxx/CVE-2024-50299.json
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html
- https://nvd.nist.gov/vuln/detail/CVE-2024-50299
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced1da177e4c3f41524e886b7f1b8a0c1fc7321cac2Fixed67b9a278b80f71ec62091ded97c6bcbea33b5ec3Fixed9b5d42aeaf1a52f73b003a33da6deef7df34685fFixed40b283ba76665437bc2ac72079c51b57b25bff9eFixeda758aa6a773bb872196bcc3173171ef8996bddf0Fixedbf9bff13225baf5f658577f7d985fc4933d79527Fixedd3fb3cc83cf313e4f87063ce0f3fea76b071567bFixed8820d2d6589f62ee5514793fff9b50c9f8101182Fixed0ead60804b64f5bd6999eec88e503c6a1a242d41
Linux / Kernel
Package
- Name
- Kernel
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced2.6.12Fixed4.19.324
- Type
- ECOSYSTEM
- Events
-
Introduced4.20.0Fixed5.4.286
- Type
- ECOSYSTEM
- Events
-
Introduced5.5.0Fixed5.10.230
- Type
- ECOSYSTEM
- Events
-
Introduced5.11.0Fixed5.15.172
- Type
- ECOSYSTEM
- Events
-
Introduced5.16.0Fixed6.1.117
- Type
- ECOSYSTEM
- Events
-
Introduced6.2.0Fixed6.6.61
- Type
- ECOSYSTEM
- Events
-
Introduced6.7.0Fixed6.11.8