Executive Summary

Informations
Name CVE-2024-50072 First vendor Publication 2024-10-29
Vendor Cve Last vendor Modification 2024-11-08

Security-Database Scoring CVSS v3

Cvss vector : CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Overall CVSS Score 5.5
Base Score 5.5 Environmental Score 5.5
impact SubScore 3.6 Temporal Score 5.5
Exploitabality Sub Score 1.8
 
Attack Vector Local Attack Complexity Low
Privileges Required Low User Interaction None
Scope Unchanged Confidentiality Impact None
Integrity Impact None Availability Impact High
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector :
Cvss Base Score N/A Attack Range N/A
Cvss Impact Score N/A Attack Complexity N/A
Cvss Expoit Score N/A Authentication N/A
Calculate full CVSS 2.0 Vectors scores

Detail

In the Linux kernel, the following vulnerability has been resolved:

x86/bugs: Use code segment selector for VERW operand

Robert Gill reported below #GP in 32-bit mode when dosemu software was executing vm86() system call:

general protection fault: 0000 [#1] PREEMPT SMP
CPU: 4 PID: 4610 Comm: dosemu.bin Not tainted 6.6.21-gentoo-x86 #1
Hardware name: Dell Inc. PowerEdge 1950/0H723K, BIOS 2.7.0 10/30/2010
EIP: restore_all_switch_stack+0xbe/0xcf
EAX: 00000000 EBX: 00000000 ECX: 00000000 EDX: 00000000
ESI: 00000000 EDI: 00000000 EBP: 00000000 ESP: ff8affdc
DS: 0000 ES: 0000 FS: 0000 GS: 0033 SS: 0068 EFLAGS: 00010046
CR0: 80050033 CR2: 00c2101c CR3: 04b6d000 CR4: 000406d0
Call Trace:
show_regs+0x70/0x78
die_addr+0x29/0x70
exc_general_protection+0x13c/0x348
exc_bounds+0x98/0x98
handle_exception+0x14d/0x14d
exc_bounds+0x98/0x98
restore_all_switch_stack+0xbe/0xcf
exc_bounds+0x98/0x98
restore_all_switch_stack+0xbe/0xcf

This only happens in 32-bit mode when VERW based mitigations like MDS/RFDS are enabled. This is because segment registers with an arbitrary user value can result in #GP when executing VERW. Intel SDM vol. 2C documents the following behavior for VERW instruction:

#GP(0) - If a memory operand effective address is outside the CS, DS, ES,
FS, or GS segment limit.

CLEAR_CPU_BUFFERS macro executes VERW instruction before returning to user space. Use %cs selector to reference VERW operand. This ensures VERW will not #GP for an arbitrary user %ds.

[ mingo: Fixed the SOB chain. ]

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-50072

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 8
Os 3639

Sources (Detail)

https://git.kernel.org/stable/c/38c5fe74f3bef98f75d16effa49836d50c9b6097
https://git.kernel.org/stable/c/481b477ab63c7245715a3e57ba79eb87c2dc0d02
https://git.kernel.org/stable/c/ada431c6c31a2c8c37991c46089af5caa23a9c6e
https://git.kernel.org/stable/c/bc576fbaf82deded606e69a00efe9752136bf91d
https://git.kernel.org/stable/c/bfd1d223d80cb29a210caa1bd5e21f0816d58f02
https://git.kernel.org/stable/c/e4d2102018542e3ae5e297bc6e229303abff8a0f
Source Url

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
6
7
8
9
10
Date Informations
2024-11-23 03:04:37
  • Multiple Updates
2024-11-22 03:02:44
  • Multiple Updates
2024-11-20 03:01:02
  • Multiple Updates
2024-11-13 21:21:25
  • Multiple Updates
2024-11-09 00:28:03
  • Multiple Updates
2024-11-08 21:27:49
  • Multiple Updates
2024-11-01 17:27:41
  • Multiple Updates
2024-10-30 02:56:01
  • Multiple Updates
2024-10-30 02:55:25
  • Multiple Updates
2024-10-29 17:27:31
  • Multiple Updates
2024-10-29 09:27:31
  • First insertion