GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-50281 (GCVE-0-2024-50281)

Vulnerability from cvelistv5 – Published: 2024-11-19 01:30 – Updated: 2026-08-05 11:43
VLAI
Title
KEYS: trusted: dcp: fix NULL dereference in AEAD crypto operation
Summary
In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: dcp: fix NULL dereference in AEAD crypto operation When sealing or unsealing a key blob we currently do not wait for the AEAD cipher operation to finish and simply return after submitting the request. If there is some load on the system we can exit before the cipher operation is done and the buffer we read from/write to is already removed from the stack. This will e.g. result in NULL pointer dereference errors in the DCP driver during blob creation. Fix this by waiting for the AEAD cipher operation to finish before resuming the seal and unseal calls.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-01 20:14 UTC
CWE
  • CWE-476 - NULL Pointer Dereference
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 0e28bf61a5f9ab30be3f3b4eafb8d097e39446bb , < c75e0272289eae18c5379518a9c56ef31d65cc7d (git)
Affected: 0e28bf61a5f9ab30be3f3b4eafb8d097e39446bb , < 04de7589e0a95167d803ecadd115235ba2c14997 (git)
Affected: 9e3b266afcfe4294e84496f50f006f029d3100db (git)
Affected: 6.10.7 , < 6.11 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.11
Unaffected: 0 , < 6.11 (semver)
Unaffected: 6.11.8 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-50281",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T20:14:40.365722Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-476",
                "description": "CWE-476 NULL Pointer Dereference",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T20:17:22.242Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "security/keys/trusted-keys/trusted_dcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c75e0272289eae18c5379518a9c56ef31d65cc7d",
              "status": "affected",
              "version": "0e28bf61a5f9ab30be3f3b4eafb8d097e39446bb",
              "versionType": "git"
            },
            {
              "lessThan": "04de7589e0a95167d803ecadd115235ba2c14997",
              "status": "affected",
              "version": "0e28bf61a5f9ab30be3f3b4eafb8d097e39446bb",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9e3b266afcfe4294e84496f50f006f029d3100db",
              "versionType": "git"
            },
            {
              "lessThan": "6.11",
              "status": "affected",
              "version": "6.10.7",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "security/keys/trusted-keys/trusted_dcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.8",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.10.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKEYS: trusted: dcp: fix NULL dereference in AEAD crypto operation\n\nWhen sealing or unsealing a key blob we currently do not wait for\nthe AEAD cipher operation to finish and simply return after submitting\nthe request. If there is some load on the system we can exit before\nthe cipher operation is done and the buffer we read from/write to\nis already removed from the stack. This will e.g. result in NULL\npointer dereference errors in the DCP driver during blob creation.\n\nFix this by waiting for the AEAD cipher operation to finish before\nresuming the seal and unseal calls."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached only through the `add_key()`/`keyctl()` syscalls on the \"trusted\" key type, requiring local access to the system. There is no network or remote-peer path into `trusted_dcp_seal()`/`trusted_dcp_unseal()`.\nAC:L - The attacker controls both sides of the race \u2014 they submit the AEAD requests via repeated `add_key()` calls and can generate the system load that delays async completion past the function\u0027s return, and they control what reuses the freed stack frame. No condition outside the attacker\u0027s influence is required on affected i.MX DCP hardware.\nPR:L - `trusted_instantiate()` and `trusted_update()` contain no capability or privilege checks, so any unprivileged local user can add or load a trusted key into their own keyring and drive `do_aead_crypto()`. Only basic local user access is needed.\nUI:N - The attacker triggers the bug entirely through their own syscalls; no victim action, mount, or file open is involved.\nS:U - The corruption and crash occur inside the kernel that the attacker is already interacting with, with no crossing into another security authority such as a hypervisor or IOMMU boundary.\nC:H - The in-flight operation reads from a scatterlist pointing into a reclaimed stack frame and uses a freed `aead_request`/tfm holding the AES-GCM blob key, so plaintext key material and adjacent memory can be written into reused allocations and exposed. This memory corruption is leverageable for information disclosure.\nI:H - After `aead_request_free()`/`crypto_free_aead()` return, the asynchronous DCP engine still writes its output through stale stack-resident scatterlists into memory that has been reclaimed and reused, giving an attacker-influenceable write into unrelated kernel objects \u2014 classic use-after-free/stack-corruption primitives for control-flow hijack.\nA:H - The commit documents that this produces NULL pointer dereference oopses in the DCP driver during blob creation, and use of the freed request/tfm crashes the kernel. An unprivileged user can trigger it repeatedly, causing denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:43:00.504Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c75e0272289eae18c5379518a9c56ef31d65cc7d"
        },
        {
          "url": "https://git.kernel.org/stable/c/04de7589e0a95167d803ecadd115235ba2c14997"
        }
      ],
      "title": "KEYS: trusted: dcp: fix NULL dereference in AEAD crypto operation",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-50281",
    "datePublished": "2024-11-19T01:30:23.275Z",
    "dateReserved": "2024-10-21T19:36:19.983Z",
    "dateUpdated": "2026-08-05T11:43:00.504Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-50281",
      "date": "2026-09-16",
      "epss": "0.00184",
      "percentile": "0.0818"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.11\", \"versionEndExcluding\": \"6.11.8\", \"matchCriteriaId\": \"728427FE-4653-45EF-AA11-DA6A6AF58B8F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.10.7:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6DF5EB33-2A8E-4768-B03E-823B0CCF32EF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"7F361E1D-580F-4A2D-A509-7615F73167A1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"925478D0-3E3D-4E6F-ACD5-09F28D5DF82C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"3C95E234-D335-4B6C-96BF-E2CEBD8654ED\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:*\", \"matchCriteriaId\": \"E0F717D8-3014-4F84-8086-0124B2111379\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc5:*:*:*:*:*:*\", \"matchCriteriaId\": \"24DBE6C7-2AAE-4818-AED2-E131F153D2FA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc6:*:*:*:*:*:*\", \"matchCriteriaId\": \"24B88717-53F5-42AA-9B72-14C707639E3F\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nKEYS: trusted: dcp: fix NULL dereference in AEAD crypto operation\\n\\nWhen sealing or unsealing a key blob we currently do not wait for\\nthe AEAD cipher operation to finish and simply return after submitting\\nthe request. If there is some load on the system we can exit before\\nthe cipher operation is done and the buffer we read from/write to\\nis already removed from the stack. This will e.g. result in NULL\\npointer dereference errors in the DCP driver during blob creation.\\n\\nFix this by waiting for the AEAD cipher operation to finish before\\nresuming the seal and unseal calls.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: KEYS: trusted: dcp: fix NULL dereference in AEAD cryptooperation Al sellar o desellar un blob de claves, actualmente no esperamos a que finalice la operaci\\u00f3n de cifrado AEAD y simplemente regresamos despu\\u00e9s de enviar la solicitud. Si hay alguna carga en el sistema, podemos salir antes de que finalice la operaci\\u00f3n de cifrado y el b\\u00fafer desde el que leemos/escribimos ya se elimin\\u00f3 de la pila. Esto, por ejemplo, dar\\u00e1 como resultado errores de desreferencia de puntero NULL en el controlador DCP durante la creaci\\u00f3n del blob. Solucione esto esperando a que finalice la operaci\\u00f3n de cifrado AEAD antes de reanudar las llamadas de sellado y dessellado.\"}]",
      "id": "CVE-2024-50281",
      "lastModified": "2024-11-21T19:27:19.097",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-11-19T02:16:30.413",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/04de7589e0a95167d803ecadd115235ba2c14997\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/c75e0272289eae18c5379518a9c56ef31d65cc7d\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-476\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-50281\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-11-19T02:16:30.413\",\"lastModified\":\"2026-08-04T11:21:40.183\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nKEYS: trusted: dcp: fix NULL dereference in AEAD crypto operation\\n\\nWhen sealing or unsealing a key blob we currently do not wait for\\nthe AEAD cipher operation to finish and simply return after submitting\\nthe request. If there is some load on the system we can exit before\\nthe cipher operation is done and the buffer we read from/write to\\nis already removed from the stack. This will e.g. result in NULL\\npointer dereference errors in the DCP driver during blob creation.\\n\\nFix this by waiting for the AEAD cipher operation to finish before\\nresuming the seal and unseal calls.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: KEYS: trusted: dcp: fix NULL dereference in AEAD cryptooperation Al sellar o desellar un blob de claves, actualmente no esperamos a que finalice la operaci\u00f3n de cifrado AEAD y simplemente regresamos despu\u00e9s de enviar la solicitud. Si hay alguna carga en el sistema, podemos salir antes de que finalice la operaci\u00f3n de cifrado y el b\u00fafer desde el que leemos/escribimos ya se elimin\u00f3 de la pila. Esto, por ejemplo, dar\u00e1 como resultado errores de desreferencia de puntero NULL en el controlador DCP durante la creaci\u00f3n del blob. Solucione esto esperando a que finalice la operaci\u00f3n de cifrado AEAD antes de reanudar las llamadas de sellado y dessellado.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"security/keys/trusted-keys/trusted_dcp.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"0e28bf61a5f9ab30be3f3b4eafb8d097e39446bb\",\"lessThan\":\"c75e0272289eae18c5379518a9c56ef31d65cc7d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0e28bf61a5f9ab30be3f3b4eafb8d097e39446bb\",\"lessThan\":\"04de7589e0a95167d803ecadd115235ba2c14997\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9e3b266afcfe4294e84496f50f006f029d3100db\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.10.7\",\"lessThan\":\"6.11\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"security/keys/trusted-keys/trusted_dcp.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.11\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.11\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11.8\",\"lessThanOrEqual\":\"6.11.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-10-01T20:14:40.365722Z\",\"id\":\"CVE-2024-50281\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.11\",\"versionEndExcluding\":\"6.11.8\",\"matchCriteriaId\":\"728427FE-4653-45EF-AA11-DA6A6AF58B8F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6DF5EB33-2A8E-4768-B03E-823B0CCF32EF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F361E1D-580F-4A2D-A509-7615F73167A1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"925478D0-3E3D-4E6F-ACD5-09F28D5DF82C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"3C95E234-D335-4B6C-96BF-E2CEBD8654ED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"E0F717D8-3014-4F84-8086-0124B2111379\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"24DBE6C7-2AAE-4818-AED2-E131F153D2FA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"24B88717-53F5-42AA-9B72-14C707639E3F\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/04de7589e0a95167d803ecadd115235ba2c14997\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c75e0272289eae18c5379518a9c56ef31d65cc7d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:40:53+00:00",
      "cve": "CVE-2024-50281",
      "id": "CVE-2024-50281",
      "initial_release_date": "2024-11-19T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: KEYS: trusted: dcp: fix NULL dereference in AEAD crypto operation",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-50281.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-01T13:57:55Z",
      "cve": "CVE-2024-50281",
      "id": "CVE-2024-50281",
      "initial_release_date": "2024-11-19T03:49:16Z",
      "product_status:known_not_affected": "477",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-50281",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-50281.json",
      "version": "22"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-50281\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-01T20:14:40.365722Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-476\", \"description\": \"CWE-476 NULL Pointer Dereference\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-01T15:26:44.665Z\"}}], \"cna\": {\"title\": \"KEYS: trusted: dcp: fix NULL dereference in AEAD crypto operation\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable code is reached only through the `add_key()`/`keyctl()` syscalls on the \\\"trusted\\\" key type, requiring local access to the system. There is no network or remote-peer path into `trusted_dcp_seal()`/`trusted_dcp_unseal()`.\\nAC:L - The attacker controls both sides of the race \\u2014 they submit the AEAD requests via repeated `add_key()` calls and can generate the system load that delays async completion past the function\u0027s return, and they control what reuses the freed stack frame. No condition outside the attacker\u0027s influence is required on affected i.MX DCP hardware.\\nPR:L - `trusted_instantiate()` and `trusted_update()` contain no capability or privilege checks, so any unprivileged local user can add or load a trusted key into their own keyring and drive `do_aead_crypto()`. Only basic local user access is needed.\\nUI:N - The attacker triggers the bug entirely through their own syscalls; no victim action, mount, or file open is involved.\\nS:U - The corruption and crash occur inside the kernel that the attacker is already interacting with, with no crossing into another security authority such as a hypervisor or IOMMU boundary.\\nC:H - The in-flight operation reads from a scatterlist pointing into a reclaimed stack frame and uses a freed `aead_request`/tfm holding the AES-GCM blob key, so plaintext key material and adjacent memory can be written into reused allocations and exposed. This memory corruption is leverageable for information disclosure.\\nI:H - After `aead_request_free()`/`crypto_free_aead()` return, the asynchronous DCP engine still writes its output through stale stack-resident scatterlists into memory that has been reclaimed and reused, giving an attacker-influenceable write into unrelated kernel objects \\u2014 classic use-after-free/stack-corruption primitives for control-flow hijack.\\nA:H - The commit documents that this produces NULL pointer dereference oopses in the DCP driver during blob creation, and use of the freed request/tfm crashes the kernel. An unprivileged user can trigger it repeatedly, causing denial of service.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"0e28bf61a5f9ab30be3f3b4eafb8d097e39446bb\", \"lessThan\": \"c75e0272289eae18c5379518a9c56ef31d65cc7d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0e28bf61a5f9ab30be3f3b4eafb8d097e39446bb\", \"lessThan\": \"04de7589e0a95167d803ecadd115235ba2c14997\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9e3b266afcfe4294e84496f50f006f029d3100db\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6.10.7\", \"lessThan\": \"6.11\", \"versionType\": \"semver\"}], \"programFiles\": [\"security/keys/trusted-keys/trusted_dcp.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.11\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.11\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.11.8\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"security/keys/trusted-keys/trusted_dcp.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/c75e0272289eae18c5379518a9c56ef31d65cc7d\"}, {\"url\": \"https://git.kernel.org/stable/c/04de7589e0a95167d803ecadd115235ba2c14997\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nKEYS: trusted: dcp: fix NULL dereference in AEAD crypto operation\\n\\nWhen sealing or unsealing a key blob we currently do not wait for\\nthe AEAD cipher operation to finish and simply return after submitting\\nthe request. If there is some load on the system we can exit before\\nthe cipher operation is done and the buffer we read from/write to\\nis already removed from the stack. This will e.g. result in NULL\\npointer dereference errors in the DCP driver during blob creation.\\n\\nFix this by waiting for the AEAD cipher operation to finish before\\nresuming the seal and unseal calls.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.8\", \"versionStartIncluding\": \"6.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"6.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"6.10.7\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:43:00.504Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-50281\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:43:00.504Z\", \"dateReserved\": \"2024-10-21T19:36:19.983Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-11-19T01:30:23.275Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.