GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-50294 (GCVE-0-2024-50294)

Vulnerability from cvelistv5 – Published: 2024-11-19 01:30 – Updated: 2026-08-05 11:43
VLAI
Title
rxrpc: Fix missing locking causing hanging calls
Summary
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix missing locking causing hanging calls If a call gets aborted (e.g. because kafs saw a signal) between it being queued for connection and the I/O thread picking up the call, the abort will be prioritised over the connection and it will be removed from local->new_client_calls by rxrpc_disconnect_client_call() without a lock being held. This may cause other calls on the list to disappear if a race occurs. Fix this by taking the client_call_lock when removing a call from whatever list its ->wait_link happens to be on.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.7 (Medium)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-01 20:14 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 9d35d880e0e4a3ab32d8c12f9e4d76198aadd42d , < 996a7208dadbf2cdda8d51444d5ee1fdd1ccbc92 (git)
Affected: 9d35d880e0e4a3ab32d8c12f9e4d76198aadd42d , < b1fdb0bb3b6513f5bd26f92369fd6ac1a2422d8b (git)
Affected: 9d35d880e0e4a3ab32d8c12f9e4d76198aadd42d , < fc9de52de38f656399d2ce40f7349a6b5f86e787 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.2
Unaffected: 0 , < 6.2 (semver)
Unaffected: 6.6.61 , ≤ 6.6.* (semver)
Unaffected: 6.11.8 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 4.7,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-50294",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T20:14:11.422504Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-667",
                "description": "CWE-667 Improper Locking",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T20:17:20.629Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/trace/events/rxrpc.h",
            "net/rxrpc/conn_client.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "996a7208dadbf2cdda8d51444d5ee1fdd1ccbc92",
              "status": "affected",
              "version": "9d35d880e0e4a3ab32d8c12f9e4d76198aadd42d",
              "versionType": "git"
            },
            {
              "lessThan": "b1fdb0bb3b6513f5bd26f92369fd6ac1a2422d8b",
              "status": "affected",
              "version": "9d35d880e0e4a3ab32d8c12f9e4d76198aadd42d",
              "versionType": "git"
            },
            {
              "lessThan": "fc9de52de38f656399d2ce40f7349a6b5f86e787",
              "status": "affected",
              "version": "9d35d880e0e4a3ab32d8c12f9e4d76198aadd42d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/trace/events/rxrpc.h",
            "net/rxrpc/conn_client.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.61",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.61",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.8",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix missing locking causing hanging calls\n\nIf a call gets aborted (e.g. because kafs saw a signal) between it being\nqueued for connection and the I/O thread picking up the call, the abort\nwill be prioritised over the connection and it will be removed from\nlocal-\u003enew_client_calls by rxrpc_disconnect_client_call() without a lock\nbeing held.  This may cause other calls on the list to disappear if a race\noccurs.\n\nFix this by taking the client_call_lock when removing a call from whatever\nlist its -\u003ewait_link happens to be on."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The race is driven entirely by local syscalls on an AF_RXRPC socket \u2014 sendmsg() to queue client calls on local-\u003enew_client_calls plus an RXRPC_ABORT cmsg/signal/close to trigger the unlocked list_del_init(). A call in this window has no cid, no connection and is not on peer-\u003eerror_targets, so no received packet or ICMP error can reach it.\nAC:L - The attacker owns both sides of the race: one thread spams client-call creation (locked list_add_tail) while another aborts calls still in RXRPC_CALL_CLIENT_AWAIT_CONN (unlocked list_del_init), and it can be retried in a tight loop with the I/O thread kept busy to widen the window. AF_RXRPC is built as a module in major distros and autoloads on socket creation.\nPR:L - There are no capable()/CAP_* checks anywhere in net/rxrpc, and creating an AF_RXRPC socket requires no privilege (the module autoloads via net-pf-33). Any unprivileged local user can open the socket and drive both sides of the race.\nUI:N - The attacker performs every step itself via its own socket; no victim action, mount, or file access is required.\nS:U - The corruption is confined to kernel memory managed by the same kernel security authority \u2014 no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The list corruption can leave a freed rxrpc_call still linked into local-\u003enew_client_calls after rxrpc_disconnect_call() drops the io_thread reference, and rxrpc_cleanup_call()/rxrpc_destroy_call() never unlink wait_link; the I/O thread then reads that freed object (call-\u003ebundle, wait_link pointers), a use-after-free read leveragable for kernel memory disclosure.\nI:H - The same stale link gives use-after-free writes \u2014 list_move_tail() and rxrpc_activate_one_channel() store into the freed/reused object (call-\u003econn, call-\u003ecid, call-\u003ecall_id, wake_up(\u0026call-\u003ewaitq)) \u2014 and the corrupted prev-\u003enext = new store writes an attacker-influenced pointer into groomable memory, a control-flow-hijack-capable primitive.\nA:H - The documented symptom is calls silently vanishing from the list and hanging forever with sendmsg blocked in rxrpc_wait_to_be_connected(); the corrupted head can also spin rxrpc_connect_client_calls()\u0027s loop or oops the rxrpc I/O thread, killing every call on that local endpoint including the in-kernel AFS client."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:43:10.106Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/996a7208dadbf2cdda8d51444d5ee1fdd1ccbc92"
        },
        {
          "url": "https://git.kernel.org/stable/c/b1fdb0bb3b6513f5bd26f92369fd6ac1a2422d8b"
        },
        {
          "url": "https://git.kernel.org/stable/c/fc9de52de38f656399d2ce40f7349a6b5f86e787"
        }
      ],
      "title": "rxrpc: Fix missing locking causing hanging calls",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-50294",
    "datePublished": "2024-11-19T01:30:40.699Z",
    "dateReserved": "2024-10-21T19:36:19.986Z",
    "dateUpdated": "2026-08-05T11:43:10.106Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-50294",
      "date": "2026-09-17",
      "epss": "0.00174",
      "percentile": "0.07191"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-50294\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-11-19T02:16:31.587\",\"lastModified\":\"2026-08-04T11:21:42.830\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nrxrpc: Fix missing locking causing hanging calls\\n\\nIf a call gets aborted (e.g. because kafs saw a signal) between it being\\nqueued for connection and the I/O thread picking up the call, the abort\\nwill be prioritised over the connection and it will be removed from\\nlocal-\u003enew_client_calls by rxrpc_disconnect_client_call() without a lock\\nbeing held.  This may cause other calls on the list to disappear if a race\\noccurs.\\n\\nFix this by taking the client_call_lock when removing a call from whatever\\nlist its -\u003ewait_link happens to be on.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: rxrpc: Se corrige la falta de bloqueo que causa llamadas colgadas Si una llamada se cancela (por ejemplo, porque kafs vio una se\u00f1al) entre su puesta en cola para la conexi\u00f3n y el hilo de E/S que recoge la llamada, la cancelaci\u00f3n tendr\u00e1 prioridad sobre la conexi\u00f3n y se eliminar\u00e1 de local-\u0026gt;new_client_calls mediante rxrpc_disconnect_client_call() sin que se mantenga un bloqueo. Esto puede provocar que otras llamadas de la lista desaparezcan si se produce una ejecuci\u00f3n. Arregle esto tomando el client_call_lock al eliminar una llamada de cualquier lista en la que se encuentre su -\u0026gt;wait_link.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"include/trace/events/rxrpc.h\",\"net/rxrpc/conn_client.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"9d35d880e0e4a3ab32d8c12f9e4d76198aadd42d\",\"lessThan\":\"996a7208dadbf2cdda8d51444d5ee1fdd1ccbc92\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9d35d880e0e4a3ab32d8c12f9e4d76198aadd42d\",\"lessThan\":\"b1fdb0bb3b6513f5bd26f92369fd6ac1a2422d8b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9d35d880e0e4a3ab32d8c12f9e4d76198aadd42d\",\"lessThan\":\"fc9de52de38f656399d2ce40f7349a6b5f86e787\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"include/trace/events/rxrpc.h\",\"net/rxrpc/conn_client.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.2\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.2\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.61\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11.8\",\"lessThanOrEqual\":\"6.11.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":4.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":4.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-10-01T20:14:11.422504Z\",\"id\":\"CVE-2024-50294\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-667\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-667\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2.1\",\"versionEndExcluding\":\"6.6.61\",\"matchCriteriaId\":\"0587E0D9-8B0B-4FA8-9425-3218DB9EC9A4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.11.8\",\"matchCriteriaId\":\"0BD000F7-3DAD-4DD3-8906-98EA1EC67E95\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.2:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"3ADCCCEE-143A-4B48-9B2A-0CB97BD385DE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.2:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"A127C155-689C-4F67-B146-44A57F4BFD85\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.2:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"D34127CC-68F5-4703-A5F6-5006F803E4AE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.2:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"4AB8D555-648E-4F2F-98BD-3E7F45BD12A8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.2:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"C64BDD9D-C663-4E75-AE06-356EDC392B82\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.2:rc8:*:*:*:*:*:*\",\"matchCriteriaId\":\"26544390-88E4-41CA-98BF-7BB1E9D4E243\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F361E1D-580F-4A2D-A509-7615F73167A1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"925478D0-3E3D-4E6F-ACD5-09F28D5DF82C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"3C95E234-D335-4B6C-96BF-E2CEBD8654ED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"E0F717D8-3014-4F84-8086-0124B2111379\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"24DBE6C7-2AAE-4818-AED2-E131F153D2FA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"24B88717-53F5-42AA-9B72-14C707639E3F\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/996a7208dadbf2cdda8d51444d5ee1fdd1ccbc92\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b1fdb0bb3b6513f5bd26f92369fd6ac1a2422d8b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fc9de52de38f656399d2ce40f7349a6b5f86e787\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T14:17:17+00:00",
      "cve": "CVE-2024-50294",
      "id": "CVE-2024-50294",
      "initial_release_date": "2024-11-19T00:00:00+00:00",
      "product_status:fixed": "303",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: rxrpc: Fix missing locking causing hanging calls",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-50294.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 4.7, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-50294\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-01T20:14:11.422504Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-667\", \"description\": \"CWE-667 Improper Locking\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-01T15:27:35.345Z\"}}], \"cna\": {\"title\": \"rxrpc: Fix missing locking causing hanging calls\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The race is driven entirely by local syscalls on an AF_RXRPC socket \\u2014 sendmsg() to queue client calls on local-\u003enew_client_calls plus an RXRPC_ABORT cmsg/signal/close to trigger the unlocked list_del_init(). A call in this window has no cid, no connection and is not on peer-\u003eerror_targets, so no received packet or ICMP error can reach it.\\nAC:L - The attacker owns both sides of the race: one thread spams client-call creation (locked list_add_tail) while another aborts calls still in RXRPC_CALL_CLIENT_AWAIT_CONN (unlocked list_del_init), and it can be retried in a tight loop with the I/O thread kept busy to widen the window. AF_RXRPC is built as a module in major distros and autoloads on socket creation.\\nPR:L - There are no capable()/CAP_* checks anywhere in net/rxrpc, and creating an AF_RXRPC socket requires no privilege (the module autoloads via net-pf-33). Any unprivileged local user can open the socket and drive both sides of the race.\\nUI:N - The attacker performs every step itself via its own socket; no victim action, mount, or file access is required.\\nS:U - The corruption is confined to kernel memory managed by the same kernel security authority \\u2014 no VM, IOMMU, or sandbox boundary is crossed.\\nC:H - The list corruption can leave a freed rxrpc_call still linked into local-\u003enew_client_calls after rxrpc_disconnect_call() drops the io_thread reference, and rxrpc_cleanup_call()/rxrpc_destroy_call() never unlink wait_link; the I/O thread then reads that freed object (call-\u003ebundle, wait_link pointers), a use-after-free read leveragable for kernel memory disclosure.\\nI:H - The same stale link gives use-after-free writes \\u2014 list_move_tail() and rxrpc_activate_one_channel() store into the freed/reused object (call-\u003econn, call-\u003ecid, call-\u003ecall_id, wake_up(\u0026call-\u003ewaitq)) \\u2014 and the corrupted prev-\u003enext = new store writes an attacker-influenced pointer into groomable memory, a control-flow-hijack-capable primitive.\\nA:H - The documented symptom is calls silently vanishing from the list and hanging forever with sendmsg blocked in rxrpc_wait_to_be_connected(); the corrupted head can also spin rxrpc_connect_client_calls()\u0027s loop or oops the rxrpc I/O thread, killing every call on that local endpoint including the in-kernel AFS client.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"9d35d880e0e4a3ab32d8c12f9e4d76198aadd42d\", \"lessThan\": \"996a7208dadbf2cdda8d51444d5ee1fdd1ccbc92\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9d35d880e0e4a3ab32d8c12f9e4d76198aadd42d\", \"lessThan\": \"b1fdb0bb3b6513f5bd26f92369fd6ac1a2422d8b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9d35d880e0e4a3ab32d8c12f9e4d76198aadd42d\", \"lessThan\": \"fc9de52de38f656399d2ce40f7349a6b5f86e787\", \"versionType\": \"git\"}], \"programFiles\": [\"include/trace/events/rxrpc.h\", \"net/rxrpc/conn_client.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.2\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.2\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.61\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.8\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"include/trace/events/rxrpc.h\", \"net/rxrpc/conn_client.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/996a7208dadbf2cdda8d51444d5ee1fdd1ccbc92\"}, {\"url\": \"https://git.kernel.org/stable/c/b1fdb0bb3b6513f5bd26f92369fd6ac1a2422d8b\"}, {\"url\": \"https://git.kernel.org/stable/c/fc9de52de38f656399d2ce40f7349a6b5f86e787\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nrxrpc: Fix missing locking causing hanging calls\\n\\nIf a call gets aborted (e.g. because kafs saw a signal) between it being\\nqueued for connection and the I/O thread picking up the call, the abort\\nwill be prioritised over the connection and it will be removed from\\nlocal-\u003enew_client_calls by rxrpc_disconnect_client_call() without a lock\\nbeing held.  This may cause other calls on the list to disappear if a race\\noccurs.\\n\\nFix this by taking the client_call_lock when removing a call from whatever\\nlist its -\u003ewait_link happens to be on.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.61\", \"versionStartIncluding\": \"6.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.8\", \"versionStartIncluding\": \"6.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"6.2\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:43:10.106Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-50294\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:43:10.106Z\", \"dateReserved\": \"2024-10-21T19:36:19.986Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-11-19T01:30:40.699Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.