CVE-2024-56650 (GCVE-0-2024-56650)

Vulnerability from cvelistv5 – Published: 2024-12-27 15:02 – Updated: 2026-05-11 20:56
VLAI
Title
netfilter: x_tables: fix LED ID check in led_tg_check()
Summary
In the Linux kernel, the following vulnerability has been resolved: netfilter: x_tables: fix LED ID check in led_tg_check() Syzbot has reported the following BUG detected by KASAN: BUG: KASAN: slab-out-of-bounds in strlen+0x58/0x70 Read of size 1 at addr ffff8881022da0c8 by task repro/5879 ... Call Trace: <TASK> dump_stack_lvl+0x241/0x360 ? __pfx_dump_stack_lvl+0x10/0x10 ? __pfx__printk+0x10/0x10 ? _printk+0xd5/0x120 ? __virt_addr_valid+0x183/0x530 ? __virt_addr_valid+0x183/0x530 print_report+0x169/0x550 ? __virt_addr_valid+0x183/0x530 ? __virt_addr_valid+0x183/0x530 ? __virt_addr_valid+0x45f/0x530 ? __phys_addr+0xba/0x170 ? strlen+0x58/0x70 kasan_report+0x143/0x180 ? strlen+0x58/0x70 strlen+0x58/0x70 kstrdup+0x20/0x80 led_tg_check+0x18b/0x3c0 xt_check_target+0x3bb/0xa40 ? __pfx_xt_check_target+0x10/0x10 ? stack_depot_save_flags+0x6e4/0x830 ? nft_target_init+0x174/0xc30 nft_target_init+0x82d/0xc30 ? __pfx_nft_target_init+0x10/0x10 ? nf_tables_newrule+0x1609/0x2980 ? nf_tables_newrule+0x1609/0x2980 ? rcu_is_watching+0x15/0xb0 ? nf_tables_newrule+0x1609/0x2980 ? nf_tables_newrule+0x1609/0x2980 ? __kmalloc_noprof+0x21a/0x400 nf_tables_newrule+0x1860/0x2980 ? __pfx_nf_tables_newrule+0x10/0x10 ? __nla_parse+0x40/0x60 nfnetlink_rcv+0x14e5/0x2ab0 ? __pfx_validate_chain+0x10/0x10 ? __pfx_nfnetlink_rcv+0x10/0x10 ? __lock_acquire+0x1384/0x2050 ? netlink_deliver_tap+0x2e/0x1b0 ? __pfx_lock_release+0x10/0x10 ? netlink_deliver_tap+0x2e/0x1b0 netlink_unicast+0x7f8/0x990 ? __pfx_netlink_unicast+0x10/0x10 ? __virt_addr_valid+0x183/0x530 ? __check_object_size+0x48e/0x900 netlink_sendmsg+0x8e4/0xcb0 ? __pfx_netlink_sendmsg+0x10/0x10 ? aa_sock_msg_perm+0x91/0x160 ? __pfx_netlink_sendmsg+0x10/0x10 __sock_sendmsg+0x223/0x270 ____sys_sendmsg+0x52a/0x7e0 ? __pfx_____sys_sendmsg+0x10/0x10 __sys_sendmsg+0x292/0x380 ? __pfx___sys_sendmsg+0x10/0x10 ? lockdep_hardirqs_on_prepare+0x43d/0x780 ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 ? exc_page_fault+0x590/0x8c0 ? do_syscall_64+0xb6/0x230 do_syscall_64+0xf3/0x230 entry_SYSCALL_64_after_hwframe+0x77/0x7f ... </TASK> Since an invalid (without '\0' byte at all) byte sequence may be passed from userspace, add an extra check to ensure that such a sequence is rejected as possible ID and so never passed to 'kstrdup()' and further.
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 268cb38e1802db560c73167e643f14a3dcb4b07c , < 147a42bb02de8735cb08476be6d0917987d022c2 (git)
Affected: 268cb38e1802db560c73167e643f14a3dcb4b07c , < ad28612ebae1fcc1104bd432e99e99d87f6bfe09 (git)
Affected: 268cb38e1802db560c73167e643f14a3dcb4b07c , < 36a9d94dac28beef6b8abba46ba8874320d3e800 (git)
Affected: 268cb38e1802db560c73167e643f14a3dcb4b07c , < ab9916321c95f5280b72b4c5055e269f98627efe (git)
Affected: 268cb38e1802db560c73167e643f14a3dcb4b07c , < a9bcc0b70d9baf3ff005874489a0dc9d023b54c3 (git)
Affected: 268cb38e1802db560c73167e643f14a3dcb4b07c , < c40c96d98e536fc1daaa125c2332b988615e30a4 (git)
Affected: 268cb38e1802db560c73167e643f14a3dcb4b07c , < 04317f4eb2aad312ad85c1a17ad81fe75f1f9bc7 (git)
Create a notification for this product.
Linux Linux Affected: 2.6.30
Unaffected: 0 , < 2.6.30 (semver)
Unaffected: 5.4.287 , ≤ 5.4.* (semver)
Unaffected: 5.10.231 , ≤ 5.10.* (semver)
Unaffected: 5.15.174 , ≤ 5.15.* (semver)
Unaffected: 6.1.120 , ≤ 6.1.* (semver)
Unaffected: 6.6.66 , ≤ 6.6.* (semver)
Unaffected: 6.12.5 , ≤ 6.12.* (semver)
Unaffected: 6.13 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-56650",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T20:00:22.683789Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-125",
                "description": "CWE-125 Out-of-bounds Read",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T20:07:11.150Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:51:56.813Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/xt_LED.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "147a42bb02de8735cb08476be6d0917987d022c2",
              "status": "affected",
              "version": "268cb38e1802db560c73167e643f14a3dcb4b07c",
              "versionType": "git"
            },
            {
              "lessThan": "ad28612ebae1fcc1104bd432e99e99d87f6bfe09",
              "status": "affected",
              "version": "268cb38e1802db560c73167e643f14a3dcb4b07c",
              "versionType": "git"
            },
            {
              "lessThan": "36a9d94dac28beef6b8abba46ba8874320d3e800",
              "status": "affected",
              "version": "268cb38e1802db560c73167e643f14a3dcb4b07c",
              "versionType": "git"
            },
            {
              "lessThan": "ab9916321c95f5280b72b4c5055e269f98627efe",
              "status": "affected",
              "version": "268cb38e1802db560c73167e643f14a3dcb4b07c",
              "versionType": "git"
            },
            {
              "lessThan": "a9bcc0b70d9baf3ff005874489a0dc9d023b54c3",
              "status": "affected",
              "version": "268cb38e1802db560c73167e643f14a3dcb4b07c",
              "versionType": "git"
            },
            {
              "lessThan": "c40c96d98e536fc1daaa125c2332b988615e30a4",
              "status": "affected",
              "version": "268cb38e1802db560c73167e643f14a3dcb4b07c",
              "versionType": "git"
            },
            {
              "lessThan": "04317f4eb2aad312ad85c1a17ad81fe75f1f9bc7",
              "status": "affected",
              "version": "268cb38e1802db560c73167e643f14a3dcb4b07c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/xt_LED.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.30"
            },
            {
              "lessThan": "2.6.30",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.287",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.231",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.174",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.120",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.66",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.287",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.231",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.174",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.120",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.66",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.5",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: x_tables: fix LED ID check in led_tg_check()\n\nSyzbot has reported the following BUG detected by KASAN:\n\nBUG: KASAN: slab-out-of-bounds in strlen+0x58/0x70\nRead of size 1 at addr ffff8881022da0c8 by task repro/5879\n...\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x241/0x360\n ? __pfx_dump_stack_lvl+0x10/0x10\n ? __pfx__printk+0x10/0x10\n ? _printk+0xd5/0x120\n ? __virt_addr_valid+0x183/0x530\n ? __virt_addr_valid+0x183/0x530\n print_report+0x169/0x550\n ? __virt_addr_valid+0x183/0x530\n ? __virt_addr_valid+0x183/0x530\n ? __virt_addr_valid+0x45f/0x530\n ? __phys_addr+0xba/0x170\n ? strlen+0x58/0x70\n kasan_report+0x143/0x180\n ? strlen+0x58/0x70\n strlen+0x58/0x70\n kstrdup+0x20/0x80\n led_tg_check+0x18b/0x3c0\n xt_check_target+0x3bb/0xa40\n ? __pfx_xt_check_target+0x10/0x10\n ? stack_depot_save_flags+0x6e4/0x830\n ? nft_target_init+0x174/0xc30\n nft_target_init+0x82d/0xc30\n ? __pfx_nft_target_init+0x10/0x10\n ? nf_tables_newrule+0x1609/0x2980\n ? nf_tables_newrule+0x1609/0x2980\n ? rcu_is_watching+0x15/0xb0\n ? nf_tables_newrule+0x1609/0x2980\n ? nf_tables_newrule+0x1609/0x2980\n ? __kmalloc_noprof+0x21a/0x400\n nf_tables_newrule+0x1860/0x2980\n ? __pfx_nf_tables_newrule+0x10/0x10\n ? __nla_parse+0x40/0x60\n nfnetlink_rcv+0x14e5/0x2ab0\n ? __pfx_validate_chain+0x10/0x10\n ? __pfx_nfnetlink_rcv+0x10/0x10\n ? __lock_acquire+0x1384/0x2050\n ? netlink_deliver_tap+0x2e/0x1b0\n ? __pfx_lock_release+0x10/0x10\n ? netlink_deliver_tap+0x2e/0x1b0\n netlink_unicast+0x7f8/0x990\n ? __pfx_netlink_unicast+0x10/0x10\n ? __virt_addr_valid+0x183/0x530\n ? __check_object_size+0x48e/0x900\n netlink_sendmsg+0x8e4/0xcb0\n ? __pfx_netlink_sendmsg+0x10/0x10\n ? aa_sock_msg_perm+0x91/0x160\n ? __pfx_netlink_sendmsg+0x10/0x10\n __sock_sendmsg+0x223/0x270\n ____sys_sendmsg+0x52a/0x7e0\n ? __pfx_____sys_sendmsg+0x10/0x10\n __sys_sendmsg+0x292/0x380\n ? __pfx___sys_sendmsg+0x10/0x10\n ? lockdep_hardirqs_on_prepare+0x43d/0x780\n ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10\n ? exc_page_fault+0x590/0x8c0\n ? do_syscall_64+0xb6/0x230\n do_syscall_64+0xf3/0x230\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n...\n \u003c/TASK\u003e\n\nSince an invalid (without \u0027\\0\u0027 byte at all) byte sequence may be passed\nfrom userspace, add an extra check to ensure that such a sequence is\nrejected as possible ID and so never passed to \u0027kstrdup()\u0027 and further."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:56:35.481Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/147a42bb02de8735cb08476be6d0917987d022c2"
        },
        {
          "url": "https://git.kernel.org/stable/c/ad28612ebae1fcc1104bd432e99e99d87f6bfe09"
        },
        {
          "url": "https://git.kernel.org/stable/c/36a9d94dac28beef6b8abba46ba8874320d3e800"
        },
        {
          "url": "https://git.kernel.org/stable/c/ab9916321c95f5280b72b4c5055e269f98627efe"
        },
        {
          "url": "https://git.kernel.org/stable/c/a9bcc0b70d9baf3ff005874489a0dc9d023b54c3"
        },
        {
          "url": "https://git.kernel.org/stable/c/c40c96d98e536fc1daaa125c2332b988615e30a4"
        },
        {
          "url": "https://git.kernel.org/stable/c/04317f4eb2aad312ad85c1a17ad81fe75f1f9bc7"
        }
      ],
      "title": "netfilter: x_tables: fix LED ID check in led_tg_check()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-56650",
    "datePublished": "2024-12-27T15:02:50.098Z",
    "dateReserved": "2024-12-27T15:00:39.840Z",
    "dateUpdated": "2026-05-11T20:56:35.481Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-56650",
      "date": "2026-06-02",
      "epss": "8e-05",
      "percentile": "0.00725"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-56650\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-12-27T15:15:24.783\",\"lastModified\":\"2025-11-03T21:18:14.590\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnetfilter: x_tables: fix LED ID check in led_tg_check()\\n\\nSyzbot has reported the following BUG detected by KASAN:\\n\\nBUG: KASAN: slab-out-of-bounds in strlen+0x58/0x70\\nRead of size 1 at addr ffff8881022da0c8 by task repro/5879\\n...\\nCall Trace:\\n \u003cTASK\u003e\\n dump_stack_lvl+0x241/0x360\\n ? __pfx_dump_stack_lvl+0x10/0x10\\n ? __pfx__printk+0x10/0x10\\n ? _printk+0xd5/0x120\\n ? __virt_addr_valid+0x183/0x530\\n ? __virt_addr_valid+0x183/0x530\\n print_report+0x169/0x550\\n ? __virt_addr_valid+0x183/0x530\\n ? __virt_addr_valid+0x183/0x530\\n ? __virt_addr_valid+0x45f/0x530\\n ? __phys_addr+0xba/0x170\\n ? strlen+0x58/0x70\\n kasan_report+0x143/0x180\\n ? strlen+0x58/0x70\\n strlen+0x58/0x70\\n kstrdup+0x20/0x80\\n led_tg_check+0x18b/0x3c0\\n xt_check_target+0x3bb/0xa40\\n ? __pfx_xt_check_target+0x10/0x10\\n ? stack_depot_save_flags+0x6e4/0x830\\n ? nft_target_init+0x174/0xc30\\n nft_target_init+0x82d/0xc30\\n ? __pfx_nft_target_init+0x10/0x10\\n ? nf_tables_newrule+0x1609/0x2980\\n ? nf_tables_newrule+0x1609/0x2980\\n ? rcu_is_watching+0x15/0xb0\\n ? nf_tables_newrule+0x1609/0x2980\\n ? nf_tables_newrule+0x1609/0x2980\\n ? __kmalloc_noprof+0x21a/0x400\\n nf_tables_newrule+0x1860/0x2980\\n ? __pfx_nf_tables_newrule+0x10/0x10\\n ? __nla_parse+0x40/0x60\\n nfnetlink_rcv+0x14e5/0x2ab0\\n ? __pfx_validate_chain+0x10/0x10\\n ? __pfx_nfnetlink_rcv+0x10/0x10\\n ? __lock_acquire+0x1384/0x2050\\n ? netlink_deliver_tap+0x2e/0x1b0\\n ? __pfx_lock_release+0x10/0x10\\n ? netlink_deliver_tap+0x2e/0x1b0\\n netlink_unicast+0x7f8/0x990\\n ? __pfx_netlink_unicast+0x10/0x10\\n ? __virt_addr_valid+0x183/0x530\\n ? __check_object_size+0x48e/0x900\\n netlink_sendmsg+0x8e4/0xcb0\\n ? __pfx_netlink_sendmsg+0x10/0x10\\n ? aa_sock_msg_perm+0x91/0x160\\n ? __pfx_netlink_sendmsg+0x10/0x10\\n __sock_sendmsg+0x223/0x270\\n ____sys_sendmsg+0x52a/0x7e0\\n ? __pfx_____sys_sendmsg+0x10/0x10\\n __sys_sendmsg+0x292/0x380\\n ? __pfx___sys_sendmsg+0x10/0x10\\n ? lockdep_hardirqs_on_prepare+0x43d/0x780\\n ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10\\n ? exc_page_fault+0x590/0x8c0\\n ? do_syscall_64+0xb6/0x230\\n do_syscall_64+0xf3/0x230\\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\\n...\\n \u003c/TASK\u003e\\n\\nSince an invalid (without \u0027\\\\0\u0027 byte at all) byte sequence may be passed\\nfrom userspace, add an extra check to ensure that such a sequence is\\nrejected as possible ID and so never passed to \u0027kstrdup()\u0027 and further.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: netfilter: x_tables: correcci\u00f3n de la comprobaci\u00f3n del ID del LED en led_tg_check() Syzbot ha informado del siguiente ERROR detectado por KASAN: ERROR: KASAN: slab-out-of-bounds en strlen+0x58/0x70 Lectura de tama\u00f1o 1 en la direcci\u00f3n ffff8881022da0c8 por la tarea repro/5879 ... Seguimiento de llamadas:  dump_stack_lvl+0x241/0x360 ? __pfx_dump_stack_lvl+0x10/0x10 ? __pfx__printk+0x10/0x10 ? _printk+0xd5/0x120 ? __virt_addr_valid+0x183/0x530 ? __virt_addr_valid+0x183/0x530 imprimir_informe+0x169/0x550 ? __virt_addr_valid+0x183/0x530 ? __virt_addr_valid+0x183/0x530 ? __virt_addr_valid+0x45f/0x530 ? __phys_addr+0xba/0x170 ? strlen+0x58/0x70 kasan_informe+0x143/0x180 ? strlen+0x58/0x70 strlen+0x58/0x70 kstrdup+0x20/0x80 led_tg_check+0x18b/0x3c0 xt_check_target+0x3bb/0xa40 ? __pfx_xt_check_target+0x10/0x10 ? stack_depot_save_flags+0x6e4/0x830 ? nft_target_init+0x174/0xc30 nft_target_init+0x82d/0xc30 ? __pfx_nft_target_init+0x10/0x10 ? nf_tables_newrule+0x1609/0x2980 ? nf_tables_newrule+0x1609/0x2980 ? rcu_is_watching+0x15/0xb0 ? nf_tables_newrule+0x1609/0x2980 ? nf_tables_newrule+0x1609/0x2980 ? __kmalloc_noprof+0x21a/0x400 nf_tables_newrule+0x1860/0x2980 ? __pfx_nf_tables_newrule+0x10/0x10 ? __nla_parse+0x40/0x60 nfnetlink_rcv+0x14e5/0x2ab0 ? __pfx_validate_chain+0x10/0x10 ? __pfx_nfnetlink_rcv+0x10/0x10 ? __lock_acquire+0x1384/0x2050 ? netlink_deliver_tap+0x2e/0x1b0 ? __pfx_lock_release+0x10/0x10 ? aa_sock_msg_perm+0x91/0x160 ? __pfx_netlink_sendmsg+0x10/0x10 __sock_sendmsg+0x223/0x270 ____sys_sendmsg+0x52a/0x7e0 ? exc_page_fault+0x590/0x8c0 ? Dado que una secuencia de bytes no v\u00e1lida (sin el byte \u0027\\\\0\u0027 en absoluto) puede pasarse desde el espacio de usuario, agregue una verificaci\u00f3n adicional para garantizar que dicha secuencia se rechace como posible ID y, por lo tanto, nunca se pase a \u0027kstrdup()\u0027 ni a nada m\u00e1s.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.6.30\",\"versionEndExcluding\":\"5.4.287\",\"matchCriteriaId\":\"2D46A016-4FC6-416B-92D5-0A3833B3F57C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.231\",\"matchCriteriaId\":\"B5C644CC-2BD7-4E32-BC54-8DCC7ABE9935\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.174\",\"matchCriteriaId\":\"419FD073-1517-4FD5-8158-F94BC68A1E89\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.120\",\"matchCriteriaId\":\"09AC6122-E2A4-40FE-9D33-268A1B2EC265\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.66\",\"matchCriteriaId\":\"29A976AD-B9AB-4A95-9F08-7669F8847EB9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.5\",\"matchCriteriaId\":\"9501D045-7A94-42CA-8B03-821BE94A65B7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"62567B3C-6CEE-46D0-BC2E-B3717FBF7D13\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/04317f4eb2aad312ad85c1a17ad81fe75f1f9bc7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/147a42bb02de8735cb08476be6d0917987d022c2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/36a9d94dac28beef6b8abba46ba8874320d3e800\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a9bcc0b70d9baf3ff005874489a0dc9d023b54c3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ab9916321c95f5280b72b4c5055e269f98627efe\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ad28612ebae1fcc1104bd432e99e99d87f6bfe09\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c40c96d98e536fc1daaa125c2332b988615e30a4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.1, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-56650\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-01T20:00:22.683789Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-125\", \"description\": \"CWE-125 Out-of-bounds Read\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-01T15:44:39.351Z\"}}], \"cna\": {\"title\": \"netfilter: x_tables: fix LED ID check in led_tg_check()\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"268cb38e1802db560c73167e643f14a3dcb4b07c\", \"lessThan\": \"147a42bb02de8735cb08476be6d0917987d022c2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"268cb38e1802db560c73167e643f14a3dcb4b07c\", \"lessThan\": \"ad28612ebae1fcc1104bd432e99e99d87f6bfe09\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"268cb38e1802db560c73167e643f14a3dcb4b07c\", \"lessThan\": \"36a9d94dac28beef6b8abba46ba8874320d3e800\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"268cb38e1802db560c73167e643f14a3dcb4b07c\", \"lessThan\": \"ab9916321c95f5280b72b4c5055e269f98627efe\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"268cb38e1802db560c73167e643f14a3dcb4b07c\", \"lessThan\": \"a9bcc0b70d9baf3ff005874489a0dc9d023b54c3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"268cb38e1802db560c73167e643f14a3dcb4b07c\", \"lessThan\": \"c40c96d98e536fc1daaa125c2332b988615e30a4\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"268cb38e1802db560c73167e643f14a3dcb4b07c\", \"lessThan\": \"04317f4eb2aad312ad85c1a17ad81fe75f1f9bc7\", \"versionType\": \"git\"}], \"programFiles\": [\"net/netfilter/xt_LED.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.6.30\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"2.6.30\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.4.287\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.231\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.174\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.120\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.66\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.5\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.13\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/netfilter/xt_LED.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/147a42bb02de8735cb08476be6d0917987d022c2\"}, {\"url\": \"https://git.kernel.org/stable/c/ad28612ebae1fcc1104bd432e99e99d87f6bfe09\"}, {\"url\": \"https://git.kernel.org/stable/c/36a9d94dac28beef6b8abba46ba8874320d3e800\"}, {\"url\": \"https://git.kernel.org/stable/c/ab9916321c95f5280b72b4c5055e269f98627efe\"}, {\"url\": \"https://git.kernel.org/stable/c/a9bcc0b70d9baf3ff005874489a0dc9d023b54c3\"}, {\"url\": \"https://git.kernel.org/stable/c/c40c96d98e536fc1daaa125c2332b988615e30a4\"}, {\"url\": \"https://git.kernel.org/stable/c/04317f4eb2aad312ad85c1a17ad81fe75f1f9bc7\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnetfilter: x_tables: fix LED ID check in led_tg_check()\\n\\nSyzbot has reported the following BUG detected by KASAN:\\n\\nBUG: KASAN: slab-out-of-bounds in strlen+0x58/0x70\\nRead of size 1 at addr ffff8881022da0c8 by task repro/5879\\n...\\nCall Trace:\\n \u003cTASK\u003e\\n dump_stack_lvl+0x241/0x360\\n ? __pfx_dump_stack_lvl+0x10/0x10\\n ? __pfx__printk+0x10/0x10\\n ? _printk+0xd5/0x120\\n ? __virt_addr_valid+0x183/0x530\\n ? __virt_addr_valid+0x183/0x530\\n print_report+0x169/0x550\\n ? __virt_addr_valid+0x183/0x530\\n ? __virt_addr_valid+0x183/0x530\\n ? __virt_addr_valid+0x45f/0x530\\n ? __phys_addr+0xba/0x170\\n ? strlen+0x58/0x70\\n kasan_report+0x143/0x180\\n ? strlen+0x58/0x70\\n strlen+0x58/0x70\\n kstrdup+0x20/0x80\\n led_tg_check+0x18b/0x3c0\\n xt_check_target+0x3bb/0xa40\\n ? __pfx_xt_check_target+0x10/0x10\\n ? stack_depot_save_flags+0x6e4/0x830\\n ? nft_target_init+0x174/0xc30\\n nft_target_init+0x82d/0xc30\\n ? __pfx_nft_target_init+0x10/0x10\\n ? nf_tables_newrule+0x1609/0x2980\\n ? nf_tables_newrule+0x1609/0x2980\\n ? rcu_is_watching+0x15/0xb0\\n ? nf_tables_newrule+0x1609/0x2980\\n ? nf_tables_newrule+0x1609/0x2980\\n ? __kmalloc_noprof+0x21a/0x400\\n nf_tables_newrule+0x1860/0x2980\\n ? __pfx_nf_tables_newrule+0x10/0x10\\n ? __nla_parse+0x40/0x60\\n nfnetlink_rcv+0x14e5/0x2ab0\\n ? __pfx_validate_chain+0x10/0x10\\n ? __pfx_nfnetlink_rcv+0x10/0x10\\n ? __lock_acquire+0x1384/0x2050\\n ? netlink_deliver_tap+0x2e/0x1b0\\n ? __pfx_lock_release+0x10/0x10\\n ? netlink_deliver_tap+0x2e/0x1b0\\n netlink_unicast+0x7f8/0x990\\n ? __pfx_netlink_unicast+0x10/0x10\\n ? __virt_addr_valid+0x183/0x530\\n ? __check_object_size+0x48e/0x900\\n netlink_sendmsg+0x8e4/0xcb0\\n ? __pfx_netlink_sendmsg+0x10/0x10\\n ? aa_sock_msg_perm+0x91/0x160\\n ? __pfx_netlink_sendmsg+0x10/0x10\\n __sock_sendmsg+0x223/0x270\\n ____sys_sendmsg+0x52a/0x7e0\\n ? __pfx_____sys_sendmsg+0x10/0x10\\n __sys_sendmsg+0x292/0x380\\n ? __pfx___sys_sendmsg+0x10/0x10\\n ? lockdep_hardirqs_on_prepare+0x43d/0x780\\n ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10\\n ? exc_page_fault+0x590/0x8c0\\n ? do_syscall_64+0xb6/0x230\\n do_syscall_64+0xf3/0x230\\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\\n...\\n \u003c/TASK\u003e\\n\\nSince an invalid (without \u0027\\\\0\u0027 byte at all) byte sequence may be passed\\nfrom userspace, add an extra check to ensure that such a sequence is\\nrejected as possible ID and so never passed to \u0027kstrdup()\u0027 and further.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.287\", \"versionStartIncluding\": \"2.6.30\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.231\", \"versionStartIncluding\": \"2.6.30\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.174\", \"versionStartIncluding\": \"2.6.30\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.120\", \"versionStartIncluding\": \"2.6.30\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.66\", \"versionStartIncluding\": \"2.6.30\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.5\", \"versionStartIncluding\": \"2.6.30\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.13\", \"versionStartIncluding\": \"2.6.30\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T10:01:03.454Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-56650\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-10-01T20:07:11.150Z\", \"dateReserved\": \"2024-12-27T15:00:39.840Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-12-27T15:02:50.098Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.