CVE-2024-50139 (GCVE-0-2024-50139)

Vulnerability from cvelistv5 – Published: 2024-11-07 09:31 – Updated: 2026-08-05 11:41
VLAI
Title
KVM: arm64: Fix shift-out-of-bounds bug
Summary
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix shift-out-of-bounds bug Fix a shift-out-of-bounds bug reported by UBSAN when running VM with MTE enabled host kernel. UBSAN: shift-out-of-bounds in arch/arm64/kvm/sys_regs.c:1988:14 shift exponent 33 is too large for 32-bit type 'int' CPU: 26 UID: 0 PID: 7629 Comm: qemu-kvm Not tainted 6.12.0-rc2 #34 Hardware name: IEI NF5280R7/Mitchell MB, BIOS 00.00. 2024-10-12 09:28:54 10/14/2024 Call trace: dump_backtrace+0xa0/0x128 show_stack+0x20/0x38 dump_stack_lvl+0x74/0x90 dump_stack+0x18/0x28 __ubsan_handle_shift_out_of_bounds+0xf8/0x1e0 reset_clidr+0x10c/0x1c8 kvm_reset_sys_regs+0x50/0x1c8 kvm_reset_vcpu+0xec/0x2b0 __kvm_vcpu_set_target+0x84/0x158 kvm_vcpu_set_target+0x138/0x168 kvm_arch_vcpu_ioctl_vcpu_init+0x40/0x2b0 kvm_arch_vcpu_ioctl+0x28c/0x4b8 kvm_vcpu_ioctl+0x4bc/0x7a8 __arm64_sys_ioctl+0xb4/0x100 invoke_syscall+0x70/0x100 el0_svc_common.constprop.0+0x48/0xf0 do_el0_svc+0x24/0x38 el0_svc+0x3c/0x158 el0t_64_sync_handler+0x120/0x130 el0t_64_sync+0x194/0x198
Severity
7.9 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 7af0c2534f4c57b16e92dfca8c5f40fa90fbb3f3 , < 04ed2ba07ce73f323052475fbd33d647aca3ff2e (git)
Affected: 7af0c2534f4c57b16e92dfca8c5f40fa90fbb3f3 , < 4b9e11794d910aa55300debbac5f0adcc42c491a (git)
Affected: 7af0c2534f4c57b16e92dfca8c5f40fa90fbb3f3 , < c6c167afa090ea0451f91814e1318755a8fb8bb9 (git)
Create a notification for this product.
Linux Linux Affected: 6.3
Unaffected: 0 , < 6.3 (semver)
Unaffected: 6.6.59 , ≤ 6.6.* (semver)
Unaffected: 6.11.6 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-50139",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T20:21:13.947802Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T20:27:14.564Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/kvm/sys_regs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "04ed2ba07ce73f323052475fbd33d647aca3ff2e",
              "status": "affected",
              "version": "7af0c2534f4c57b16e92dfca8c5f40fa90fbb3f3",
              "versionType": "git"
            },
            {
              "lessThan": "4b9e11794d910aa55300debbac5f0adcc42c491a",
              "status": "affected",
              "version": "7af0c2534f4c57b16e92dfca8c5f40fa90fbb3f3",
              "versionType": "git"
            },
            {
              "lessThan": "c6c167afa090ea0451f91814e1318755a8fb8bb9",
              "status": "affected",
              "version": "7af0c2534f4c57b16e92dfca8c5f40fa90fbb3f3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/kvm/sys_regs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.59",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.59",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.6",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Fix shift-out-of-bounds bug\n\nFix a shift-out-of-bounds bug reported by UBSAN when running\nVM with MTE enabled host kernel.\n\nUBSAN: shift-out-of-bounds in arch/arm64/kvm/sys_regs.c:1988:14\nshift exponent 33 is too large for 32-bit type \u0027int\u0027\nCPU: 26 UID: 0 PID: 7629 Comm: qemu-kvm Not tainted 6.12.0-rc2 #34\nHardware name: IEI NF5280R7/Mitchell MB, BIOS 00.00. 2024-10-12 09:28:54 10/14/2024\nCall trace:\n dump_backtrace+0xa0/0x128\n show_stack+0x20/0x38\n dump_stack_lvl+0x74/0x90\n dump_stack+0x18/0x28\n __ubsan_handle_shift_out_of_bounds+0xf8/0x1e0\n reset_clidr+0x10c/0x1c8\n kvm_reset_sys_regs+0x50/0x1c8\n kvm_reset_vcpu+0xec/0x2b0\n __kvm_vcpu_set_target+0x84/0x158\n kvm_vcpu_set_target+0x138/0x168\n kvm_arch_vcpu_ioctl_vcpu_init+0x40/0x2b0\n kvm_arch_vcpu_ioctl+0x28c/0x4b8\n kvm_vcpu_ioctl+0x4bc/0x7a8\n __arm64_sys_ioctl+0xb4/0x100\n invoke_syscall+0x70/0x100\n el0_svc_common.constprop.0+0x48/0xf0\n do_el0_svc+0x24/0x38\n el0_svc+0x3c/0x158\n el0t_64_sync_handler+0x120/0x130\n el0t_64_sync+0x194/0x198"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.9,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached through `ioctl(KVM_ARM_VCPU_INIT)` on a local `/dev/kvm` vCPU file descriptor, or from a local VM guest via a PSCI CPU_ON SMC that queues `KVM_REQ_VCPU_RESET`. No network protocol is involved on either path.\nAC:L - The out-of-bounds shift is fully deterministic \u2014 no race, no memory-layout dependency, no timing window; the attacker simply enables `KVM_CAP_ARM_MTE` and initializes a vCPU, and the shift executes unconditionally under `kvm_has_mte()`.\nPR:L - No capability check exists anywhere along the path \u2014 only an open `/dev/kvm` descriptor, which unprivileged members of the `kvm` group hold on standard distributions, or control of a guest for the PSCI path. Not PR:N, since some local foothold is required.\nUI:N - Triggering requires only the attacker\u0027s own ioctl sequence or an SMC issued from inside a VM they already control; no action by any other user or administrator is needed.\nS:C - The defect crosses the host/guest security boundary in both directions \u2014 the host hypervisor writes architecturally-invalid CPU state into the guest, and via the guest-reachable PSCI `CPU_ON` path a VM-confined attacker drives a UBSAN violation in host kernel context, which under `CONFIG_UBSAN_TRAP` or `panic_on_warn` takes down the host and every co-resident VM.\nC:L - There is no out-of-bounds read or memory disclosure primitive, but the UBSAN report and the `die()`/oops path dump host kernel addresses and a full backtrace to the kernel log, giving a bounded kernel-pointer leak that undermines KASLR for a locally-triggering attacker.\nI:L - The hypervisor stores a corrupted `CLIDR_EL1` with a reserved `Ctype` encoding and missing MTE `Ttypen` fields into guest-visible CPU state, so protected data across the boundary is modified \u2014 but the written value is fixed and not attacker-controlled, and there is no write primitive or control-flow hijack.\nA:H - `ubsan_epilogue()` calls `check_panic_on_warn(\"UBSAN\")`, panicking the host on the widely deployed `panic_on_warn=1` setting, and `CONFIG_UBSAN_TRAP=y` turns the shift into a BRK handled by `die()` in kernel context while `kvm-\u003earch.config_lock` is held \u2014 a host kernel crash that destroys all running guests."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:41:58.518Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/04ed2ba07ce73f323052475fbd33d647aca3ff2e"
        },
        {
          "url": "https://git.kernel.org/stable/c/4b9e11794d910aa55300debbac5f0adcc42c491a"
        },
        {
          "url": "https://git.kernel.org/stable/c/c6c167afa090ea0451f91814e1318755a8fb8bb9"
        }
      ],
      "title": "KVM: arm64: Fix shift-out-of-bounds bug",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-50139",
    "datePublished": "2024-11-07T09:31:15.925Z",
    "dateReserved": "2024-10-21T19:36:19.956Z",
    "dateUpdated": "2026-08-05T11:41:58.518Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-50139",
      "date": "2026-08-04",
      "epss": "0.00226",
      "percentile": "0.13409"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-50139\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-11-07T10:15:05.903\",\"lastModified\":\"2026-06-17T08:03:41.330\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nKVM: arm64: Fix shift-out-of-bounds bug\\n\\nFix a shift-out-of-bounds bug reported by UBSAN when running\\nVM with MTE enabled host kernel.\\n\\nUBSAN: shift-out-of-bounds in arch/arm64/kvm/sys_regs.c:1988:14\\nshift exponent 33 is too large for 32-bit type \u0027int\u0027\\nCPU: 26 UID: 0 PID: 7629 Comm: qemu-kvm Not tainted 6.12.0-rc2 #34\\nHardware name: IEI NF5280R7/Mitchell MB, BIOS 00.00. 2024-10-12 09:28:54 10/14/2024\\nCall trace:\\n dump_backtrace+0xa0/0x128\\n show_stack+0x20/0x38\\n dump_stack_lvl+0x74/0x90\\n dump_stack+0x18/0x28\\n __ubsan_handle_shift_out_of_bounds+0xf8/0x1e0\\n reset_clidr+0x10c/0x1c8\\n kvm_reset_sys_regs+0x50/0x1c8\\n kvm_reset_vcpu+0xec/0x2b0\\n __kvm_vcpu_set_target+0x84/0x158\\n kvm_vcpu_set_target+0x138/0x168\\n kvm_arch_vcpu_ioctl_vcpu_init+0x40/0x2b0\\n kvm_arch_vcpu_ioctl+0x28c/0x4b8\\n kvm_vcpu_ioctl+0x4bc/0x7a8\\n __arm64_sys_ioctl+0xb4/0x100\\n invoke_syscall+0x70/0x100\\n el0_svc_common.constprop.0+0x48/0xf0\\n do_el0_svc+0x24/0x38\\n el0_svc+0x3c/0x158\\n el0t_64_sync_handler+0x120/0x130\\n el0t_64_sync+0x194/0x198\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: KVM: arm64: Corregir error de desplazamiento fuera de los l\u00edmites Corrige un error de desplazamiento fuera de los l\u00edmites informado por UBSAN al ejecutar una m\u00e1quina virtual con un kernel de host habilitado para MTE. UBSAN: desplazamiento fuera de los l\u00edmites en arch/arm64/kvm/sys_regs.c:1988:14 el exponente de desplazamiento 33 es demasiado grande para el tipo de 32 bits \u0027int\u0027 CPU: 26 UID: 0 PID: 7629 Comm: qemu-kvm No contaminado 6.12.0-rc2 #34 Nombre del hardware: IEI NF5280R7/Mitchell MB, BIOS 00.00. 2024-10-12 09:28:54 14/10/2024 Seguimiento de llamadas: dump_backtrace+0xa0/0x128 show_stack+0x20/0x38 dump_stack_lvl+0x74/0x90 dump_stack+0x18/0x28 __ubsan_handle_shift_out_of_bounds+0xf8/0x1e0 reset_clidr+0x10c/0x1c8 kvm_reset_sys_regs+0x50/0x1c8 kvm_reset_vcpu+0xec/0x2b0 __kvm_vcpu_set_target+0x84/0x158 kvm_vcpu_set_target+0x138/0x168 kvm_arch_vcpu_ioctl_vcpu_init+0x40/0x2b0 kvm_arch_vcpu_ioctl+0x28c/0x4b8 kvm_vcpu_ioctl+0x4bc/0x7a8 __arm64_sys_ioctl+0xb4/0x100 invocar_llamada_al_sistema+0x70/0x100 el0_svc_common.constprop.0+0x48/0xf0 do_el0_svc+0x24/0x38 el0_svc+0x3c/0x158 el0t_64_sync_handler+0x120/0x130 el0t_64_sync+0x194/0x198\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"arch/arm64/kvm/sys_regs.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7af0c2534f4c57b16e92dfca8c5f40fa90fbb3f3\",\"lessThan\":\"04ed2ba07ce73f323052475fbd33d647aca3ff2e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7af0c2534f4c57b16e92dfca8c5f40fa90fbb3f3\",\"lessThan\":\"4b9e11794d910aa55300debbac5f0adcc42c491a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7af0c2534f4c57b16e92dfca8c5f40fa90fbb3f3\",\"lessThan\":\"c6c167afa090ea0451f91814e1318755a8fb8bb9\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"arch/arm64/kvm/sys_regs.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.3\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.3\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.59\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11.6\",\"lessThanOrEqual\":\"6.11.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-10-01T20:21:13.947802Z\",\"id\":\"CVE-2024-50139\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.3\",\"versionEndExcluding\":\"6.6.59\",\"matchCriteriaId\":\"FE6BAC9A-DCE6-4768-8A7A-24AA8A77B015\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.11.6\",\"matchCriteriaId\":\"E4486B12-007B-4794-9857-F07145637AA1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F361E1D-580F-4A2D-A509-7615F73167A1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"925478D0-3E3D-4E6F-ACD5-09F28D5DF82C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"3C95E234-D335-4B6C-96BF-E2CEBD8654ED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"E0F717D8-3014-4F84-8086-0124B2111379\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/04ed2ba07ce73f323052475fbd33d647aca3ff2e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4b9e11794d910aa55300debbac5f0adcc42c491a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c6c167afa090ea0451f91814e1318755a8fb8bb9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T17:47:39+00:00",
      "cve": "CVE-2024-50139",
      "id": "CVE-2024-50139",
      "initial_release_date": "2024-11-07T00:00:00+00:00",
      "product_status:known_affected": "108",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: KVM: arm64: Fix shift-out-of-bounds bug",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-50139.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-50139\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-01T20:21:13.947802Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"description\": \"CWE-noinfo Not enough information\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-01T15:17:07.730Z\"}}], \"cna\": {\"title\": \"KVM: arm64: Fix shift-out-of-bounds bug\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"7af0c2534f4c57b16e92dfca8c5f40fa90fbb3f3\", \"lessThan\": \"04ed2ba07ce73f323052475fbd33d647aca3ff2e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7af0c2534f4c57b16e92dfca8c5f40fa90fbb3f3\", \"lessThan\": \"4b9e11794d910aa55300debbac5f0adcc42c491a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7af0c2534f4c57b16e92dfca8c5f40fa90fbb3f3\", \"lessThan\": \"c6c167afa090ea0451f91814e1318755a8fb8bb9\", \"versionType\": \"git\"}], \"programFiles\": [\"arch/arm64/kvm/sys_regs.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.3\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.3\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.59\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.6\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"arch/arm64/kvm/sys_regs.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/04ed2ba07ce73f323052475fbd33d647aca3ff2e\"}, {\"url\": \"https://git.kernel.org/stable/c/4b9e11794d910aa55300debbac5f0adcc42c491a\"}, {\"url\": \"https://git.kernel.org/stable/c/c6c167afa090ea0451f91814e1318755a8fb8bb9\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nKVM: arm64: Fix shift-out-of-bounds bug\\n\\nFix a shift-out-of-bounds bug reported by UBSAN when running\\nVM with MTE enabled host kernel.\\n\\nUBSAN: shift-out-of-bounds in arch/arm64/kvm/sys_regs.c:1988:14\\nshift exponent 33 is too large for 32-bit type \u0027int\u0027\\nCPU: 26 UID: 0 PID: 7629 Comm: qemu-kvm Not tainted 6.12.0-rc2 #34\\nHardware name: IEI NF5280R7/Mitchell MB, BIOS 00.00. 2024-10-12 09:28:54 10/14/2024\\nCall trace:\\n dump_backtrace+0xa0/0x128\\n show_stack+0x20/0x38\\n dump_stack_lvl+0x74/0x90\\n dump_stack+0x18/0x28\\n __ubsan_handle_shift_out_of_bounds+0xf8/0x1e0\\n reset_clidr+0x10c/0x1c8\\n kvm_reset_sys_regs+0x50/0x1c8\\n kvm_reset_vcpu+0xec/0x2b0\\n __kvm_vcpu_set_target+0x84/0x158\\n kvm_vcpu_set_target+0x138/0x168\\n kvm_arch_vcpu_ioctl_vcpu_init+0x40/0x2b0\\n kvm_arch_vcpu_ioctl+0x28c/0x4b8\\n kvm_vcpu_ioctl+0x4bc/0x7a8\\n __arm64_sys_ioctl+0xb4/0x100\\n invoke_syscall+0x70/0x100\\n el0_svc_common.constprop.0+0x48/0xf0\\n do_el0_svc+0x24/0x38\\n el0_svc+0x3c/0x158\\n el0t_64_sync_handler+0x120/0x130\\n el0t_64_sync+0x194/0x198\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.59\", \"versionStartIncluding\": \"6.3\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.6\", \"versionStartIncluding\": \"6.3\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"6.3\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T09:47:03.545Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-50139\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-10-01T20:27:14.564Z\", \"dateReserved\": \"2024-10-21T19:36:19.956Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-11-07T09:31:15.925Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.