Vulnerability-Lookup

FKIE_CVE-2024-50195

Vulnerability from fkie_nvd - Published: 2024-11-08 06:15 - Updated: 2026-08-04 11:21

Severity

7.1 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Summary

In the Linux kernel, the following vulnerability has been resolved: posix-clock: Fix missing timespec64 check in pc_clock_settime() As Andrew pointed out, it will make sense that the PTP core checked timespec64 struct's tv_sec and tv_nsec range before calling ptp->info->settime64(). As the man manual of clock_settime() said, if tp.tv_sec is negative or tp.tv_nsec is outside the range [0..999,999,999], it should return EINVAL, which include dynamic clocks which handles PTP clock, and the condition is consistent with timespec64_valid(). As Thomas suggested, timespec64_valid() only check the timespec is valid, but not ensure that the time is in a valid range, so check it ahead using timespec64_valid_strict() in pc_clock_settime() and return -EINVAL if not valid. There are some drivers that use tp->tv_sec and tp->tv_nsec directly to write registers without validity checks and assume that the higher layer has checked it, which is dangerous and will benefit from this, such as hclge_ptp_settime(), igb_ptp_settime_i210(), _rcar_gen4_ptp_settime(), and some drivers can remove the checks of itself.

References

URL	Tags
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/1ff7247101af723731ea42ed565d54fb8f341264	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/27abbde44b6e71ee3891de13e1a228aa7ce95bfe	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/29f085345cde24566efb751f39e5d367c381c584	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/673a1c5a2998acbd429d6286e6cad10f17f4f073	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/a3f169e398215e71361774d13bf91a0101283ac2	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/c8789fbe2bbf75845e45302cba6ffa44e1884d01	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/d8794ac20a299b647ba9958f6d657051fc51a540	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/e0c966bd3e31911b57ef76cec4c5796ebd88e512	Patch
af854a3a-2127-422b-91ae-364da2661108	https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html
af854a3a-2127-422b-91ae-364da2661108	https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html

Impacted products

Vendor	Product	Version
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	6.12
linux	linux_kernel	6.12
linux	linux_kernel	6.12

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/time/posix-clock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "29f085345cde24566efb751f39e5d367c381c584",
              "status": "affected",
              "version": "0606f422b453f76c31ab2b1bd52943ff06a2dcf2",
              "versionType": "git"
            },
            {
              "lessThan": "e0c966bd3e31911b57ef76cec4c5796ebd88e512",
              "status": "affected",
              "version": "0606f422b453f76c31ab2b1bd52943ff06a2dcf2",
              "versionType": "git"
            },
            {
              "lessThan": "673a1c5a2998acbd429d6286e6cad10f17f4f073",
              "status": "affected",
              "version": "0606f422b453f76c31ab2b1bd52943ff06a2dcf2",
              "versionType": "git"
            },
            {
              "lessThan": "c8789fbe2bbf75845e45302cba6ffa44e1884d01",
              "status": "affected",
              "version": "0606f422b453f76c31ab2b1bd52943ff06a2dcf2",
              "versionType": "git"
            },
            {
              "lessThan": "27abbde44b6e71ee3891de13e1a228aa7ce95bfe",
              "status": "affected",
              "version": "0606f422b453f76c31ab2b1bd52943ff06a2dcf2",
              "versionType": "git"
            },
            {
              "lessThan": "a3f169e398215e71361774d13bf91a0101283ac2",
              "status": "affected",
              "version": "0606f422b453f76c31ab2b1bd52943ff06a2dcf2",
              "versionType": "git"
            },
            {
              "lessThan": "1ff7247101af723731ea42ed565d54fb8f341264",
              "status": "affected",
              "version": "0606f422b453f76c31ab2b1bd52943ff06a2dcf2",
              "versionType": "git"
            },
            {
              "lessThan": "d8794ac20a299b647ba9958f6d657051fc51a540",
              "status": "affected",
              "version": "0606f422b453f76c31ab2b1bd52943ff06a2dcf2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/time/posix-clock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.39"
            },
            {
              "lessThan": "2.6.39",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.323",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.285",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.228",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.169",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.114",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.58",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "5A3583A3-7039-4012-9458-F67912AED1CA",
              "versionEndExcluding": "4.19.323",
              "versionStartIncluding": "2.6.39",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B5A89369-320F-47FC-8695-56F61F87E4C0",
              "versionEndExcluding": "5.4.285",
              "versionStartIncluding": "4.20",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "9062315F-AB89-4ABE-8C13-B75927689F66",
              "versionEndExcluding": "5.10.228",
              "versionStartIncluding": "5.5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "18BEDAD6-86F8-457C-952F-C35698B3D07F",
              "versionEndExcluding": "5.15.169",
              "versionStartIncluding": "5.11",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "10FD2B3E-C7D9-4A9C-BD64-41877EDF88EB",
              "versionEndExcluding": "6.1.114",
              "versionStartIncluding": "5.16",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "6B9489BC-825E-4EEE-8D93-F93C801988C8",
              "versionEndExcluding": "6.6.58",
              "versionStartIncluding": "6.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "6E62D61A-F704-44DB-A311-17B7534DA7BC",
              "versionEndExcluding": "6.11.5",
              "versionStartIncluding": "6.7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "7F361E1D-580F-4A2D-A509-7615F73167A1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "925478D0-3E3D-4E6F-ACD5-09F28D5DF82C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*",
              "matchCriteriaId": "3C95E234-D335-4B6C-96BF-E2CEBD8654ED",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nposix-clock: Fix missing timespec64 check in pc_clock_settime()\n\nAs Andrew pointed out, it will make sense that the PTP core\nchecked timespec64 struct\u0027s tv_sec and tv_nsec range before calling\nptp-\u003einfo-\u003esettime64().\n\nAs the man manual of clock_settime() said, if tp.tv_sec is negative or\ntp.tv_nsec is outside the range [0..999,999,999], it should return EINVAL,\nwhich include dynamic clocks which handles PTP clock, and the condition is\nconsistent with timespec64_valid(). As Thomas suggested, timespec64_valid()\nonly check the timespec is valid, but not ensure that the time is\nin a valid range, so check it ahead using timespec64_valid_strict()\nin pc_clock_settime() and return -EINVAL if not valid.\n\nThere are some drivers that use tp-\u003etv_sec and tp-\u003etv_nsec directly to\nwrite registers without validity checks and assume that the higher layer\nhas checked it, which is dangerous and will benefit from this, such as\nhclge_ptp_settime(), igb_ptp_settime_i210(), _rcar_gen4_ptp_settime(),\nand some drivers can remove the checks of itself."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: posix-clock: Arreglar la comprobaci\u00f3n timespec64 faltante en pc_clock_settime() Como se\u00f1al\u00f3 Andrew, tendr\u00e1 sentido que el n\u00facleo PTP comprobara el rango tv_sec y tv_nsec de la estructura timespec64 antes de llamar a ptp-\u0026gt;info-\u0026gt;settime64(). Como dec\u00eda el manual de manual de clock_settime(), si tp.tv_sec es negativo o tp.tv_nsec est\u00e1 fuera del rango [0..999,999,999], deber\u00eda devolver EINVAL, que incluye relojes din\u00e1micos que manejan el reloj PTP, y la condici\u00f3n es consistente con timespec64_valid(). Como sugiri\u00f3 Thomas, timespec64_valid() solo comprueba que el timespec sea v\u00e1lido, pero no garantiza que el tiempo est\u00e9 en un rango v\u00e1lido, as\u00ed que compru\u00e9belo con antelaci\u00f3n usando timespec64_valid_strict() en pc_clock_settime() y devuelva -EINVAL si no es v\u00e1lido. Hay algunos controladores que usan tp-\u0026gt;tv_sec y tp-\u0026gt;tv_nsec directamente para escribir registros sin comprobaciones de validez y asumen que la capa superior lo ha comprobado, lo cual es peligroso y se beneficiar\u00e1 de esto, como hclge_ptp_settime(), igb_ptp_settime_i210(), _rcar_gen4_ptp_settime(), y algunos controladores pueden eliminar las comprobaciones de s\u00ed mismos."
    }
  ],
  "id": "CVE-2024-50195",
  "lastModified": "2026-08-04T11:21:31.493",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.2,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.6,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-50195",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-10-01T20:18:04.312116Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2024-11-08T06:15:16.280",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/1ff7247101af723731ea42ed565d54fb8f341264"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/27abbde44b6e71ee3891de13e1a228aa7ce95bfe"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/29f085345cde24566efb751f39e5d367c381c584"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/673a1c5a2998acbd429d6286e6cad10f17f4f073"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/a3f169e398215e71361774d13bf91a0101283ac2"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/c8789fbe2bbf75845e45302cba6ffa44e1884d01"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/d8794ac20a299b647ba9958f6d657051fc51a540"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/e0c966bd3e31911b57ef76cec4c5796ebd88e512"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-754"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-754"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

CVE-2024-50195 (GCVE-0-2024-50195)

Vulnerability from cvelistv5 – Published: 2024-11-08 05:54 – Updated: 2026-08-05 11:42

Title

posix-clock: Fix missing timespec64 check in pc_clock_settime()

Summary

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-10-01 20:18 UTC

CWE

CWE-754 - Improper Check for Unusual or Exceptional Conditions

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6639 records in the last 180 days details

References

10 references

URL	Tags
https://git.kernel.org/stable/c/29f085345cde24566…
https://git.kernel.org/stable/c/e0c966bd3e31911b5…
https://git.kernel.org/stable/c/673a1c5a2998acbd4…
https://git.kernel.org/stable/c/c8789fbe2bbf75845…
https://git.kernel.org/stable/c/27abbde44b6e71ee3…
https://git.kernel.org/stable/c/a3f169e398215e713…
https://git.kernel.org/stable/c/1ff7247101af72373…
https://git.kernel.org/stable/c/d8794ac20a299b647…
https://lists.debian.org/debian-lts-announce/2025…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 0606f422b453f76c31ab2b1bd52943ff06a2dcf2 , < 29f085345cde24566efb751f39e5d367c381c584 (git) Affected: 0606f422b453f76c31ab2b1bd52943ff06a2dcf2 , < e0c966bd3e31911b57ef76cec4c5796ebd88e512 (git) Affected: 0606f422b453f76c31ab2b1bd52943ff06a2dcf2 , < 673a1c5a2998acbd429d6286e6cad10f17f4f073 (git) Affected: 0606f422b453f76c31ab2b1bd52943ff06a2dcf2 , < c8789fbe2bbf75845e45302cba6ffa44e1884d01 (git) Affected: 0606f422b453f76c31ab2b1bd52943ff06a2dcf2 , < 27abbde44b6e71ee3891de13e1a228aa7ce95bfe (git) Affected: 0606f422b453f76c31ab2b1bd52943ff06a2dcf2 , < a3f169e398215e71361774d13bf91a0101283ac2 (git) Affected: 0606f422b453f76c31ab2b1bd52943ff06a2dcf2 , < 1ff7247101af723731ea42ed565d54fb8f341264 (git) Affected: 0606f422b453f76c31ab2b1bd52943ff06a2dcf2 , < d8794ac20a299b647ba9958f6d657051fc51a540 (git)
Linux	Linux	Affected: 2.6.39 Unaffected: 0 , < 2.6.39 (semver) Unaffected: 4.19.323 , ≤ 4.19.* (semver) Unaffected: 5.4.285 , ≤ 5.4.* (semver) Unaffected: 5.10.228 , ≤ 5.10.* (semver) Unaffected: 5.15.169 , ≤ 5.15.* (semver) Unaffected: 6.1.114 , ≤ 6.1.* (semver) Unaffected: 6.6.58 , ≤ 6.6.* (semver) Unaffected: 6.11.5 , ≤ 6.11.* (semver) Unaffected: 6.12 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-50195",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T20:18:04.312116Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-754",
                "description": "CWE-754 Improper Check for Unusual or Exceptional Conditions",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T20:27:07.870Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:26:50.538Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/time/posix-clock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "29f085345cde24566efb751f39e5d367c381c584",
              "status": "affected",
              "version": "0606f422b453f76c31ab2b1bd52943ff06a2dcf2",
              "versionType": "git"
            },
            {
              "lessThan": "e0c966bd3e31911b57ef76cec4c5796ebd88e512",
              "status": "affected",
              "version": "0606f422b453f76c31ab2b1bd52943ff06a2dcf2",
              "versionType": "git"
            },
            {
              "lessThan": "673a1c5a2998acbd429d6286e6cad10f17f4f073",
              "status": "affected",
              "version": "0606f422b453f76c31ab2b1bd52943ff06a2dcf2",
              "versionType": "git"
            },
            {
              "lessThan": "c8789fbe2bbf75845e45302cba6ffa44e1884d01",
              "status": "affected",
              "version": "0606f422b453f76c31ab2b1bd52943ff06a2dcf2",
              "versionType": "git"
            },
            {
              "lessThan": "27abbde44b6e71ee3891de13e1a228aa7ce95bfe",
              "status": "affected",
              "version": "0606f422b453f76c31ab2b1bd52943ff06a2dcf2",
              "versionType": "git"
            },
            {
              "lessThan": "a3f169e398215e71361774d13bf91a0101283ac2",
              "status": "affected",
              "version": "0606f422b453f76c31ab2b1bd52943ff06a2dcf2",
              "versionType": "git"
            },
            {
              "lessThan": "1ff7247101af723731ea42ed565d54fb8f341264",
              "status": "affected",
              "version": "0606f422b453f76c31ab2b1bd52943ff06a2dcf2",
              "versionType": "git"
            },
            {
              "lessThan": "d8794ac20a299b647ba9958f6d657051fc51a540",
              "status": "affected",
              "version": "0606f422b453f76c31ab2b1bd52943ff06a2dcf2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/time/posix-clock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.39"
            },
            {
              "lessThan": "2.6.39",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.323",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.285",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.228",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.169",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.114",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.58",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.323",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.285",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.228",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.169",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.114",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.58",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.5",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nposix-clock: Fix missing timespec64 check in pc_clock_settime()\n\nAs Andrew pointed out, it will make sense that the PTP core\nchecked timespec64 struct\u0027s tv_sec and tv_nsec range before calling\nptp-\u003einfo-\u003esettime64().\n\nAs the man manual of clock_settime() said, if tp.tv_sec is negative or\ntp.tv_nsec is outside the range [0..999,999,999], it should return EINVAL,\nwhich include dynamic clocks which handles PTP clock, and the condition is\nconsistent with timespec64_valid(). As Thomas suggested, timespec64_valid()\nonly check the timespec is valid, but not ensure that the time is\nin a valid range, so check it ahead using timespec64_valid_strict()\nin pc_clock_settime() and return -EINVAL if not valid.\n\nThere are some drivers that use tp-\u003etv_sec and tp-\u003etv_nsec directly to\nwrite registers without validity checks and assume that the higher layer\nhas checked it, which is dangerous and will benefit from this, such as\nhclge_ptp_settime(), igb_ptp_settime_i210(), _rcar_gen4_ptp_settime(),\nand some drivers can remove the checks of itself."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The only entry point is the local `clock_settime()`/`clock_settime32()` syscall with a dynamic CLOCKFD clockid derived from an open file descriptor on a `/dev/ptpN` character device. There is no network, adjacent, or remote-peer path into `pc_clock_settime()`.\nAC:L - A single syscall with e.g. `tv_nsec = 1000000000` or `tv_sec = -1` deterministically drives the unvalidated value into the driver callback \u2014 no race, no timing window, no memory-layout or victim-state dependency, and it can be repeated at will.\nPR:L - No capability check exists anywhere on the path; the sole gate is `FMODE_WRITE` on a PTP character device, which is routinely granted to non-root PTP/TSN daemons (linuxptp running with dropped privileges), containers, and appliance workloads in telecom, automotive and cloud deployments. An ordinary unprivileged user holding such a descriptor fully controls the trigger.\nUI:N - The attacker performs the whole sequence on a descriptor they opened themselves with one syscall. No mount, file open, or other action by another user is required.\nS:U - The corrupted state is the kernel\u0027s own PTP/posix-clock objects and the NIC\u0027s PHC managed by the same kernel security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:N - The defect is a missing input-validation check on a value flowing inward to hardware registers and time arithmetic; nothing is read out of bounds, no freed object is reused, and no kernel memory is copied back to userspace, so no read primitive exists.\nI:H - The attacker gains full, arbitrary control over the value programmed into the PTP hardware clock \u2014 the authoritative time base for all hardware timestamping on the interface, for PTP/gPTP synchronization of downstream nodes, and for TSN taprio/ETF gate schedules \u2014 and drivers such as `hclge_ptp_settime()`, `igb_ptp_settime_i210()` and `_rcar_gen4_ptp_settime()` commit it to registers with no checks of their own. Malicious modification of that specific state is a direct, serious integrity consequence for the impacted component, and it also drives undefined arithmetic (`timespec64_to_ns()` overflow, `timecounter_init()`, `do_div()` in `vsc9959_new_base_time()`) in code that assumed a validated input.\nA:H - Programming an out-of-range or negative time into the PHC produces a total, persistent loss of hardware timestamping, PTP synchronization and time-aware-shaper transmission on that interface \u2014 TSN gate schedules recomputed from the poisoned base never open, and the condition can be re-triggered at will so the service cannot recover. The unvalidated value additionally reaches out-of-spec hardware register writes and overflowing kernel time arithmetic on paths that assume validated input."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:42:26.108Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/29f085345cde24566efb751f39e5d367c381c584"
        },
        {
          "url": "https://git.kernel.org/stable/c/e0c966bd3e31911b57ef76cec4c5796ebd88e512"
        },
        {
          "url": "https://git.kernel.org/stable/c/673a1c5a2998acbd429d6286e6cad10f17f4f073"
        },
        {
          "url": "https://git.kernel.org/stable/c/c8789fbe2bbf75845e45302cba6ffa44e1884d01"
        },
        {
          "url": "https://git.kernel.org/stable/c/27abbde44b6e71ee3891de13e1a228aa7ce95bfe"
        },
        {
          "url": "https://git.kernel.org/stable/c/a3f169e398215e71361774d13bf91a0101283ac2"
        },
        {
          "url": "https://git.kernel.org/stable/c/1ff7247101af723731ea42ed565d54fb8f341264"
        },
        {
          "url": "https://git.kernel.org/stable/c/d8794ac20a299b647ba9958f6d657051fc51a540"
        }
      ],
      "title": "posix-clock: Fix missing timespec64 check in pc_clock_settime()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-50195",
    "datePublished": "2024-11-08T05:54:10.183Z",
    "dateReserved": "2024-10-21T19:36:19.968Z",
    "dateUpdated": "2026-08-05T11:42:26.108Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted