CVE-2024-50129

What it actually does

Out-of-bounds array access during iteration over PI structures in the PSE-PD driver because the loop condition incorrectly allows reaching index pcdev->nr_lines despite only nr_lines structures being allocated.

Why it matters to the business

Kernel memory corruption on Linux systems managing Power over Ethernet hardware can lead to crashes, denial of service, or local privilege escalation affecting servers, switches, and embedded devices.

How an attack unfolds

An attacker with local access supplies crafted input or triggers PSE-PD initialization paths that cause the for-loop to exceed allocated PI structure bounds, resulting in out-of-bounds read or write operations that can be leveraged for code execution or information disclosure.

How to fix it

Update the Linux kernel to the commit 50ea68146d82f34b3ad80d8290ef8222136dedd7 or later stable releases that enforce the corrected loop bound.

How to confirm the fix worked

Verify the presence of the fix by inspecting the pse-pd driver source for the adjusted loop limit condition and confirm the running kernel contains the referenced commit.

Typical attack path

1. Obtain local access or execute code in a context that interacts with the PSE-PD subsystem
2. Trigger PSE controller registration or PI structure iteration paths
3. Supply parameters that cause the loop to reach the out-of-bounds index
4. Exploit resulting memory corruption to escalate privileges or crash the kernel

How to detect it

Search kernel logs for out-of-bounds access warnings or oops messages originating from pse-pd code paths and audit recent changes to PSE controller initialization.

What your security team should do

• Apply the kernel update containing commit 50ea68146d82f34b3ad80d8290ef8222136dedd7 as soon as possible on affected systems
• Review and restrict unprivileged access to PSE-PD configuration interfaces
• Monitor for kernel oops or panic events related to pse_pd after patching