CVE-2024-50142

What it actually does

The flaw allows creation of an xfrm SA with usersa.sel.family=AF_UNSPEC and an oversized prefixlen_s (e.g. 128) while usersa.family=AF_INET; verify_newsa_info skips prefixlen bounds checks because of AF_UNSPEC, but copy_from_user_state later sets x->sel.family to AF_INET, leaving an inconsistent selector that can trigger invalid memory access or kernel instability.

Why it matters to the business

Local users on affected kernels can trigger kernel crashes or denial-of-service; organizations running unpatched Linux systems face unplanned outages and potential loss of network connectivity or VPN services until the kernel is updated.

How an attack unfolds

An attacker with local access crafts an xfrm SA via netlink using AF_UNSPEC selector family and an out-of-range prefix length; the missing validation in verify_newsa_info permits the SA to be installed, after which subsequent xfrm processing that relies on the now-corrected family value encounters invalid prefix lengths, leading to crashes or undefined behavior.

How to fix it

Upgrade the Linux kernel to commit f31398570acf0f0804c644006f7bfa9067106b0a or later; apply the corresponding stable or distribution kernel package that contains the fix for CVE-2024-50142.

How to confirm the fix worked

Confirm the running kernel contains commit f31398570acf0f0804c644006f7bfa9067106b0a or a backport; attempt to reproduce the original syzbot reproducer and verify that verify_newsa_info now enforces prefixlen limits based on the SA family before the selector family is finalized.

Typical attack path

1. Obtain local shell or unprivileged process on target Linux host
2. Use netlink or setsockopt to create an xfrm SA with sel.family=AF_UNSPEC and prefixlen_s=128 while family=AF_INET
3. Trigger xfrm processing that dereferences the inconsistent selector
4. Cause kernel panic or DoS

How to detect it

Search kernel logs for oops/panic messages mentioning xfrm, verify_newsa_info, or prefixlen; inspect netlink audit records for xfrm SA creation attempts that specify AF_UNSPEC selector family combined with large prefix lengths.

What your security team should do

• Prioritize kernel updates on all internet-facing and multi-tenant systems within the next patch cycle
• Restrict unprivileged netlink/xfrm access via SELinux or AppArmor where feasible
• Monitor for kernel oops or panic logs referencing xfrm or verify_newsa_info
• Review downstream package lists for any remaining vulnerable webkit2gtk or kernel builds and replace them