CVE-2024-50206

What it actually does

Incorrect loop bound during MTK_FQ_DMA_LENGTH buffer allocation in mtk_eth_soc driver causes writes beyond allocated descriptors, corrupting adjacent kernel memory.

Why it matters to the business

Linux-based network equipment may experience crashes, unpredictable behavior, or silent data corruption when the affected Ethernet driver initializes, increasing downtime and support costs especially in high-volume deployments.

How an attack unfolds

An attacker with the ability to load or reload the mtk_eth_soc driver (via privileged local access or crafted network configuration) triggers the DMA initialization path; the oversized loop then overwrites unrelated kernel structures, enabling further corruption or privilege escalation. Listed threat actors have been observed targeting similar Linux kernel memory issues in espionage and financial campaigns.

How to fix it

Upgrade the Linux kernel to the commit 0c3836482481200ead7b416ca80c68a29cfdaabd or later; rebuild and deploy the updated kernel image on all affected systems. Where live patching is unavailable, schedule a reboot after the package update.

How to confirm the fix worked

Confirm the running kernel contains commit 0c3836482481200ead7b416ca80c68a29cfdaabd via git log or package version; inspect the mtk_eth_soc.c source to verify the corrected loop bound matches MTK_FQ_DMA_LENGTH descriptors.

Typical attack path

1. Obtain local or container root on a system using the MediaTek Ethernet driver
2. Trigger driver probe or interface bring-up that executes fq DMA initialization
3. Induce the off-by-one loop iteration that writes past descriptor array bounds
4. Leverage resulting memory corruption for code execution or denial of service

How to detect it

Review kernel logs for unexpected oops or memory corruption warnings during Ethernet driver initialization; correlate with process creation events that load the mtk_eth_soc module on systems that should not normally trigger it. Examine threat actor TTPs associated with Linux kernel memory flaws for similar patterns.

What your security team should do

• Immediately identify all systems running vulnerable mtk_eth_soc code and schedule kernel updates within the next maintenance window
• Prioritize patching for internet-facing or multi-tenant Linux hosts given observed kernel memory flaw exploitation by espionage and financially motivated actors
• Add the fixed commit hash to internal SBOM and vulnerability scanners to prevent re-introduction