CVE-2024-50281

What it actually does

Race condition in AEAD crypto handling for trusted key seal/unseal operations causes use of stack buffers after they are freed when the operation does not complete before return, resulting in NULL pointer dereference in the DCP driver.

Why it matters to the business

Systems handling trusted keys with DCP hardware acceleration can experience crashes or denial of service under load, disrupting key management and cryptographic operations; urgency is low given absence from known exploitation lists and minimal EPSS score with stable trend.

How an attack unfolds

An attacker with local access triggers repeated seal or unseal operations on a trusted key blob while the system is under load, racing the AEAD request submission against buffer lifetime so that the DCP driver later dereferences freed stack memory during the asynchronous completion.

How to fix it

Update the Linux kernel to a version containing the fix that ensures the AEAD cipher operation completes before seal and unseal functions resume; apply the corresponding package update for any affected distributions.

How to confirm the fix worked

Confirm the running kernel version contains the commit that adds the wait for AEAD completion; test seal and unseal operations under load to verify absence of NULL dereference faults in the DCP driver.

Typical attack path

1. Obtain local execution context on a system using the DCP-backed trusted keys subsystem
2. Issue concurrent seal/unseal requests for key blobs while inducing system load
3. Trigger the window where the AEAD operation has not yet completed before the calling function returns
4. Cause the DCP driver to access the now-invalid stack buffer resulting in NULL dereference and crash

How to detect it

Inspect kernel logs for NULL pointer dereference faults mentioning the DCP driver or trusted keys AEAD operations around the time of key seal or unseal activity; correlate with process activity that performs key operations under load.

What your security team should do

• Prioritize kernel updates on systems that use the trusted keys DCP driver
• Monitor for kernel oops or NULL dereference reports related to dcp or trusted keys
• Review any custom key sealing tooling for synchronous operation assumptions