CVE-2024-50072

5.5 · MEDIUM

Published Oct 29, 2024 linux EPSS 0.23% (14th pctl) CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Overview

CVE-2024-50072 is a medium-severity vulnerability affecting linux linux_kernel. It was published on October 29, 2024 and has a CVSS 3.1 base score of 5.5 (MEDIUM).

This vulnerability has a CVSS 3.1 base score of 5.5, rated MEDIUM. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

x86/bugs: Use code segment selector for VERW operand

Robert Gill reported below #GP in 32-bit mode when dosemu software was

executing vm86() system call:

general protection fault: 0000 [#1] PREEMPT SMP

CPU: 4 PID: 4610 Comm: dosemu.bin Not tainted 6.6.21-gentoo-x86 #1

Hardware name: Dell Inc. PowerEdge 1950/0H723K, BIOS 2.7.0 10/30/2010

EIP: restore_all_switch_stack+0xbe/0xcf

EAX: 00000000 EBX: 00000000 ECX: 00000000 EDX: 00000000

ESI: 00000000 EDI: 00000000 EBP: 00000000 ESP: ff8affdc

DS: 0000 ES: 0000 FS: 0000 GS: 0033 SS: 0068 EFLAGS: 00010046

CR0: 80050033 CR2: 00c2101c CR3: 04b6d000 CR4: 000406d0

Call Trace:

show_regs+0x70/0x78

die_addr+0x29/0x70

exc_general_protection+0x13c/0x348

exc_bounds+0x98/0x98

handle_exception+0x14d/0x14d

exc_bounds+0x98/0x98

restore_all_switch_stack+0xbe/0xcf

exc_bounds+0x98/0x98

restore_all_switch_stack+0xbe/0xcf

This only happens in 32-bi

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

Vendor	Product	Versions	Status
linux	linux_kernel	>= 5.10.215, < 5.11	Affected

References

Ref git.kernel.org/stable/c/38c5fe74f3bef98f75d16effa49836d50c9b6097 Ref git.kernel.org/stable/c/481b477ab63c7245715a3e57ba79eb87c2dc0d02 Ref git.kernel.org/stable/c/ada431c6c31a2c8c37991c46089af5caa23a9c6e Ref git.kernel.org/stable/c/bc576fbaf82deded606e69a00efe9752136bf91d Ref git.kernel.org/stable/c/bfd1d223d80cb29a210caa1bd5e21f0816d58f02 Ref git.kernel.org/stable/c/e4d2102018542e3ae5e297bc6e229303abff8a0f Ref lists.debian.org/debian-lts-announce/2025/01/msg00001.html Ref lists.debian.org/debian-lts-announce/2025/03/msg00002.html

Frequently Asked Questions

What is CVE-2024-50072?

CVE-2024-50072 is a medium-severity vulnerability affecting linux linux_kernel. It was published on October 29, 2024 and has a CVSS 3.1 base score of 5.5 (MEDIUM).

How severe is CVE-2024-50072?

This vulnerability has a CVSS 3.1 base score of 5.5, rated MEDIUM. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

How do I fix or remediate CVE-2024-50072?

How can CyberStrike help with CVE-2024-50072?

CyberStrike's AI-powered security agents can automatically detect CVE-2024-50072 across your infrastructure using autonomous pentesting, DAST scanning, and HackBrowser. The platform continuously monitors for known vulnerabilities and provides actionable remediation guidance prioritized by real-world exploitability.

How CyberStrike Helps

Autonomous Discovery

AI agents map your attack surface to find vulnerabilities like this one.

Continuous Pentesting

Automated penetration testing that runs continuously, not just quarterly.

Code Review

AI-driven PR review catches vulnerable dependencies before they ship.

HackBrowser

Browser-based exploitation validates findings with real proof-of-concept.

Related MEDIUM CVEs from 2024

View all →

6.9

CVE-2023-3726

OCSInventory allow stored email template with special characters that lead to a Stored cross-site Sc

6.9

CVE-2023-51719