CVE-2024-50153

5.5 · MEDIUM

Published Nov 7, 2024 linux CWE-476 EPSS 0.26% (17th pctl) CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Overview

CVE-2024-50153 is a medium-severity vulnerability affecting linux linux_kernel. It was published on November 7, 2024 and has a CVSS 3.1 base score of 5.5 (MEDIUM).

This vulnerability has a CVSS 3.1 base score of 5.5, rated MEDIUM. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: target: core: Fix null-ptr-deref in target_alloc_device()

There is a null-ptr-deref issue reported by KASAN:

BUG: KASAN: null-ptr-deref in target_alloc_device+0xbc4/0xbe0 [target_core_mod]

...

kasan_report+0xb9/0xf0

target_alloc_device+0xbc4/0xbe0 [target_core_mod]

core_dev_setup_virtual_lun0+0xef/0x1f0 [target_core_mod]

target_core_init_configfs+0x205/0x420 [target_core_mod]

do_one_initcall+0xdd/0x4e0

...

entry_SYSCALL_64_after_hwframe+0x76/0x7e

In target_alloc_device(), if allocing memory for dev queues fails, then

dev will be freed by dev->transport->free_device(), but dev->transport

is not initialized at that time, which will lead to a null pointer

reference problem.

Fixing this bug by freeing dev with hba->backend->ops->free_device().

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

Vendor	Product	Versions	Status
linux	linux_kernel	>= 5.11, < 5.15.170	Affected

References

Ref git.kernel.org/stable/c/14a6a2adb440e4ae97bee73b2360946bd033dadd Ref git.kernel.org/stable/c/39e02fa90323243187c91bb3e8f2f5f6a9aacfc7 Ref git.kernel.org/stable/c/895ab729425ef9bf3b6d2f8d0853abe64896f314 Ref git.kernel.org/stable/c/8c1e6717f60d31f8af3937c23c4f1498529584e1 Ref git.kernel.org/stable/c/b80e9bc85bd9af378e7eac83e15dd129557bbdb6 Ref git.kernel.org/stable/c/fca6caeb4a61d240f031914413fcc69534f6dc03 Ref lists.debian.org/debian-lts-announce/2025/01/msg00001.html Ref lists.debian.org/debian-lts-announce/2025/03/msg00002.html Ref cert-portal.siemens.com/productcert/html/ssa-265688.html

Frequently Asked Questions

What is CVE-2024-50153?

CVE-2024-50153 is a medium-severity vulnerability affecting linux linux_kernel. It was published on November 7, 2024 and has a CVSS 3.1 base score of 5.5 (MEDIUM).

How severe is CVE-2024-50153?

This vulnerability has a CVSS 3.1 base score of 5.5, rated MEDIUM. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

How do I fix or remediate CVE-2024-50153?

How can CyberStrike help with CVE-2024-50153?

CyberStrike's AI-powered security agents can automatically detect CVE-2024-50153 across your infrastructure using autonomous pentesting, DAST scanning, and HackBrowser. The platform continuously monitors for known vulnerabilities and provides actionable remediation guidance prioritized by real-world exploitability.

How CyberStrike Helps

Autonomous Discovery

AI agents map your attack surface to find vulnerabilities like this one.

Continuous Pentesting

Automated penetration testing that runs continuously, not just quarterly.

Code Review

AI-driven PR review catches vulnerable dependencies before they ship.

HackBrowser

Browser-based exploitation validates findings with real proof-of-concept.

Related MEDIUM CVEs from 2024

View all →

6.9

CVE-2023-3726

OCSInventory allow stored email template with special characters that lead to a Stored cross-site Sc

6.9

CVE-2023-51719