CVE-2024-55916

5.5 · MEDIUM

Published Jan 11, 2025 linux CWE-476 EPSS 0.22% (12th pctl) CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Overview

CVE-2024-55916 is a medium-severity vulnerability affecting linux linux_kernel. It was published on January 11, 2025 and has a CVSS 3.1 base score of 5.5 (MEDIUM).

This vulnerability has a CVSS 3.1 base score of 5.5, rated MEDIUM. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

Drivers: hv: util: Avoid accessing a ringbuffer not initialized yet

If the KVP (or VSS) daemon starts before the VMBus channel's ringbuffer is

fully initialized, we can hit the panic below:

hv_utils: Registering HyperV Utility Driver

hv_vmbus: registering driver hv_utils

...

BUG: kernel NULL pointer dereference, address: 0000000000000000

CPU: 44 UID: 0 PID: 2552 Comm: hv_kvp_daemon Tainted: G E 6.11.0-rc3+ #1

RIP: 0010:hv_pkt_iter_first+0x12/0xd0

Call Trace:

...

vmbus_recvpacket

hv_kvp_onchannelcallback

vmbus_on_event

tasklet_action_common

tasklet_action

handle_softirqs

irq_exit_rcu

sysvec_hyperv_stimer0

</IRQ>

<TASK>

asm_sysvec_hyperv_stimer0

...

kvp_register_done

hvt_op_read

vfs_read

ksys_read

__x64_sys_read

This can happen because the KVP/VSS channel callback can be invoked

even before the channel is fully opened:

1) as soon as hv_kvp_init() -> hvutil_transport_init() creates

/dev/vmbus/hv_kvp, t

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

Vendor	Product	Versions	Status
linux	linux_kernel	>= 4.9, < 5.4.289	Affected

References

Ref git.kernel.org/stable/c/042253c57be901bfd19f15b68267442b70f510d5 Ref git.kernel.org/stable/c/07a756a49f4b4290b49ea46e089cbe6f79ff8d26 Ref git.kernel.org/stable/c/3dd7a30c6d7f90afcf19e9b072f572ba524d7ec6 Ref git.kernel.org/stable/c/718fe694a334be9d1a89eed22602369ac18d6583 Ref git.kernel.org/stable/c/89fcec5e466b3ac9b376e0d621c71effa1a7983f Ref git.kernel.org/stable/c/d81f4e73aff9b861671df60e5100ad25cc16fbf8 Ref git.kernel.org/stable/c/f091a224a2c82f1e302b1768d73bb6332f687321 Ref lists.debian.org/debian-lts-announce/2025/03/msg00001.html Ref lists.debian.org/debian-lts-announce/2025/03/msg00002.html

Frequently Asked Questions

What is CVE-2024-55916?

CVE-2024-55916 is a medium-severity vulnerability affecting linux linux_kernel. It was published on January 11, 2025 and has a CVSS 3.1 base score of 5.5 (MEDIUM).

How severe is CVE-2024-55916?

This vulnerability has a CVSS 3.1 base score of 5.5, rated MEDIUM. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

How do I fix or remediate CVE-2024-55916?

How can CyberStrike help with CVE-2024-55916?

CyberStrike's AI-powered security agents can automatically detect CVE-2024-55916 across your infrastructure using autonomous pentesting, DAST scanning, and HackBrowser. The platform continuously monitors for known vulnerabilities and provides actionable remediation guidance prioritized by real-world exploitability.

How CyberStrike Helps

Autonomous Discovery

AI agents map your attack surface to find vulnerabilities like this one.

Continuous Pentesting

Automated penetration testing that runs continuously, not just quarterly.

Code Review

AI-driven PR review catches vulnerable dependencies before they ship.

HackBrowser

Browser-based exploitation validates findings with real proof-of-concept.

Related MEDIUM CVEs from 2024

View all →

6.9

CVE-2023-3726

OCSInventory allow stored email template with special characters that lead to a Stored cross-site Sc

6.9

CVE-2023-51719