CVE-2024-50302
Description
Important: kernel security update
CISA KEV
- Vendor
- Linux
- Product
- Kernel
- Due date
- 2025-03-25
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: alma — https://errata.almalinux.org/9/ALSA-2025-2627.html
Vendor advisory: alma — https://bugzilla.redhat.com/2329924
Vendor advisory: alma — https://bugzilla.redhat.com/2329370
Vendor advisory: alma — https://bugzilla.redhat.com/2327168
Vendor advisory: alma — https://bugzilla.redhat.com/2268295
Vendor advisory: alma — https://errata.almalinux.org/8/ALSA-2025-2474.html
Vendor advisory: alma — https://access.redhat.com/errata/RHSA-2025:2474
Vendor advisory: alma — https://errata.almalinux.org/8/ALSA-2025-2473.html
Vendor advisory: alma — https://bugzilla.redhat.com/2348562
Vendor advisory: alma — https://bugzilla.redhat.com/2337098
Vendor advisory: alma — https://bugzilla.redhat.com/2334412
Vendor advisory: alma — https://bugzilla.redhat.com/2327169
Vendor advisory: alma — https://access.redhat.com/errata/RHSA-2025:2473
Vendor advisory: cisa-kev — This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. For more information, please see: https://lore.kernel.org/linux-cve-announce/2024111908-CVE-2024-50302-f677@gregkh/ ; https://source.android.com/docs/security/bulletin/2025-03-01 ; https://nvd.nist.gov/vuln/detail/CVE-2024-50302
Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2024-50302
Vendor advisory: suse — https://www.suse.com/security/cve/CVE-2024-50302.html
Vendor advisory: rocky — https://errata.rockylinux.org/RLSA-2025:2473
Vendor advisory: rocky — https://errata.rockylinux.org/RLSA-2025:2474
Vendor advisory: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 — https://git.kernel.org/stable/c/e7ea60184e1e88a3c9e437b3265cbb6439aa7e26
Vendor advisory: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 — https://git.kernel.org/stable/c/d7dc68d82ab3fcfc3f65322465da3d7031d4ab46
Vendor advisory: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 — https://git.kernel.org/stable/c/9d9f5c75c0c7f31766ec27d90f7a6ac673193191
Vendor advisory: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 — https://git.kernel.org/stable/c/492015e6249fbcd42138b49de3c588d826dd9648
Vendor advisory: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 — https://git.kernel.org/stable/c/3f9e88f2672c4635960570ee9741778d4135ecf5
Vendor advisory: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 — https://git.kernel.org/stable/c/1884ab3d22536a5c14b17c78c2ce76d1734e8b0b
Vendor advisory: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 — https://git.kernel.org/stable/c/177f25d1292c7e16e1199b39c85480f7f8815552
Vendor advisory: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 — https://git.kernel.org/stable/c/05ade5d4337867929e7ef664e7ac8e0c734f1aaf
Vendor advisory: redhat — https://access.redhat.com/errata/RHSA-2025:2627
Exploits
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| rhel | 9 | fixed | |
| rocky | 8 | fixed | |
| sles | affected | | |
| debian | bookworm | fixed | 6.1.119-1 |
| debian | bullseye | fixed | 5.10.234-1 |
| debian | forky | fixed | 6.11.9-1 |
| debian | sid | fixed | 6.11.9-1 |
| debian | trixie | fixed | 6.11.9-1 |
| linux-kernel | affected | 4.19.324 | |
| linux-kernel | 6.12 | affected | |
| debian | 11.0 | affected | |
References
- https://access.redhat.com/errata/RHSA-2025:2627
- https://git.kernel.org/stable/c/05ade5d4337867929e7ef664e7ac8e0c734f1aaf
- https://git.kernel.org/stable/c/177f25d1292c7e16e1199b39c85480f7f8815552
- https://git.kernel.org/stable/c/1884ab3d22536a5c14b17c78c2ce76d1734e8b0b
- https://git.kernel.org/stable/c/3f9e88f2672c4635960570ee9741778d4135ecf5
- https://git.kernel.org/stable/c/492015e6249fbcd42138b49de3c588d826dd9648
- https://git.kernel.org/stable/c/9d9f5c75c0c7f31766ec27d90f7a6ac673193191
- https://git.kernel.org/stable/c/d7dc68d82ab3fcfc3f65322465da3d7031d4ab46
- https://git.kernel.org/stable/c/e7ea60184e1e88a3c9e437b3265cbb6439aa7e26
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html
- https://cert-portal.siemens.com/productcert/html/ssa-265688.html
- https://cert-portal.siemens.com/productcert/html/ssa-355557.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-50302
- https://errata.rockylinux.org/RLSA-2025:2474
- https://errata.rockylinux.org/RLSA-2025:2473
- https://www.suse.com/security/cve/CVE-2024-50302.html
- https://security-tracker.debian.org/tracker/CVE-2024-50302
- This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. For more information, please see: https://lore.kernel.org/linux-cve-announce/2024111908-CVE-2024-50302-f677@gregkh/ ; https://source.android.com/docs/security/bulletin/2025-03-01 ; https://nvd.nist.gov/vuln/detail/CVE-2024-50302
- https://access.redhat.com/errata/RHSA-2025:2473
- https://bugzilla.redhat.com/2327169
- https://bugzilla.redhat.com/2334412
- https://bugzilla.redhat.com/2337098
- https://bugzilla.redhat.com/2348562
- https://errata.almalinux.org/8/ALSA-2025-2473.html
CWEs
CWE-908
Verify integrity in audit chain (admin only). AS-IS.