VYPR
← All advisories
Medium severity5.5NVD Advisory· Published Nov 7, 2024· Updated May 12, 2026

CVE-2024-50142

CVE-2024-50142

Description

In the Linux kernel, the following vulnerability has been resolved:

xfrm: validate new SA's prefixlen using SA family when sel.family is unset

This expands the validation introduced in commit 07bf7908950a ("xfrm: Validate address prefix lengths in the xfrm selector.")

syzbot created an SA with usersa.sel.family = AF_UNSPEC usersa.sel.prefixlen_s = 128 usersa.family = AF_INET

Because of the AF_UNSPEC selector, verify_newsa_info doesn't put limits on prefixlen_{s,d}. But then copy_from_user_state sets x->sel.family to usersa.family (AF_INET). Do the same conversion in verify_newsa_info before validating prefixlen_{s,d}, since that's how prefixlen is going to be used later on.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

In the Linux kernel's xfrm subsystem, insufficient validation of prefix lengths when the selector family is AF_UNSPEC allows creating invalid Security Associations.

Vulnerability

In the Linux kernel's xfrm subsystem, when creating a new Security Association (SA), the function verify_newsa_info validates prefix lengths prefixlen_s and prefixlen_d only when the selector family is set. However, if sel.family is AF_UNSPEC, the validation is skipped, allowing arbitrary prefix lengths to be set. Later, copy_from_user_state converts sel.family to the SA's family (e.g., AF_INET), but the previously unchecked prefix lengths are then used, potentially leading to invalid SA configurations [1].

Exploitation

An attacker with sufficient privileges (e.g., CAP_NET_ADMIN) to create SAs can craft an SA with sel.family = AF_UNSPEC and set prefixlen_s to an invalid value (e.g., 128 for IPv4). This bypasses the intended validation that was introduced in commit 07bf7908950a. The syzbot fuzzer demonstrated this by creating an SA with usersa.sel.family = AF_UNSPEC, usersa.sel.prefixlen_s = 128, and usersa.family = AF_INET, resulting in an inconsistent state [1].

Impact

A successful exploit could allow an attacker to create SAs with mismatched prefix lengths and address families, potentially bypassing IPsec security policies or causing denial of service. The vulnerability is rated medium (CVSS 5.5) and affects Linux kernel versions prior to the fix [1].

Mitigation

The fix, which converts sel.family in verify_newsa_info before validating prefix lengths, has been committed to stable kernel branches (e.g., commits [2], [3], [4]). Users should update to the latest kernel versions. Siemens has also listed this CVE in their advisory SSA-265688 for affected SIMATIC products [1].

References
  1. SSA-265688
  2. Making sure you're not a bot!
  3. Making sure you're not a bot!
  4. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

179

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

11

News mentions

0

No linked articles in our index yet.