VYPR
← All advisories
Medium severity6.2NVD Advisory· Published Nov 9, 2024· Updated May 12, 2026

CVE-2024-50251

CVE-2024-50251

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_payload: sanitize offset and length before calling skb_checksum()

If access to offset + length is larger than the skbuff length, then skb_checksum() triggers BUG_ON().

skb_checksum() internally subtracts the length parameter while iterating over skbuff, BUG_ON(len) at the end of it checks that the expected length to be included in the checksum calculation is fully consumed.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A missing bounds check in the Linux kernel's netfilter nft_payload can cause a BUG_ON crash via crafted network packets, leading to local denial of service.

Vulnerability

Overview

In the Linux kernel's netfilter subsystem, the nft_payload module fails to properly validate the offset and length parameters before calling skb_checksum(). If the sum of offset and length exceeds the skbuff's data length, skb_checksum() triggers a BUG_ON() due to an internal length mismatch check [1][4]. This missing bounds check allows a local attacker to cause a kernel panic.

Exploitation

An attacker with local access and the ability to inject crafted netfilter rules (e.g., via nftables) can exploit this vulnerability. The attack requires the ability to set up a netfilter rule that uses the payload expression with a large offset/length combination. The vulnerability is reachable from user space via nftables but requires local privileges (CAP_NET_ADMIN) or a compromised container with netfilter access. A proof-of-concept demonstrating local denial of service is publicly available [4].

Impact

Successful exploitation causes a kernel BUG, resulting in a system crash (denial of service). No privilege escalation or data leak has been reported. The CVSS score of 6.2 reflects medium severity due to the requirement for local access and the availability impact.

Mitigation

The fix was committed to the Linux kernel mainline and backported to stable releases. Users should update their kernel to a version containing the patch. Siemens has listed this CVE in their advisory for affected products (e.g., SIMATIC S7-1500 TM MFP) [1]. No workaround is mentioned; the only mitigation is applying the kernel update.

References
  1. SSA-265688
  2. GitHub - slavin-ayu/CVE-2024-50251-PoC: Just a local Dos bug in Linux kernel

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

144

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

13

News mentions

0

No linked articles in our index yet.