{"id":"CVE-2024-50033","revision":null,"records":[{"revision":"bda9f597d31649978d0d8e7f2951b711","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2024-50033","aliases":[],"title":"slip: make slhc_remember() more robust against malicious packets","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nslip: make slhc_remember() more robust against malicious packets\n\nsyzbot found that slhc_remember() was missing checks against\nmalicious packets [1].\n\nslhc_remember() only checked the size of the packet was at least 20,\nwhich is not good enough.\n\nWe need to make sure the packet includes the IPv4 and TCP header\nthat are supposed to be carried.\n\nAdd iph and th pointers to make the code more readable.\n\n[1]\n\nBUG: KMSAN: uninit-value in slhc_remember+0x2e8/0x7b0 drivers/net/slip/slhc.c:666\n slhc_remember+0x2e8/0x7b0 drivers/net/slip/slhc.c:666\n ppp_receive_nonmp_frame+0xe45/0x35e0 drivers/net/ppp/ppp_generic.c:2455\n ppp_receive_frame drivers/net/ppp/ppp_generic.c:2372 [inline]\n ppp_do_recv+0x65f/0x40d0 drivers/net/ppp/ppp_generic.c:2212\n ppp_input+0x7dc/0xe60 drivers/net/ppp/ppp_generic.c:2327\n pppoe_rcv_core+0x1d3/0x720 drivers/net/ppp/pppoe.c:379\n sk_backlog_rcv+0x13b/0x420 include/net/sock.h:1113\n __release_sock+0x1da/0x330 net/core/sock.c:3072\n release_sock+0x6b/0x250 net/core/sock.c:3626\n pppoe_sendmsg+0x2b8/0xb90 drivers/net/ppp/pppoe.c:903\n sock_sendmsg_nosec net/socket.c:729 [inline]\n __sock_sendmsg+0x30f/0x380 net/socket.c:744\n ____sys_sendmsg+0x903/0xb60 net/socket.c:2602\n ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2656\n __sys_sendmmsg+0x3c1/0x960 net/socket.c:2742\n __do_sys_sendmmsg net/socket.c:2771 [inline]\n __se_sys_sendmmsg net/socket.c:2768 [inline]\n __x64_sys_sendmmsg+0xbc/0x120 net/socket.c:2768\n x64_sys_call+0xb6e/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:308\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nUninit was created at:\n slab_post_alloc_hook mm/slub.c:4091 [inline]\n slab_alloc_node mm/slub.c:4134 [inline]\n kmem_cache_alloc_node_noprof+0x6bf/0xb80 mm/slub.c:4186\n kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:587\n __alloc_skb+0x363/0x7b0 net/core/skbuff.c:678\n alloc_skb include/linux/skbuff.h:1322 [inline]\n sock_wmalloc+0xfe/0x1a0 net/core/sock.c:2732\n pppoe_sendmsg+0x3a7/0xb90 drivers/net/ppp/pppoe.c:867\n sock_sendmsg_nosec net/socket.c:729 [inline]\n __sock_sendmsg+0x30f/0x380 net/socket.c:744\n ____sys_sendmsg+0x903/0xb60 net/socket.c:2602\n ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2656\n __sys_sendmmsg+0x3c1/0x960 net/socket.c:2742\n __do_sys_sendmmsg net/socket.c:2771 [inline]\n __se_sys_sendmmsg net/socket.c:2768 [inline]\n __x64_sys_sendmmsg+0xbc/0x120 net/socket.c:2768\n x64_sys_call+0xb6e/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:308\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nCPU: 0 UID: 0 PID: 5460 Comm: syz.2.33 Not tainted 6.12.0-rc2-syzkaller-00006-g87d6aab2389e #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024","state":0,"publishedAt":"2024-10-21T19:39:35.127+00:00","modifiedAt":"2026-10-15T00:56:17.152+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"product\": \"Linux\",\n \"vendor\": \"Linux\",\n \"defaultStatus\": \"unaffected\",\n \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n \"programFiles\": [\n \"drivers/net/slip/slhc.c\"\n ],\n \"versions\": [\n {\n \"version\": \"b5451d783ade99308dfccdf5ca284ed07affa4ff\",\n \"lessThan\": \"ba6501ea06462d6404d57d5644cf2854db38e7d7\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"b5451d783ade99308dfccdf5ca284ed07affa4ff\",\n \"lessThan\": \"36b054324d18e51cf466134e13b6fbe3c91f52af\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"b5451d783ade99308dfccdf5ca284ed07affa4ff\",\n \"lessThan\": \"5e336384cc9b608e0551f99c3d87316ca3b0e51a\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"b5451d783ade99308dfccdf5ca284ed07affa4ff\",\n \"lessThan\": \"ff5e0f895315706e4ca5a19df15be6866cee4f5d\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"b5451d783ade99308dfccdf5ca284ed07affa4ff\",\n \"lessThan\": \"8bb79eb1db85a10865f0d4dd15b013def3f2d246\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"b5451d783ade99308dfccdf5ca284ed07affa4ff\",\n \"lessThan\": \"29e8d96d44f51cf89a62dd042be35d052833b95c\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"b5451d783ade99308dfccdf5ca284ed07affa4ff\",\n \"lessThan\": \"7d3fce8cbe3a70a1c7c06c9b53696be5d5d8dd5c\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"product\": \"Linux\",\n \"vendor\": \"Linux\",\n \"defaultStatus\": \"affected\",\n \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n \"programFiles\": [\n \"drivers/net/slip/slhc.c\"\n ],\n \"versions\": [\n {\n \"version\": \"3.2\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"0\",\n \"lessThan\": \"3.2\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"5.4.285\",\n \"lessThanOrEqual\": \"5.4.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"5.10.227\",\n \"lessThanOrEqual\": \"5.10.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"5.15.168\",\n \"lessThanOrEqual\": \"5.15.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.1.113\",\n \"lessThanOrEqual\": \"6.1.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.6.57\",\n \"lessThanOrEqual\": \"6.6.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.11.4\",\n \"lessThanOrEqual\": \"6.11.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.12\",\n \"lessThanOrEqual\": \"*\",\n \"status\": \"unaffected\",\n \"versionType\": \"original_commit_for_fix\"\n }\n ]\n }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8,"severity":"CRITICAL"}],"references":["https://git.kernel.org/stable/c/ba6501ea06462d6404d57d5644cf2854db38e7d7","https://git.kernel.org/stable/c/36b054324d18e51cf466134e13b6fbe3c91f52af","https://git.kernel.org/stable/c/5e336384cc9b608e0551f99c3d87316ca3b0e51a","https://git.kernel.org/stable/c/ff5e0f895315706e4ca5a19df15be6866cee4f5d","https://git.kernel.org/stable/c/8bb79eb1db85a10865f0d4dd15b013def3f2d246","https://git.kernel.org/stable/c/29e8d96d44f51cf89a62dd042be35d052833b95c","https://git.kernel.org/stable/c/7d3fce8cbe3a70a1c7c06c9b53696be5d5d8dd5c"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-50033","license":"CVE Program Terms of Use","key":"cve-program:CVE-2024-50033","identifiers":["CVE-2024-50033"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-09T20:04:25.0077254+00:00","complete":true,"records":1772,"lastAttemptAt":"2026-11-09T20:04:25.0077254+00:00","lastSuccessAt":"2026-11-09T20:04:25.1926568+00:00","error":null,"lastVerifiedAt":"2026-11-09T20:04:25.192657+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-24e6fde7b744113daefb8f6135035fb8a5c69c9617c9c0d40574a0376532ffd3-4a9560b8b58726018512a0a26f2f2de094eec0a9257ebc797e76aa7229628f6d","complete":true,"records":421528,"lastAttemptAt":"2026-11-09T20:02:23.7922996+00:00","lastSuccessAt":"2026-11-09T20:02:23.6346925+00:00","error":null,"lastVerifiedAt":"2026-11-09T20:02:23.7922996+00:00","snapshotPublishedAt":"2026-11-09T19:26:49+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-7062dd6d7628421ab96b6fad5e9e5783","complete":false,"records":13655,"lastAttemptAt":"2026-11-09T20:16:49.2041123+00:00","lastSuccessAt":"2026-11-09T20:16:49.199+00:00","error":"9 identifier lookups failed; latest failures include HTTP 403. Other identifiers were checked independently.","lastVerifiedAt":"2026-11-09T20:16:49.199+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13314,"expectedIdentifiers":13707,"failedIdentifiers":9},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-09T20:04:25.0077254+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-09T20:04:25.0077254+00:00","lastSuccessAt":"2026-11-09T20:04:25.193761+00:00","error":null,"lastVerifiedAt":"2026-11-09T20:04:25.1937612+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-9938fd6291bf40d68f5b1fd395158ad4","complete":true,"records":13667,"lastAttemptAt":"2026-11-09T20:04:38.0577664+00:00","lastSuccessAt":"2026-11-09T20:04:38.055+00:00","error":null,"lastVerifiedAt":"2026-11-09T20:04:38.055+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13707,"expectedIdentifiers":13707,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-980593e6977a6d1b4fb1eed5a1ffe88a468736f89f0a06f710924ad59132c023","complete":true,"records":9914,"lastAttemptAt":"2026-11-09T20:04:24.9600639+00:00","lastSuccessAt":"2026-11-08T11:07:07.068788+00:00","error":null,"lastVerifiedAt":"2026-11-09T20:04:24.9600639+00:00","snapshotPublishedAt":"2026-11-08T11:02:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-712163772d637a9cfaa34d4241efb9e9d0ccd6149596c672c613d362f44af841","complete":true,"records":1971,"lastAttemptAt":"2026-11-09T20:02:23.9593912+00:00","lastSuccessAt":"2026-11-09T18:02:23.0088273+00:00","error":null,"lastVerifiedAt":"2026-11-09T20:02:23.9593912+00:00","snapshotPublishedAt":"2026-11-09T17:03:01+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-761ecc9061239b0da572dc9254c6f384c1d19339eb08408c436647a2f26129e9","complete":true,"records":3064,"lastAttemptAt":"2026-11-09T20:04:24.9750181+00:00","lastSuccessAt":"2026-11-09T17:05:03.4044794+00:00","error":null,"lastVerifiedAt":"2026-11-09T20:04:24.9750181+00:00","snapshotPublishedAt":"2026-11-09T16:33:20+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-604a3d0f2ac3a85e07b87120f064f717efb18ea8fa81b2bec8e0f33ba949fa25","complete":true,"records":231321,"lastAttemptAt":"2026-11-09T20:04:24.8172812+00:00","lastSuccessAt":"2026-11-09T20:04:23.3062045+00:00","error":null,"lastVerifiedAt":"2026-11-09T20:04:24.8172812+00:00","snapshotPublishedAt":"2026-11-09T19:33:14+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}