CVE-2024-50072

Medium

In the Linux kernel, the following vulnerability has been resolved: x86/bugs: Use code segment selector for VERW operand Robert Gill reported below #GP in 32-bit mode when dosemu software was executing vm86() system call: general protection fault: 0000 [#1] PREEMPT SMP CPU: 4 PID: 4610 Comm: dosemu.bin Not tainted 6.6.21-gentoo-x86 #1 Hardware name: Dell Inc. PowerEdge 1950/0H723K, BIOS 2.7.0 10/30/2010 EIP: restore_all_switch_stack+0xbe/0xcf EAX: 00000000 EBX: 00000000 ECX: 00000000 EDX: 00000000 ESI: 00000000 EDI: 00000000 EBP: 00000000 ESP: ff8affdc DS: 0000 ES: 0000 FS: 0000 GS: 0033 SS: 0068 EFLAGS: 00010046 CR0: 80050033 CR2: 00c2101c CR3: 04b6d000 CR4: 000406d0 Call Trace: show_regs+0x70/0x78 die_addr+0x29/0x70 exc_general_protection+0x13c/0x348 exc_bounds+0x98/0x98 handle_exception+0x14d/0x14d exc_bounds+0x98/0x98 restore_all_switch_stack+0xbe/0xcf exc_bounds+0x98/0x98 restore_all_switch_stack+0xbe/0xcf This only happens in 32-bit mode when VERW based mitigations like MDS/RFDS are enabled. This is because segment registers with an arbitrary user value can result in #GP when executing VERW. Intel SDM vol. 2C documents the following behavior for VERW instruction: #GP(0) - If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. CLEAR_CPU_BUFFERS macro executes VERW instruction before returning to user space. Use %cs selector to reference VERW operand. This ensures VERW will not #GP for an arbitrary user %ds. [ mingo: Fixed the SOB chain. ]

Package Linux Kernel
Published 2024-10-29
Last modified 2025-11-03
CVSS version 3.1
Patch available
Yes

CVSS 3.1 score

5.5

out of 10
Medium
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
High
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected versions

Linux kernel versions 5.10.215, 5.15.154, 6.1.81, 6.6.21, 6.7.9, 6.8 and later are affected. Fixed in 5.10.229, 5.15.171, 6.1.116, 6.6.58, 6.11.5, 6.12 and their respective stable series.

Affected from
≥ 5.10.215 ≥ 5.15.154 ≥ 6.1.81 ≥ 6.6.21 ≥ 6.7.9 ≥ 6.8
Fixed in
✓ 5.10.229 5.10.x ✓ 5.15.171 5.15.x ✓ 6.1.116 6.1.x ✓ 6.6.58 6.6.x ✓ 6.11.5 6.11.x ✓ 6.12

References

8 total
Showing 5 of 8 references View all on NVD

Frequently asked questions

  • What is CVE-2024-50072?

    CVE-2024-50072 is a Medium severity Linux kernel vulnerability with a CVSS score of 5.5 out of 10 . It affects Linux kernel versions from 5.10.215 onward and has been patched in 5.10.229, 5.15.171, 6.1.116 and others. CVE-2024-50072 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

  • What is the CVSS score for CVE-2024-50072?

    CVE-2024-50072 has a CVSS score of 5.5 out of 10, rated Medium severity (CVSS 3.1). The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H .

  • Is there a patch available for CVE-2024-50072?

    Yes. CVE-2024-50072 has been patched. Fixed versions include 5.10.229, 5.15.171, 6.1.116 and others. If you are running Linux kernel 5.10.215 or later up to the fix versions, apply the relevant patch for your kernel branch.

  • Is CVE-2024-50072 actively exploited?

    No. CVE-2024-50072 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Back to
All CVEs
View on
NVD / NIST