Critical

slip: make slhc_remember() more robust against malicious packets

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: slip: make slhc_remember() more robust against malicious packets syzbot found that slhc_remember() was missing checks against malicious packets [1]. slhc_remember() only checked the size of the packet was at least 20, which is not good enough. We need to make sure the packet includes the IPv4 and TCP header that are supposed to be carried. Add iph and th pointers to make the code more readable. [1] BUG: KMSAN: uninit-value in slhc_remember+0x2e8/0x7b0 drivers/net/slip/slhc.c:666 slhc_remember+0x2e8/0x7b0 drivers/net/slip/slhc.c:666 ppp_receive_nonmp_frame+0xe45/0x35e0 drivers/net/ppp/ppp_generic.c:2455 ppp_receive_frame drivers/net/ppp/ppp_generic.c:2372 [inline] ppp_do_recv+0x65f/0x40d0 drivers/net/ppp/ppp_generic.c:2212 ppp_input+0x7dc/0xe60 drivers/net/ppp/ppp_generic.c:2327 pppoe_rcv_core+0x1d3/0x720 drivers/net/ppp/pppoe.c:379 sk_backlog_rcv+0x13b/0x420 include/net/sock.h:1113 __release_sock+0x1da/0x330 net/core/sock.c:3072 release_sock+0x6b/0x250 net/core/sock.c:3626 pppoe_sendmsg+0x2b8/0xb90 drivers/net/ppp/pppoe.c:903 sock_sendmsg_nosec net/socket.c:729 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:744 ____sys_sendmsg+0x903/0xb60 net/socket.c:2602 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2656 __sys_sendmmsg+0x3c1/0x960 net/socket.c:2742 __do_sys_sendmmsg net/socket.c:2771 [inline] __se_sys_sendmmsg net/socket.c:2768 [inline] __x64_sys_sendmmsg+0xbc/0x120 net/socket.c:2768 x64_sys_call+0xb6e/0x3ba0 a

Announced 21 Oct 2024Group revision 1

Original source ↗

CVE-2024-50033

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2024-50033

Linux

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "b5451d783ade99308dfccdf5ca284ed07affa4ff",
        "lessThan": "ba6501ea06462d6404d57d5644cf2854db38e7d7",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "b5451d783ade99308dfccdf5ca284ed07affa4ff",
        "lessThan": "36b054324d18e51cf466134e13b6fbe3c91f52af",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "b5451d783ade99308dfccdf5ca284ed07affa4ff",
        "lessThan": "5e336384cc9b608e0551f99c3d87316ca3b0e51a",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "b5451d783ade99308dfccdf5ca284ed07affa4ff",
        "lessThan": "ff5e0f895315706e4ca5a19df15be6866cee4f5d",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "b5451d783ade99308dfccdf5ca284ed07affa4ff",
        "lessThan": "8bb79eb1db85a10865f0d4dd15b013def3f2d246",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "b5451d783ade99308dfccdf5ca284ed07affa4ff",
        "lessThan": "29e8d96d44f51cf89a62dd042be35d052833b95c",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "b5451d783ade99308dfccdf5ca284ed07affa4ff",
        "lessThan": "7d3fce8cbe3a70a1c7c06c9b53696be5d5d8dd5c",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "drivers/net/slip/slhc.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "3.2"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "3.2",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "5.4.285",
        "versionType": "semver",
        "lessThanOrEqual": "5.4.*"
      },
      {
        "status": "unaffected",
        "version": "5.10.227",
        "versionType": "semver",
        "lessThanOrEqual": "5.10.*"
      },
      {
        "status": "unaffected",
        "version": "5.15.168",
        "versionType": "semver",
        "lessThanOrEqual": "5.15.*"
      },
      {
        "status": "unaffected",
        "version": "6.1.113",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.57",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.11.4",
        "versionType": "semver",
        "lessThanOrEqual": "6.11.*"
      },
      {
        "status": "unaffected",
        "version": "6.12",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "drivers/net/slip/slhc.c"
    ],
    "defaultStatus": "affected"
  }
]

Related CVEs: CVE-2024-50033
Source reference: /cveMetadata/cveId

Publisher severity

critical

Source reference: /containers/cna/metrics

Event: #26772 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 07:14:26 GMT
Publisher date: Mon, 21 Oct 2024 19:39:35 GMT

Read the original announcement

Revision history

25 Oct 2026CVE-2024-50033 · Revision 1Source updated