CVE-2024-50072 Affecting kernel-uek package, versions <0:5.15.0-303.171.5.2.el8uek
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-ORACLE8-KERNELUEK-8539277
- published20 Dec 2024
- disclosed29 Oct 2024
Introduced: 29 Oct 2024
CVE-2024-50072 (opens in a new tab)How to fix?
Upgrade Oracle:8 kernel-uek to version 0:5.15.0-303.171.5.2.el8uek or higher.
This issue was patched in ELSA-2024-12887.
NVD Description
Note: Versions mentioned in the description apply only to the upstream kernel-uek package and not the kernel-uek package as distributed by Oracle.
See How to fix? for Oracle:8 relevant fixed versions and status.
In the Linux kernel, the following vulnerability has been resolved:
x86/bugs: Use code segment selector for VERW operand
Robert Gill reported below #GP in 32-bit mode when dosemu software was executing vm86() system call:
general protection fault: 0000 [#1] PREEMPT SMP CPU: 4 PID: 4610 Comm: dosemu.bin Not tainted 6.6.21-gentoo-x86 #1 Hardware name: Dell Inc. PowerEdge 1950/0H723K, BIOS 2.7.0 10/30/2010 EIP: restore_all_switch_stack+0xbe/0xcf EAX: 00000000 EBX: 00000000 ECX: 00000000 EDX: 00000000 ESI: 00000000 EDI: 00000000 EBP: 00000000 ESP: ff8affdc DS: 0000 ES: 0000 FS: 0000 GS: 0033 SS: 0068 EFLAGS: 00010046 CR0: 80050033 CR2: 00c2101c CR3: 04b6d000 CR4: 000406d0 Call Trace: show_regs+0x70/0x78 die_addr+0x29/0x70 exc_general_protection+0x13c/0x348 exc_bounds+0x98/0x98 handle_exception+0x14d/0x14d exc_bounds+0x98/0x98 restore_all_switch_stack+0xbe/0xcf exc_bounds+0x98/0x98 restore_all_switch_stack+0xbe/0xcf
This only happens in 32-bit mode when VERW based mitigations like MDS/RFDS are enabled. This is because segment registers with an arbitrary user value can result in #GP when executing VERW. Intel SDM vol. 2C documents the following behavior for VERW instruction:
#GP(0) - If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit.
CLEAR_CPU_BUFFERS macro executes VERW instruction before returning to user space. Use %cs selector to reference VERW operand. This ensures VERW will not #GP for an arbitrary user %ds.
[ mingo: Fixed the SOB chain. ]
References
- https://linux.oracle.com/cve/CVE-2024-50072.html
- https://linux.oracle.com/errata/ELSA-2024-12887.html
- https://git.kernel.org/stable/c/481b477ab63c7245715a3e57ba79eb87c2dc0d02
- https://git.kernel.org/stable/c/bc576fbaf82deded606e69a00efe9752136bf91d
- https://git.kernel.org/stable/c/e4d2102018542e3ae5e297bc6e229303abff8a0f
- https://git.kernel.org/stable/c/38c5fe74f3bef98f75d16effa49836d50c9b6097
- https://git.kernel.org/stable/c/ada431c6c31a2c8c37991c46089af5caa23a9c6e
- https://git.kernel.org/stable/c/bfd1d223d80cb29a210caa1bd5e21f0816d58f02