CVE-2024-50251
netfilter: nft_payload: sanitize offset and length before calling skb_checksum()
MEDIUM
6.2
CVSS Score
Published: November 9, 2024 at 10:14 AM UTC
Updated: October 15, 2026 at 01:19 AM UTC
15 products affected across 2 vendorsLinux KernelSIMATIC S7-1500 CPU 1518-4 Pn /dp MFP FirmwareSiplus S7-1500 CPU 1518-4 Pn /dp MFP Firmware
Using Linux by Linux?
Get instant alerts when new vulnerabilities affect Linux - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM6.2
Exploit prediction
EPSS 0.5%
Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_payload: sanitize offset and length before calling skb_checksum() If access to offset + length is larger than the skbuff length, then skb_checksum() triggers BUG_ON(). skb_checksum() internally subtracts the length parameter while iterating over skbuff, BUG_ON(len) at the end of it checks that the expected length to be included in the checksum calculation is fully consumed.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
4.20 ≤ v < 5.4.2854.5 ≤ v < 4.19.3235.11 ≤ v < 5.15.1715.16 ≤ v < 6.1.1165.5 ≤ v < 5.10.2296.2 ≤ v < 6.6.606.7 ≤ v < 6.11.76.126.12 rc16.12 rc26.12 rc36.12 rc46.12 rc57ec3f7b47b8d9ad7ba425726f2c58f9ddce040df
Vendor states this is fixed in 0ab3be58b45b996764aba0187b46de19b3e58a72 (fixed)
Vendor states this is fixed in a661ed364ae6ae88c2fafa9ddc27df1af2a73701 (fixed)
Vendor states this is fixed in ac7df3fc80fc82bcc3b1e8f6ebc0d2c435d0c534 (fixed)
Vendor states this is fixed in b1d2de8a669fa14c499a385e056944d5352b3b40 (fixed)
Vendor states this is fixed in c43e0ea848e7b9bef7a682cbc5608022d6d29d7b (fixed)
Vendor states this is fixed in d3217323525f7596427124359e76ea0d8fcc9874 (fixed)
Vendor states this is fixed in d5953d680f7e96208c29ce4139a0e38de87a57fe (fixed)
Vendor states this is fixed in e3e608cbad376674d19a71ccd0d41804d9393f02 (fixed)
Vendor states this is fixed in 4.19.323 (unaffected)
Vendor states this is fixed in 4.5 (unaffected)
Vendor states this is fixed in 5.10.229 (unaffected)
Vendor states this is fixed in 5.15.171 (unaffected)
Vendor states this is fixed in 5.4.285 (unaffected)
Vendor states this is fixed in 6.1.116 (unaffected)
Vendor states this is fixed in 6.11.7 (unaffected)
Vendor states this is fixed in 6.12 (unaffected)
Vendor states this is fixed in 6.6.60 (unaffected)
v < V3.2
Affected range stops below V3.2, so it looks safe — our inference, not a vendor statement
v < V3.2
Affected range stops below V3.2, so it looks safe — our inference, not a vendor statement
v < V3.2
Affected range stops below V3.2, so it looks safe — our inference, not a vendor statement
v < V3.2
Affected range stops below V3.2, so it looks safe — our inference, not a vendor statement
v < V3.2
Affected range stops below V3.2, so it looks safe — our inference, not a vendor statement
v < V3.2
Affected range stops below V3.2, so it looks safe — our inference, not a vendor statement
v < V3.2
Affected range stops below V3.2, so it looks safe — our inference, not a vendor statement
v < V3.2
Affected range stops below V3.2, so it looks safe — our inference, not a vendor statement
v < V3.2
Affected range stops below V3.2, so it looks safe — our inference, not a vendor statement
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
Patch and advisory references
- https://git.kernel.org/stable/c/0ab3be58b45b996764aba0187b46de19b3e58a72
- https://git.kernel.org/stable/c/a661ed364ae6ae88c2fafa9ddc27df1af2a73701
- https://git.kernel.org/stable/c/ac7df3fc80fc82bcc3b1e8f6ebc0d2c435d0c534
- https://git.kernel.org/stable/c/b1d2de8a669fa14c499a385e056944d5352b3b40
- https://git.kernel.org/stable/c/c43e0ea848e7b9bef7a682cbc5608022d6d29d7b
References (14)
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/0ab3be58b45b996764aba0187b46de19b3e58a72Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/a661ed364ae6ae88c2fafa9ddc27df1af2a73701Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/ac7df3fc80fc82bcc3b1e8f6ebc0d2c435d0c534Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/b1d2de8a669fa14c499a385e056944d5352b3b40Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/c43e0ea848e7b9bef7a682cbc5608022d6d29d7bPatch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/d3217323525f7596427124359e76ea0d8fcc9874Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/d5953d680f7e96208c29ce4139a0e38de87a57fePatch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/e3e608cbad376674d19a71ccd0d41804d9393f02CVSS
- Attack Vector
- LOCAL
- Complexity
- LOW
- Privileges
- NONE
- User Interaction
- NONE
- Scope
- UNCHANGED
- Confidentiality
- NONE
- Integrity
- NONE
- Availability
- HIGH
Vector?
Quick Info
StatusMODIFIED
CWE
NVD-CWE-noinfo
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card