CVE-2024-50155— netdevsim: use cond_resched() in nsim_dev_trap_report_work()
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于在nsim_dev_trap_report_work函数中未正确处理cond_resched()。
Possible ATT&CK Techniques 1 AI
T1498 · Network Denial of ServiceAffected Version Matrix 14
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 0193e0660cc6689c794794b471492923cfd7bfbc< 24973f4b64f93232a48fe78029385de762a2418d |
affected |
6eecddd9c3c8d6e3a097531cdc6d500335b35e46< 681ce79ab6fba2f8d1c5ea60239f0086baebd0d3 |
affected | ||
ba5e1272142d051dcc57ca1d3225ad8a089f9858< 32f054f93937b548c61b3bf57d8f4aefc50f3b16 |
affected | ||
ba5e1272142d051dcc57ca1d3225ad8a089f9858< a1494d532e28598bde7a5544892ef9c7dbfafa93 |
affected | ||
d91964cdada76740811b7c621239f9c407820dbc |
affected | ||
6.1.78< 6.1.115 |
affected | ||
6.6.17< 6.6.59 |
affected | ||
6.7.5< 6.8 |
affected | ||
| … +6 more rows | |||
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-50155
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
netdevsim: use cond_resched() in nsim_dev_trap_report_work()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
netdevsim: use cond_resched() in nsim_dev_trap_report_work()
I am still seeing many syzbot reports hinting that syzbot
might fool nsim_dev_trap_report_work() with hundreds of ports [1]
Lets use cond_resched(), and system_unbound_wq
instead of implicit system_wq.
[1]
INFO: task syz-executor:20633 blocked for more than 143 seconds.
Not tainted 6.12.0-rc2-syzkaller-00205-g1d227fcc7222 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor state:D stack:25856 pid:20633 tgid:20633 ppid:1 flags:0x00004006
...
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 16760 Comm: kworker/1:0 Not tainted 6.12.0-rc2-syzkaller-00205-g1d227fcc7222 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Workqueue: events nsim_dev_trap_report_work
RIP: 0010:__sanitizer_cov_trace_pc+0x0/0x70 kernel/kcov.c:210
Code: 89 fb e8 23 00 00 00 48 8b 3d 04 fb 9c 0c 48 89 de 5b e9 c3 c7 5d 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <f3> 0f 1e fa 48 8b 04 24 65 48 8b 0c 25 c0 d7 03 00 65 8b 15 60 f0
RSP: 0018:ffffc90000a187e8 EFLAGS: 00000246
RAX: 0000000000000100 RBX: ffffc90000a188e0 RCX: ffff888027d3bc00
RDX: ffff888027d3bc00 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff88804a2e6000 R08: ffffffff8a4bc495 R09: ffffffff89da3577
R10: 0000000000000004 R11: ffffffff8a4bc2b0 R12: dffffc0000000000
R13: ffff88806573b503 R14: dffffc0000000000 R15: ffff8880663cca00
FS: 0000000000000000(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fc90a747f98 CR3: 000000000e734000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 000000000000002b DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Call Trace:
<NMI>
</NMI>
<TASK>
__local_bh_enable_ip+0x1bb/0x200 kernel/softirq.c:382
spin_unlock_bh include/linux/spinlock.h:396 [inline]
nsim_dev_trap_report drivers/net/netdevsim/dev.c:820 [inline]
nsim_dev_trap_report_work+0x75d/0xaa0 drivers/net/netdevsim/dev.c:850
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310
worker_thread+0x870/0xd30 kernel/workqueue.c:3391
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于在nsim_dev_trap_report_work函数中未正确处理cond_resched()。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2024-50155
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-50155
请登录查看更多情报信息。
Patches & Fixes for CVE-2024-50155 (1)
Same Patch Batch · Linux · 2024-11-07 · 34 CVEs total
| CVE-2024-50162 | 9.8 CRITICAL | bpf: devmap: provide rxq after redirect |
| CVE-2024-50154 | 9.8 CRITICAL | tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). |
| CVE-2024-50152 | 9.8 CRITICAL | smb: client: fix possible double free in smb2_set_ea() |
| CVE-2024-50139 | 7.9 HIGH | KVM: arm64: Fix shift-out-of-bounds bug |
| CVE-2024-50150 | 7.8 HIGH | usb: typec: altmode should keep reference to parent |
| CVE-2024-50161 | 7.8 HIGH | bpf: Check the remaining info_cnt before repeating btf fields |
| CVE-2024-50164 | 7.8 HIGH | bpf: Fix overloading of MEM_UNINIT's meaning |
| CVE-2024-50158 | 7.8 HIGH | RDMA/bnxt_re: Fix out of bound check |
| CVE-2024-50165 | 7.8 HIGH | bpf: Preserve param->string when parsing mount options |
| CVE-2024-50151 | 7.8 HIGH | smb: client: fix OOBs when building SMB2_IOCTL request |
| CVE-2024-50149 | 7.8 HIGH | drm/xe: Don't free job in TDR |
| CVE-2024-50143 | 7.8 HIGH | udf: fix uninit-value use in udf_get_fileshortad |
| CVE-2024-50141 | 7.8 HIGH | ACPI: PRM: Find EFI_MEMORY_RUNTIME block for PRM handler and context |
| CVE-2024-50145 | 7.5 HIGH | octeon_ep: Add SKB allocation failures handling in __octep_oq_process_rx() |
| CVE-2024-50170 | 7.5 HIGH | net: bcmasp: fix potential memory leak in bcmasp_xmit() |
| CVE-2024-50159 | 7.0 HIGH | firmware: arm_scmi: Fix the double free in scmi_debugfs_common_setup() |
| CVE-2024-50156 | drm/msm: Avoid NULL dereference in msm_disp_state_print_regs() | |
| CVE-2024-50167 | be2net: fix potential memory leak in be_xmit() | |
| CVE-2024-50168 | net/sun3_82586: fix potential memory leak in sun3_82586_send_packet() | |
| CVE-2024-50166 | fsl/fman: Fix refcount handling of fman-related devices |
Showing top 20 of 34 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2023-7356
Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SE -
CVE-2026-98869
bpf: Infer zext_dst based on static register liveness analys -
CVE-2026-98868
dm-pcache: reject a kset that overruns its segment -
CVE-2026-98867
dm-pcache: bound the logical key offset from persistent memo -
CVE-2026-98866
sched/cache: Introduce task_struct->sched_cache_grp to fix U
Same vendor: Linux
-
CVE-2023-7356
Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SE -
CVE-2026-98869
bpf: Infer zext_dst based on static register liveness analys -
CVE-2026-98868
dm-pcache: reject a kset that overruns its segment -
CVE-2026-98867
dm-pcache: bound the logical key offset from persistent memo -
CVE-2026-98866
sched/cache: Introduce task_struct->sched_cache_grp to fix U
V. Comments for CVE-2024-50155
No comments yet