CVE-2024-50303— resource,kexec: walk_system_ram_res_rev must retain resource flags
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于walk_system_ram_res_rev中的资源标志保留。
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of ServiceAffected Version Matrix 6
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 7acf164b259d9007264d9d8501da1023f140a3b4< dc9031b7919bd346514ea9a720f433b8daf3970d |
affected |
7acf164b259d9007264d9d8501da1023f140a3b4< b125a0def25a082ae944c9615208bf359abdb61c |
affected | ||
6.8 |
affected | ||
< 6.8 |
unaffected | ||
6.11.7≤ 6.11.* |
unaffected | ||
6.12≤ * |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-50303
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
resource,kexec: walk_system_ram_res_rev must retain resource flags
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
resource,kexec: walk_system_ram_res_rev must retain resource flags
walk_system_ram_res_rev() erroneously discards resource flags when passing
the information to the callback.
This causes systems with IORESOURCE_SYSRAM_DRIVER_MANAGED memory to have
these resources selected during kexec to store kexec buffers if that
memory happens to be at placed above normal system ram.
This leads to undefined behavior after reboot. If the kexec buffer is
never touched, nothing happens. If the kexec buffer is touched, it could
lead to a crash (like below) or undefined behavior.
Tested on a system with CXL memory expanders with driver managed memory,
TPM enabled, and CONFIG_IMA_KEXEC=y. Adding printk's showed the flags
were being discarded and as a result the check for
IORESOURCE_SYSRAM_DRIVER_MANAGED passes.
find_next_iomem_res: name(System RAM (kmem))
start(10000000000)
end(1034fffffff)
flags(83000200)
locate_mem_hole_top_down: start(10000000000) end(1034fffffff) flags(0)
[.] BUG: unable to handle page fault for address: ffff89834ffff000
[.] #PF: supervisor read access in kernel mode
[.] #PF: error_code(0x0000) - not-present page
[.] PGD c04c8bf067 P4D c04c8bf067 PUD c04c8be067 PMD 0
[.] Oops: 0000 [#1] SMP
[.] RIP: 0010:ima_restore_measurement_list+0x95/0x4b0
[.] RSP: 0018:ffffc900000d3a80 EFLAGS: 00010286
[.] RAX: 0000000000001000 RBX: 0000000000000000 RCX: ffff89834ffff000
[.] RDX: 0000000000000018 RSI: ffff89834ffff000 RDI: ffff89834ffff018
[.] RBP: ffffc900000d3ba0 R08: 0000000000000020 R09: ffff888132b8a900
[.] R10: 4000000000000000 R11: 000000003a616d69 R12: 0000000000000000
[.] R13: ffffffff8404ac28 R14: 0000000000000000 R15: ffff89834ffff000
[.] FS: 0000000000000000(0000) GS:ffff893d44640000(0000) knlGS:0000000000000000
[.] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[.] ata5: SATA link down (SStatus 0 SControl 300)
[.] CR2: ffff89834ffff000 CR3: 000001034d00f001 CR4: 0000000000770ef0
[.] PKRU: 55555554
[.] Call Trace:
[.] <TASK>
[.] ? __die+0x78/0xc0
[.] ? page_fault_oops+0x2a8/0x3a0
[.] ? exc_page_fault+0x84/0x130
[.] ? asm_exc_page_fault+0x22/0x30
[.] ? ima_restore_measurement_list+0x95/0x4b0
[.] ? template_desc_init_fields+0x317/0x410
[.] ? crypto_alloc_tfm_node+0x9c/0xc0
[.] ? init_ima_lsm+0x30/0x30
[.] ima_load_kexec_buffer+0x72/0xa0
[.] ima_init+0x44/0xa0
[.] __initstub__kmod_ima__373_1201_init_ima7+0x1e/0xb0
[.] ? init_ima_lsm+0x30/0x30
[.] do_one_initcall+0xad/0x200
[.] ? idr_alloc_cyclic+0xaa/0x110
[.] ? new_slab+0x12c/0x420
[.] ? new_slab+0x12c/0x420
[.] ? number+0x12a/0x430
[.] ? sysvec_apic_timer_interrupt+0xa/0x80
[.] ? asm_sysvec_apic_timer_interrupt+0x16/0x20
[.] ? parse_args+0xd4/0x380
[.] ? parse_args+0x14b/0x380
[.] kernel_init_freeable+0x1c1/0x2b0
[.] ? rest_init+0xb0/0xb0
[.] kernel_init+0x16/0x1a0
[.] ret_from_fork+0x2f/0x40
[.] ? rest_init+0xb0/0xb0
[.] ret_from_fork_asm+0x11/0x20
[.] </TASK>
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于walk_system_ram_res_rev中的资源标志保留。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2024-50303
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-50303
请登录查看更多情报信息。
Patches & Fixes for CVE-2024-50303 (1)
Same Patch Batch · Linux · 2024-11-19 · 88 CVEs total
| CVE-2024-50283 | 9.8 CRITICAL | ksmbd: fix slab-use-after-free in smb3_preauth_hash_rsp |
| CVE-2024-50286 | 9.8 CRITICAL | ksmbd: fix slab-use-after-free in ksmbd_smb2_session_create |
| CVE-2024-50276 | 9.8 CRITICAL | net: vertexcom: mse102x: Fix possible double free of TX skb |
| CVE-2024-53066 | 9.8 CRITICAL | nfs: Fix KMSAN warning in decode_getfattr_attrs() |
| CVE-2024-53058 | 9.4 CRITICAL | net: stmmac: TSO: Fix unbalanced DMA map/unmap for non-paged SKB data |
| CVE-2024-53082 | 8.4 HIGH | virtio_net: Add hash_key_length check |
| CVE-2024-50299 | 8.2 HIGH | sctp: properly validate chunk size in sctp_sf_ootb() |
| CVE-2024-50293 | 7.8 HIGH | net/smc: do not leave a dangling sk pointer in __smc_create() |
| CVE-2024-50291 | 7.8 HIGH | media: dvb-core: add missing buffer index check |
| CVE-2024-50294 | 7.8 HIGH | rxrpc: Fix missing locking causing hanging calls |
| CVE-2023-52921 | 7.8 HIGH | drm/amdgpu: fix possible UAF in amdgpu_cs_pass1() |
| CVE-2024-50288 | 7.8 HIGH | media: vivid: fix buffer overwrite when using > 32 buffers |
| CVE-2024-53063 | 7.8 HIGH | media: dvbdev: prevent the risk of out of memory access |
| CVE-2024-53088 | 7.8 HIGH | i40e: fix race condition by adding filter's intermediate sync state |
| CVE-2024-53080 | 7.8 HIGH | drm/panthor: Lock XArray when getting entries for the VM |
| CVE-2024-53079 | 7.8 HIGH | mm/thp: fix deferred split unqueue naming and locking |
| CVE-2024-53076 | 7.8 HIGH | iio: gts-helper: Fix memory leaks for the error path of iio_gts_build_avail_scale_table() |
| CVE-2024-53044 | 7.8 HIGH | net/sched: sch_api: fix xa_insert() error path in tcf_block_get_ext() |
| CVE-2024-50301 | 7.8 HIGH | security/keys: fix slab-out-of-bounds in key_task_permission |
| CVE-2024-50300 | 7.8 HIGH | regulator: rtq2208: Fix uninitialized use of regulator_config |
Showing top 20 of 88 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2023-7356
Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SE -
CVE-2026-98869
bpf: Infer zext_dst based on static register liveness analys -
CVE-2026-98868
dm-pcache: reject a kset that overruns its segment -
CVE-2026-98867
dm-pcache: bound the logical key offset from persistent memo -
CVE-2026-98866
sched/cache: Introduce task_struct->sched_cache_grp to fix U
Same vendor: Linux
-
CVE-2023-7356
Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SE -
CVE-2026-98869
bpf: Infer zext_dst based on static register liveness analys -
CVE-2026-98868
dm-pcache: reject a kset that overruns its segment -
CVE-2026-98867
dm-pcache: bound the logical key offset from persistent memo -
CVE-2026-98866
sched/cache: Introduce task_struct->sched_cache_grp to fix U
V. Comments for CVE-2024-50303
No comments yet