« Volver al listado

CVE-2024-50271

Estado: ModificadaMedia (5.5)—

In the Linux kernel, the following vulnerability has been resolved:

signal: restore the override_rlimit logic

Prior to commit d64696905554 ("Reimplement RLIMIT_SIGPENDING on top of ucounts") UCOUNT_RLIMIT_SIGPENDING rlimit was not enforced for a class of signals. However now it's enforced unconditionally, even if override_rlimit is set. This behavior change caused production issues.

For example, if the limit is reached and a process receives a SIGSEGV signal, sigqueue_alloc fails to allocate the necessary resources for the signal delivery, preventing the signal from being delivered with siginfo.

Leer descripción completaMostrar menos

This prevents the process from correctly identifying the fault address and handling the error. From the user-space perspective, applications are unaware that the limit has been reached and that the siginfo is effectively 'corrupted'. This can lead to unpredictable behavior and crashes, as we observed with java applications.

Fix this by passing override_rlimit into inc_rlimit_get_ucounts() and skip the comparison to max there if override_rlimit is set. This effectively restores the old behavior.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Linux — Linux Kernel

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-50271",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-50271",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-10-01T20:15:03.580178Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      },
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "d64696905554e919321e31afc210606653b8f6a4",
              "lessThan": "012f4d5d25e9ef92ee129bd5aa7aa60f692681e1",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d64696905554e919321e31afc210606653b8f6a4",
              "lessThan": "4877d9b2a2ebad3ae240127aaa4cb8258b145cf7",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d64696905554e919321e31afc210606653b8f6a4",
              "lessThan": "0208ea17a1e4456fbfe555f13ae5c28f3d671e40",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d64696905554e919321e31afc210606653b8f6a4",
              "lessThan": "9e05e5c7ee8758141d2db7e8fea2cab34500c6ed",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "include/linux/user_namespace.h",
            "kernel/signal.c",
            "kernel/ucount.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.14",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.1.117",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.61",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.11.8",
              "versionType": "semver",
              "lessThanOrEqual": "6.11.*"
            },
            {
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "include/linux/user_namespace.h",
            "kernel/signal.c",
            "kernel/ucount.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2024-11-19T02:16:29.180",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/012f4d5d25e9ef92ee129bd5aa7aa60f692681e1",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/0208ea17a1e4456fbfe555f13ae5c28f3d671e40",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/4877d9b2a2ebad3ae240127aaa4cb8258b145cf7",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/9e05e5c7ee8758141d2db7e8fea2cab34500c6ed",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsignal: restore the override_rlimit logic\n\nPrior to commit d64696905554 (\"Reimplement RLIMIT_SIGPENDING on top of\nucounts\") UCOUNT_RLIMIT_SIGPENDING rlimit was not enforced for a class of\nsignals.  However now it's enforced unconditionally, even if\noverride_rlimit is set.  This behavior change caused production issues.  \n\nFor example, if the limit is reached and a process receives a SIGSEGV\nsignal, sigqueue_alloc fails to allocate the necessary resources for the\nsignal delivery, preventing the signal from being delivered with siginfo. \nThis prevents the process from correctly identifying the fault address and\nhandling the error.  From the user-space perspective, applications are\nunaware that the limit has been reached and that the siginfo is\neffectively 'corrupted'.  This can lead to unpredictable behavior and\ncrashes, as we observed with java applications.\n\nFix this by passing override_rlimit into inc_rlimit_get_ucounts() and skip\nthe comparison to max there if override_rlimit is set.  This effectively\nrestores the old behavior."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: señal: restaurar la lógica override_rlimit Antes de el commit d64696905554 (\"Reimplementar RLIMIT_SIGPENDING sobre ucounts\") UCOUNT_RLIMIT_SIGPENDING rlimit no se aplicaba para una clase de señales. Sin embargo, ahora se aplica de forma incondicional, incluso si se establece override_rlimit. Este cambio de comportamiento provocó problemas de producción. Por ejemplo, si se alcanza el límite y un proceso recibe una señal SIGSEGV, sigqueue_alloc no puede asignar los recursos necesarios para la entrega de la señal, lo que impide que la señal se entregue con siginfo. Esto impide que el proceso identifique correctamente la dirección de falla y maneje el error. Desde la perspectiva del espacio de usuario, las aplicaciones no saben que se ha alcanzado el límite y que la siginfo está efectivamente \"corrupta\". Esto puede provocar un comportamiento impredecible y fallas, como observamos con las aplicaciones Java. Solucione este problema pasando override_rlimit a inc_rlimit_get_ucounts() y omita la comparación con max allí si se configura override_rlimit. Esto restaura efectivamente el comportamiento anterior."
    }
  ],
  "lastModified": "2026-06-17T08:04:04.097",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "06FE3C6A-81D3-425E-8D47-5E9B9DCA40F4",
              "versionEndExcluding": "6.1.117",
              "versionStartIncluding": "5.14"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "630ED7EB-C97E-4435-B884-1E309E40D6F3",
              "versionEndExcluding": "6.6.61",
              "versionStartIncluding": "6.2"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0BD000F7-3DAD-4DD3-8906-98EA1EC67E95",
              "versionEndExcluding": "6.11.8",
              "versionStartIncluding": "6.7"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7F361E1D-580F-4A2D-A509-7615F73167A1"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "925478D0-3E3D-4E6F-ACD5-09F28D5DF82C"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3C95E234-D335-4B6C-96BF-E2CEBD8654ED"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E0F717D8-3014-4F84-8086-0124B2111379"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "24DBE6C7-2AAE-4818-AED2-E131F153D2FA"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "24B88717-53F5-42AA-9B72-14C707639E3F"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}