CVE-2024-56650 (GCVE-0-2024-56650)

Vulnerability from cvelistv5 – Published: 2024-12-27 15:02 – Updated: 2026-08-05 11:45
VLAI
Title
netfilter: x_tables: fix LED ID check in led_tg_check()
Summary
In the Linux kernel, the following vulnerability has been resolved: netfilter: x_tables: fix LED ID check in led_tg_check() Syzbot has reported the following BUG detected by KASAN: BUG: KASAN: slab-out-of-bounds in strlen+0x58/0x70 Read of size 1 at addr ffff8881022da0c8 by task repro/5879 ... Call Trace: <TASK> dump_stack_lvl+0x241/0x360 ? __pfx_dump_stack_lvl+0x10/0x10 ? __pfx__printk+0x10/0x10 ? _printk+0xd5/0x120 ? __virt_addr_valid+0x183/0x530 ? __virt_addr_valid+0x183/0x530 print_report+0x169/0x550 ? __virt_addr_valid+0x183/0x530 ? __virt_addr_valid+0x183/0x530 ? __virt_addr_valid+0x45f/0x530 ? __phys_addr+0xba/0x170 ? strlen+0x58/0x70 kasan_report+0x143/0x180 ? strlen+0x58/0x70 strlen+0x58/0x70 kstrdup+0x20/0x80 led_tg_check+0x18b/0x3c0 xt_check_target+0x3bb/0xa40 ? __pfx_xt_check_target+0x10/0x10 ? stack_depot_save_flags+0x6e4/0x830 ? nft_target_init+0x174/0xc30 nft_target_init+0x82d/0xc30 ? __pfx_nft_target_init+0x10/0x10 ? nf_tables_newrule+0x1609/0x2980 ? nf_tables_newrule+0x1609/0x2980 ? rcu_is_watching+0x15/0xb0 ? nf_tables_newrule+0x1609/0x2980 ? nf_tables_newrule+0x1609/0x2980 ? __kmalloc_noprof+0x21a/0x400 nf_tables_newrule+0x1860/0x2980 ? __pfx_nf_tables_newrule+0x10/0x10 ? __nla_parse+0x40/0x60 nfnetlink_rcv+0x14e5/0x2ab0 ? __pfx_validate_chain+0x10/0x10 ? __pfx_nfnetlink_rcv+0x10/0x10 ? __lock_acquire+0x1384/0x2050 ? netlink_deliver_tap+0x2e/0x1b0 ? __pfx_lock_release+0x10/0x10 ? netlink_deliver_tap+0x2e/0x1b0 netlink_unicast+0x7f8/0x990 ? __pfx_netlink_unicast+0x10/0x10 ? __virt_addr_valid+0x183/0x530 ? __check_object_size+0x48e/0x900 netlink_sendmsg+0x8e4/0xcb0 ? __pfx_netlink_sendmsg+0x10/0x10 ? aa_sock_msg_perm+0x91/0x160 ? __pfx_netlink_sendmsg+0x10/0x10 __sock_sendmsg+0x223/0x270 ____sys_sendmsg+0x52a/0x7e0 ? __pfx_____sys_sendmsg+0x10/0x10 __sys_sendmsg+0x292/0x380 ? __pfx___sys_sendmsg+0x10/0x10 ? lockdep_hardirqs_on_prepare+0x43d/0x780 ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 ? exc_page_fault+0x590/0x8c0 ? do_syscall_64+0xb6/0x230 do_syscall_64+0xf3/0x230 entry_SYSCALL_64_after_hwframe+0x77/0x7f ... </TASK> Since an invalid (without '\0' byte at all) byte sequence may be passed from userspace, add an extra check to ensure that such a sequence is rejected as possible ID and so never passed to 'kstrdup()' and further.
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-01 20:00 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 268cb38e1802db560c73167e643f14a3dcb4b07c , < 147a42bb02de8735cb08476be6d0917987d022c2 (git)
Affected: 268cb38e1802db560c73167e643f14a3dcb4b07c , < ad28612ebae1fcc1104bd432e99e99d87f6bfe09 (git)
Affected: 268cb38e1802db560c73167e643f14a3dcb4b07c , < 36a9d94dac28beef6b8abba46ba8874320d3e800 (git)
Affected: 268cb38e1802db560c73167e643f14a3dcb4b07c , < ab9916321c95f5280b72b4c5055e269f98627efe (git)
Affected: 268cb38e1802db560c73167e643f14a3dcb4b07c , < a9bcc0b70d9baf3ff005874489a0dc9d023b54c3 (git)
Affected: 268cb38e1802db560c73167e643f14a3dcb4b07c , < c40c96d98e536fc1daaa125c2332b988615e30a4 (git)
Affected: 268cb38e1802db560c73167e643f14a3dcb4b07c , < 04317f4eb2aad312ad85c1a17ad81fe75f1f9bc7 (git)
Create a notification for this product.
Linux Linux Affected: 2.6.30
Unaffected: 0 , < 2.6.30 (semver)
Unaffected: 5.4.287 , ≤ 5.4.* (semver)
Unaffected: 5.10.231 , ≤ 5.10.* (semver)
Unaffected: 5.15.174 , ≤ 5.15.* (semver)
Unaffected: 6.1.120 , ≤ 6.1.* (semver)
Unaffected: 6.6.66 , ≤ 6.6.* (semver)
Unaffected: 6.12.5 , ≤ 6.12.* (semver)
Unaffected: 6.13 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-56650",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T20:00:22.683789Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-125",
                "description": "CWE-125 Out-of-bounds Read",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T20:07:11.150Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:51:56.813Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/xt_LED.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "147a42bb02de8735cb08476be6d0917987d022c2",
              "status": "affected",
              "version": "268cb38e1802db560c73167e643f14a3dcb4b07c",
              "versionType": "git"
            },
            {
              "lessThan": "ad28612ebae1fcc1104bd432e99e99d87f6bfe09",
              "status": "affected",
              "version": "268cb38e1802db560c73167e643f14a3dcb4b07c",
              "versionType": "git"
            },
            {
              "lessThan": "36a9d94dac28beef6b8abba46ba8874320d3e800",
              "status": "affected",
              "version": "268cb38e1802db560c73167e643f14a3dcb4b07c",
              "versionType": "git"
            },
            {
              "lessThan": "ab9916321c95f5280b72b4c5055e269f98627efe",
              "status": "affected",
              "version": "268cb38e1802db560c73167e643f14a3dcb4b07c",
              "versionType": "git"
            },
            {
              "lessThan": "a9bcc0b70d9baf3ff005874489a0dc9d023b54c3",
              "status": "affected",
              "version": "268cb38e1802db560c73167e643f14a3dcb4b07c",
              "versionType": "git"
            },
            {
              "lessThan": "c40c96d98e536fc1daaa125c2332b988615e30a4",
              "status": "affected",
              "version": "268cb38e1802db560c73167e643f14a3dcb4b07c",
              "versionType": "git"
            },
            {
              "lessThan": "04317f4eb2aad312ad85c1a17ad81fe75f1f9bc7",
              "status": "affected",
              "version": "268cb38e1802db560c73167e643f14a3dcb4b07c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/xt_LED.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.30"
            },
            {
              "lessThan": "2.6.30",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.287",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.231",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.174",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.120",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.66",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.287",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.231",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.174",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.120",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.66",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.5",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: x_tables: fix LED ID check in led_tg_check()\n\nSyzbot has reported the following BUG detected by KASAN:\n\nBUG: KASAN: slab-out-of-bounds in strlen+0x58/0x70\nRead of size 1 at addr ffff8881022da0c8 by task repro/5879\n...\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x241/0x360\n ? __pfx_dump_stack_lvl+0x10/0x10\n ? __pfx__printk+0x10/0x10\n ? _printk+0xd5/0x120\n ? __virt_addr_valid+0x183/0x530\n ? __virt_addr_valid+0x183/0x530\n print_report+0x169/0x550\n ? __virt_addr_valid+0x183/0x530\n ? __virt_addr_valid+0x183/0x530\n ? __virt_addr_valid+0x45f/0x530\n ? __phys_addr+0xba/0x170\n ? strlen+0x58/0x70\n kasan_report+0x143/0x180\n ? strlen+0x58/0x70\n strlen+0x58/0x70\n kstrdup+0x20/0x80\n led_tg_check+0x18b/0x3c0\n xt_check_target+0x3bb/0xa40\n ? __pfx_xt_check_target+0x10/0x10\n ? stack_depot_save_flags+0x6e4/0x830\n ? nft_target_init+0x174/0xc30\n nft_target_init+0x82d/0xc30\n ? __pfx_nft_target_init+0x10/0x10\n ? nf_tables_newrule+0x1609/0x2980\n ? nf_tables_newrule+0x1609/0x2980\n ? rcu_is_watching+0x15/0xb0\n ? nf_tables_newrule+0x1609/0x2980\n ? nf_tables_newrule+0x1609/0x2980\n ? __kmalloc_noprof+0x21a/0x400\n nf_tables_newrule+0x1860/0x2980\n ? __pfx_nf_tables_newrule+0x10/0x10\n ? __nla_parse+0x40/0x60\n nfnetlink_rcv+0x14e5/0x2ab0\n ? __pfx_validate_chain+0x10/0x10\n ? __pfx_nfnetlink_rcv+0x10/0x10\n ? __lock_acquire+0x1384/0x2050\n ? netlink_deliver_tap+0x2e/0x1b0\n ? __pfx_lock_release+0x10/0x10\n ? netlink_deliver_tap+0x2e/0x1b0\n netlink_unicast+0x7f8/0x990\n ? __pfx_netlink_unicast+0x10/0x10\n ? __virt_addr_valid+0x183/0x530\n ? __check_object_size+0x48e/0x900\n netlink_sendmsg+0x8e4/0xcb0\n ? __pfx_netlink_sendmsg+0x10/0x10\n ? aa_sock_msg_perm+0x91/0x160\n ? __pfx_netlink_sendmsg+0x10/0x10\n __sock_sendmsg+0x223/0x270\n ____sys_sendmsg+0x52a/0x7e0\n ? __pfx_____sys_sendmsg+0x10/0x10\n __sys_sendmsg+0x292/0x380\n ? __pfx___sys_sendmsg+0x10/0x10\n ? lockdep_hardirqs_on_prepare+0x43d/0x780\n ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10\n ? exc_page_fault+0x590/0x8c0\n ? do_syscall_64+0xb6/0x230\n do_syscall_64+0xf3/0x230\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n...\n \u003c/TASK\u003e\n\nSince an invalid (without \u0027\\0\u0027 byte at all) byte sequence may be passed\nfrom userspace, add an extra check to ensure that such a sequence is\nrejected as possible ID and so never passed to \u0027kstrdup()\u0027 and further."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is entered only through local syscalls \u2014 `sendmsg()` on a NETLINK_NETFILTER socket (nf_tables/nft_compat) or `setsockopt(IPT_SO_SET_REPLACE)` on the legacy iptables interface. No remote peer can supply the malformed `xt_led_info` blob.\nAC:L - The attacker fully controls all 40 bytes of the target info blob and simply omits any NUL byte, making `strlen()` read out of bounds deterministically on every attempt; there is no race, no memory-layout precondition, and the required xt_LED module is present in stock distro and embedded kernel configs.\nPR:L - `nf_tables_newrule` requires CAP_NET_ADMIN only in the network namespace\u0027s owning user namespace, which any unprivileged user obtains with `unshare -Urn` \u2014 exactly how the syzbot reproducer reached it.\nUI:N - The attacker performs the entire sequence \u2014 create netns, add an nftables rule with an xt LED target \u2014 with no action by any other user, and reads the leaked bytes back from sysfs itself.\nS:U - The out-of-bounds read stays within the kernel\u0027s own heap and the disclosed data is exposed through kernel-managed interfaces; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is an unbounded slab out-of-bounds read whose contents are not merely touched but `kstrdup()`\u0027d into a globally registered LED trigger name, then printed into the world-readable (0644) `/sys/class/leds/*/trigger` file, plus an `-EEXIST` collision oracle from `led_trigger_register()` \u2014 giving an unprivileged user a practical adjacent-kernel-heap disclosure primitive that can leak pointers and defeat KASLR/heap-layout hardening.\nI:N - `kstrdup()` allocates exactly `strlen()+1` bytes and the sysfs printer clamps with `vscnprintf`, so no memory is written out of bounds and no kernel data structure is corrupted by the flaw.\nA:H - The `strlen()` walk continues until it happens to find a zero byte and can fault on a KFENCE guard page \u2014 enabled by default in production distro and Android kernels \u2014 or run past mapped memory, oopsing the kernel; on KASAN builds it panics outright, and the attacker can repeat the attempt arbitrarily."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:45:47.823Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/147a42bb02de8735cb08476be6d0917987d022c2"
        },
        {
          "url": "https://git.kernel.org/stable/c/ad28612ebae1fcc1104bd432e99e99d87f6bfe09"
        },
        {
          "url": "https://git.kernel.org/stable/c/36a9d94dac28beef6b8abba46ba8874320d3e800"
        },
        {
          "url": "https://git.kernel.org/stable/c/ab9916321c95f5280b72b4c5055e269f98627efe"
        },
        {
          "url": "https://git.kernel.org/stable/c/a9bcc0b70d9baf3ff005874489a0dc9d023b54c3"
        },
        {
          "url": "https://git.kernel.org/stable/c/c40c96d98e536fc1daaa125c2332b988615e30a4"
        },
        {
          "url": "https://git.kernel.org/stable/c/04317f4eb2aad312ad85c1a17ad81fe75f1f9bc7"
        }
      ],
      "title": "netfilter: x_tables: fix LED ID check in led_tg_check()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-56650",
    "datePublished": "2024-12-27T15:02:50.098Z",
    "dateReserved": "2024-12-27T15:00:39.840Z",
    "dateUpdated": "2026-08-05T11:45:47.823Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-56650",
      "date": "2026-08-16",
      "epss": "0.00262",
      "percentile": "0.18189"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"2.6.30\", \"versionEndExcluding\": \"5.4.287\", \"matchCriteriaId\": \"2D46A016-4FC6-416B-92D5-0A3833B3F57C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.5\", \"versionEndExcluding\": \"5.10.231\", \"matchCriteriaId\": \"B5C644CC-2BD7-4E32-BC54-8DCC7ABE9935\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.11\", \"versionEndExcluding\": \"5.15.174\", \"matchCriteriaId\": \"419FD073-1517-4FD5-8158-F94BC68A1E89\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.16\", \"versionEndExcluding\": \"6.1.120\", \"matchCriteriaId\": \"09AC6122-E2A4-40FE-9D33-268A1B2EC265\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.2\", \"versionEndExcluding\": \"6.6.66\", \"matchCriteriaId\": \"29A976AD-B9AB-4A95-9F08-7669F8847EB9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.12.5\", \"matchCriteriaId\": \"9501D045-7A94-42CA-8B03-821BE94A65B7\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"62567B3C-6CEE-46D0-BC2E-B3717FBF7D13\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnetfilter: x_tables: fix LED ID check in led_tg_check()\\n\\nSyzbot has reported the following BUG detected by KASAN:\\n\\nBUG: KASAN: slab-out-of-bounds in strlen+0x58/0x70\\nRead of size 1 at addr ffff8881022da0c8 by task repro/5879\\n...\\nCall Trace:\\n \u003cTASK\u003e\\n dump_stack_lvl+0x241/0x360\\n ? __pfx_dump_stack_lvl+0x10/0x10\\n ? __pfx__printk+0x10/0x10\\n ? _printk+0xd5/0x120\\n ? __virt_addr_valid+0x183/0x530\\n ? __virt_addr_valid+0x183/0x530\\n print_report+0x169/0x550\\n ? __virt_addr_valid+0x183/0x530\\n ? __virt_addr_valid+0x183/0x530\\n ? __virt_addr_valid+0x45f/0x530\\n ? __phys_addr+0xba/0x170\\n ? strlen+0x58/0x70\\n kasan_report+0x143/0x180\\n ? strlen+0x58/0x70\\n strlen+0x58/0x70\\n kstrdup+0x20/0x80\\n led_tg_check+0x18b/0x3c0\\n xt_check_target+0x3bb/0xa40\\n ? __pfx_xt_check_target+0x10/0x10\\n ? stack_depot_save_flags+0x6e4/0x830\\n ? nft_target_init+0x174/0xc30\\n nft_target_init+0x82d/0xc30\\n ? __pfx_nft_target_init+0x10/0x10\\n ? nf_tables_newrule+0x1609/0x2980\\n ? nf_tables_newrule+0x1609/0x2980\\n ? rcu_is_watching+0x15/0xb0\\n ? nf_tables_newrule+0x1609/0x2980\\n ? nf_tables_newrule+0x1609/0x2980\\n ? __kmalloc_noprof+0x21a/0x400\\n nf_tables_newrule+0x1860/0x2980\\n ? __pfx_nf_tables_newrule+0x10/0x10\\n ? __nla_parse+0x40/0x60\\n nfnetlink_rcv+0x14e5/0x2ab0\\n ? __pfx_validate_chain+0x10/0x10\\n ? __pfx_nfnetlink_rcv+0x10/0x10\\n ? __lock_acquire+0x1384/0x2050\\n ? netlink_deliver_tap+0x2e/0x1b0\\n ? __pfx_lock_release+0x10/0x10\\n ? netlink_deliver_tap+0x2e/0x1b0\\n netlink_unicast+0x7f8/0x990\\n ? __pfx_netlink_unicast+0x10/0x10\\n ? __virt_addr_valid+0x183/0x530\\n ? __check_object_size+0x48e/0x900\\n netlink_sendmsg+0x8e4/0xcb0\\n ? __pfx_netlink_sendmsg+0x10/0x10\\n ? aa_sock_msg_perm+0x91/0x160\\n ? __pfx_netlink_sendmsg+0x10/0x10\\n __sock_sendmsg+0x223/0x270\\n ____sys_sendmsg+0x52a/0x7e0\\n ? __pfx_____sys_sendmsg+0x10/0x10\\n __sys_sendmsg+0x292/0x380\\n ? __pfx___sys_sendmsg+0x10/0x10\\n ? lockdep_hardirqs_on_prepare+0x43d/0x780\\n ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10\\n ? exc_page_fault+0x590/0x8c0\\n ? do_syscall_64+0xb6/0x230\\n do_syscall_64+0xf3/0x230\\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\\n...\\n \u003c/TASK\u003e\\n\\nSince an invalid (without \u0027\\\\0\u0027 byte at all) byte sequence may be passed\\nfrom userspace, add an extra check to ensure that such a sequence is\\nrejected as possible ID and so never passed to \u0027kstrdup()\u0027 and further.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: netfilter: x_tables: correcci\\u00f3n de la comprobaci\\u00f3n del ID del LED en led_tg_check() Syzbot ha informado del siguiente ERROR detectado por KASAN: ERROR: KASAN: slab-out-of-bounds en strlen+0x58/0x70 Lectura de tama\\u00f1o 1 en la direcci\\u00f3n ffff8881022da0c8 por la tarea repro/5879 ... Seguimiento de llamadas:  dump_stack_lvl+0x241/0x360 ? __pfx_dump_stack_lvl+0x10/0x10 ? __pfx__printk+0x10/0x10 ? _printk+0xd5/0x120 ? __virt_addr_valid+0x183/0x530 ? __virt_addr_valid+0x183/0x530 imprimir_informe+0x169/0x550 ? __virt_addr_valid+0x183/0x530 ? __virt_addr_valid+0x183/0x530 ? __virt_addr_valid+0x45f/0x530 ? __phys_addr+0xba/0x170 ? strlen+0x58/0x70 kasan_informe+0x143/0x180 ? strlen+0x58/0x70 strlen+0x58/0x70 kstrdup+0x20/0x80 led_tg_check+0x18b/0x3c0 xt_check_target+0x3bb/0xa40 ? __pfx_xt_check_target+0x10/0x10 ? stack_depot_save_flags+0x6e4/0x830 ? nft_target_init+0x174/0xc30 nft_target_init+0x82d/0xc30 ? __pfx_nft_target_init+0x10/0x10 ? nf_tables_newrule+0x1609/0x2980 ? nf_tables_newrule+0x1609/0x2980 ? rcu_is_watching+0x15/0xb0 ? nf_tables_newrule+0x1609/0x2980 ? nf_tables_newrule+0x1609/0x2980 ? __kmalloc_noprof+0x21a/0x400 nf_tables_newrule+0x1860/0x2980 ? __pfx_nf_tables_newrule+0x10/0x10 ? __nla_parse+0x40/0x60 nfnetlink_rcv+0x14e5/0x2ab0 ? __pfx_validate_chain+0x10/0x10 ? __pfx_nfnetlink_rcv+0x10/0x10 ? __lock_acquire+0x1384/0x2050 ? netlink_deliver_tap+0x2e/0x1b0 ? __pfx_lock_release+0x10/0x10 ? aa_sock_msg_perm+0x91/0x160 ? __pfx_netlink_sendmsg+0x10/0x10 __sock_sendmsg+0x223/0x270 ____sys_sendmsg+0x52a/0x7e0 ? exc_page_fault+0x590/0x8c0 ? Dado que una secuencia de bytes no v\\u00e1lida (sin el byte \u0027\\\\0\u0027 en absoluto) puede pasarse desde el espacio de usuario, agregue una verificaci\\u00f3n adicional para garantizar que dicha secuencia se rechace como posible ID y, por lo tanto, nunca se pase a \u0027kstrdup()\u0027 ni a nada m\\u00e1s.\"}]",
      "id": "CVE-2024-56650",
      "lastModified": "2025-01-06T19:51:27.030",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\", \"baseScore\": 7.1, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.2}]}",
      "published": "2024-12-27T15:15:24.783",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/04317f4eb2aad312ad85c1a17ad81fe75f1f9bc7\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/147a42bb02de8735cb08476be6d0917987d022c2\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/36a9d94dac28beef6b8abba46ba8874320d3e800\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/a9bcc0b70d9baf3ff005874489a0dc9d023b54c3\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/ab9916321c95f5280b72b4c5055e269f98627efe\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/ad28612ebae1fcc1104bd432e99e99d87f6bfe09\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/c40c96d98e536fc1daaa125c2332b988615e30a4\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-125\"}]}]"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T15:04:20.000Z",
      "cve": "CVE-2024-56650",
      "id": "msrc_CVE-2024-56650",
      "initial_release_date": "2024-12-02T00:00:00.000Z",
      "product_status:fixed": "4",
      "product_status:known_affected": "4",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "netfilter: x_tables: fix LED ID check in led_tg_check()",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-56650.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-56650\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-12-27T15:15:24.783\",\"lastModified\":\"2026-06-17T08:12:38.820\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnetfilter: x_tables: fix LED ID check in led_tg_check()\\n\\nSyzbot has reported the following BUG detected by KASAN:\\n\\nBUG: KASAN: slab-out-of-bounds in strlen+0x58/0x70\\nRead of size 1 at addr ffff8881022da0c8 by task repro/5879\\n...\\nCall Trace:\\n \u003cTASK\u003e\\n dump_stack_lvl+0x241/0x360\\n ? __pfx_dump_stack_lvl+0x10/0x10\\n ? __pfx__printk+0x10/0x10\\n ? _printk+0xd5/0x120\\n ? __virt_addr_valid+0x183/0x530\\n ? __virt_addr_valid+0x183/0x530\\n print_report+0x169/0x550\\n ? __virt_addr_valid+0x183/0x530\\n ? __virt_addr_valid+0x183/0x530\\n ? __virt_addr_valid+0x45f/0x530\\n ? __phys_addr+0xba/0x170\\n ? strlen+0x58/0x70\\n kasan_report+0x143/0x180\\n ? strlen+0x58/0x70\\n strlen+0x58/0x70\\n kstrdup+0x20/0x80\\n led_tg_check+0x18b/0x3c0\\n xt_check_target+0x3bb/0xa40\\n ? __pfx_xt_check_target+0x10/0x10\\n ? stack_depot_save_flags+0x6e4/0x830\\n ? nft_target_init+0x174/0xc30\\n nft_target_init+0x82d/0xc30\\n ? __pfx_nft_target_init+0x10/0x10\\n ? nf_tables_newrule+0x1609/0x2980\\n ? nf_tables_newrule+0x1609/0x2980\\n ? rcu_is_watching+0x15/0xb0\\n ? nf_tables_newrule+0x1609/0x2980\\n ? nf_tables_newrule+0x1609/0x2980\\n ? __kmalloc_noprof+0x21a/0x400\\n nf_tables_newrule+0x1860/0x2980\\n ? __pfx_nf_tables_newrule+0x10/0x10\\n ? __nla_parse+0x40/0x60\\n nfnetlink_rcv+0x14e5/0x2ab0\\n ? __pfx_validate_chain+0x10/0x10\\n ? __pfx_nfnetlink_rcv+0x10/0x10\\n ? __lock_acquire+0x1384/0x2050\\n ? netlink_deliver_tap+0x2e/0x1b0\\n ? __pfx_lock_release+0x10/0x10\\n ? netlink_deliver_tap+0x2e/0x1b0\\n netlink_unicast+0x7f8/0x990\\n ? __pfx_netlink_unicast+0x10/0x10\\n ? __virt_addr_valid+0x183/0x530\\n ? __check_object_size+0x48e/0x900\\n netlink_sendmsg+0x8e4/0xcb0\\n ? __pfx_netlink_sendmsg+0x10/0x10\\n ? aa_sock_msg_perm+0x91/0x160\\n ? __pfx_netlink_sendmsg+0x10/0x10\\n __sock_sendmsg+0x223/0x270\\n ____sys_sendmsg+0x52a/0x7e0\\n ? __pfx_____sys_sendmsg+0x10/0x10\\n __sys_sendmsg+0x292/0x380\\n ? __pfx___sys_sendmsg+0x10/0x10\\n ? lockdep_hardirqs_on_prepare+0x43d/0x780\\n ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10\\n ? exc_page_fault+0x590/0x8c0\\n ? do_syscall_64+0xb6/0x230\\n do_syscall_64+0xf3/0x230\\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\\n...\\n \u003c/TASK\u003e\\n\\nSince an invalid (without \u0027\\\\0\u0027 byte at all) byte sequence may be passed\\nfrom userspace, add an extra check to ensure that such a sequence is\\nrejected as possible ID and so never passed to \u0027kstrdup()\u0027 and further.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: netfilter: x_tables: correcci\u00f3n de la comprobaci\u00f3n del ID del LED en led_tg_check() Syzbot ha informado del siguiente ERROR detectado por KASAN: ERROR: KASAN: slab-out-of-bounds en strlen+0x58/0x70 Lectura de tama\u00f1o 1 en la direcci\u00f3n ffff8881022da0c8 por la tarea repro/5879 ... Seguimiento de llamadas:  dump_stack_lvl+0x241/0x360 ? __pfx_dump_stack_lvl+0x10/0x10 ? __pfx__printk+0x10/0x10 ? _printk+0xd5/0x120 ? __virt_addr_valid+0x183/0x530 ? __virt_addr_valid+0x183/0x530 imprimir_informe+0x169/0x550 ? __virt_addr_valid+0x183/0x530 ? __virt_addr_valid+0x183/0x530 ? __virt_addr_valid+0x45f/0x530 ? __phys_addr+0xba/0x170 ? strlen+0x58/0x70 kasan_informe+0x143/0x180 ? strlen+0x58/0x70 strlen+0x58/0x70 kstrdup+0x20/0x80 led_tg_check+0x18b/0x3c0 xt_check_target+0x3bb/0xa40 ? __pfx_xt_check_target+0x10/0x10 ? stack_depot_save_flags+0x6e4/0x830 ? nft_target_init+0x174/0xc30 nft_target_init+0x82d/0xc30 ? __pfx_nft_target_init+0x10/0x10 ? nf_tables_newrule+0x1609/0x2980 ? nf_tables_newrule+0x1609/0x2980 ? rcu_is_watching+0x15/0xb0 ? nf_tables_newrule+0x1609/0x2980 ? nf_tables_newrule+0x1609/0x2980 ? __kmalloc_noprof+0x21a/0x400 nf_tables_newrule+0x1860/0x2980 ? __pfx_nf_tables_newrule+0x10/0x10 ? __nla_parse+0x40/0x60 nfnetlink_rcv+0x14e5/0x2ab0 ? __pfx_validate_chain+0x10/0x10 ? __pfx_nfnetlink_rcv+0x10/0x10 ? __lock_acquire+0x1384/0x2050 ? netlink_deliver_tap+0x2e/0x1b0 ? __pfx_lock_release+0x10/0x10 ? aa_sock_msg_perm+0x91/0x160 ? __pfx_netlink_sendmsg+0x10/0x10 __sock_sendmsg+0x223/0x270 ____sys_sendmsg+0x52a/0x7e0 ? exc_page_fault+0x590/0x8c0 ? Dado que una secuencia de bytes no v\u00e1lida (sin el byte \u0027\\\\0\u0027 en absoluto) puede pasarse desde el espacio de usuario, agregue una verificaci\u00f3n adicional para garantizar que dicha secuencia se rechace como posible ID y, por lo tanto, nunca se pase a \u0027kstrdup()\u0027 ni a nada m\u00e1s.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/netfilter/xt_LED.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"268cb38e1802db560c73167e643f14a3dcb4b07c\",\"lessThan\":\"147a42bb02de8735cb08476be6d0917987d022c2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"268cb38e1802db560c73167e643f14a3dcb4b07c\",\"lessThan\":\"ad28612ebae1fcc1104bd432e99e99d87f6bfe09\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"268cb38e1802db560c73167e643f14a3dcb4b07c\",\"lessThan\":\"36a9d94dac28beef6b8abba46ba8874320d3e800\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"268cb38e1802db560c73167e643f14a3dcb4b07c\",\"lessThan\":\"ab9916321c95f5280b72b4c5055e269f98627efe\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"268cb38e1802db560c73167e643f14a3dcb4b07c\",\"lessThan\":\"a9bcc0b70d9baf3ff005874489a0dc9d023b54c3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"268cb38e1802db560c73167e643f14a3dcb4b07c\",\"lessThan\":\"c40c96d98e536fc1daaa125c2332b988615e30a4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"268cb38e1802db560c73167e643f14a3dcb4b07c\",\"lessThan\":\"04317f4eb2aad312ad85c1a17ad81fe75f1f9bc7\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/netfilter/xt_LED.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.30\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.30\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.287\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.231\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.174\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.120\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.66\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.5\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-10-01T20:00:22.683789Z\",\"id\":\"CVE-2024-56650\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.6.30\",\"versionEndExcluding\":\"5.4.287\",\"matchCriteriaId\":\"2D46A016-4FC6-416B-92D5-0A3833B3F57C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.231\",\"matchCriteriaId\":\"B5C644CC-2BD7-4E32-BC54-8DCC7ABE9935\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.174\",\"matchCriteriaId\":\"419FD073-1517-4FD5-8158-F94BC68A1E89\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.120\",\"matchCriteriaId\":\"09AC6122-E2A4-40FE-9D33-268A1B2EC265\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.66\",\"matchCriteriaId\":\"29A976AD-B9AB-4A95-9F08-7669F8847EB9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.5\",\"matchCriteriaId\":\"9501D045-7A94-42CA-8B03-821BE94A65B7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"62567B3C-6CEE-46D0-BC2E-B3717FBF7D13\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/04317f4eb2aad312ad85c1a17ad81fe75f1f9bc7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/147a42bb02de8735cb08476be6d0917987d022c2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/36a9d94dac28beef6b8abba46ba8874320d3e800\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a9bcc0b70d9baf3ff005874489a0dc9d023b54c3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ab9916321c95f5280b72b4c5055e269f98627efe\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ad28612ebae1fcc1104bd432e99e99d87f6bfe09\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c40c96d98e536fc1daaa125c2332b988615e30a4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2025-11-21T13:51:04+00:00",
      "cve": "CVE-2024-56650",
      "id": "CVE-2024-56650",
      "initial_release_date": "2024-12-27T00:00:00+00:00",
      "product_status:known_affected": "42",
      "product_status:known_not_affected": "156",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: netfilter: x_tables: fix LED ID check in led_tg_check()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-56650.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-13T16:41:10Z",
      "cve": "CVE-2024-56650",
      "id": "CVE-2024-56650",
      "initial_release_date": "2025-01-11T00:21:43Z",
      "product_status:known_affected": "524",
      "product_status:known_not_affected": "36",
      "product_status:recommended": "801",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-56650",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-56650.json",
      "version": "90"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T20:51:56.813Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.1, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-56650\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-01T20:00:22.683789Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-125\", \"description\": \"CWE-125 Out-of-bounds Read\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-01T15:44:39.351Z\"}}], \"cna\": {\"title\": \"netfilter: x_tables: fix LED ID check in led_tg_check()\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.1, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable path is entered only through local syscalls \\u2014 `sendmsg()` on a NETLINK_NETFILTER socket (nf_tables/nft_compat) or `setsockopt(IPT_SO_SET_REPLACE)` on the legacy iptables interface. No remote peer can supply the malformed `xt_led_info` blob.\\nAC:L - The attacker fully controls all 40 bytes of the target info blob and simply omits any NUL byte, making `strlen()` read out of bounds deterministically on every attempt; there is no race, no memory-layout precondition, and the required xt_LED module is present in stock distro and embedded kernel configs.\\nPR:L - `nf_tables_newrule` requires CAP_NET_ADMIN only in the network namespace\u0027s owning user namespace, which any unprivileged user obtains with `unshare -Urn` \\u2014 exactly how the syzbot reproducer reached it.\\nUI:N - The attacker performs the entire sequence \\u2014 create netns, add an nftables rule with an xt LED target \\u2014 with no action by any other user, and reads the leaked bytes back from sysfs itself.\\nS:U - The out-of-bounds read stays within the kernel\u0027s own heap and the disclosed data is exposed through kernel-managed interfaces; no VM, IOMMU, or sandbox boundary is crossed.\\nC:H - This is an unbounded slab out-of-bounds read whose contents are not merely touched but `kstrdup()`\u0027d into a globally registered LED trigger name, then printed into the world-readable (0644) `/sys/class/leds/*/trigger` file, plus an `-EEXIST` collision oracle from `led_trigger_register()` \\u2014 giving an unprivileged user a practical adjacent-kernel-heap disclosure primitive that can leak pointers and defeat KASLR/heap-layout hardening.\\nI:N - `kstrdup()` allocates exactly `strlen()+1` bytes and the sysfs printer clamps with `vscnprintf`, so no memory is written out of bounds and no kernel data structure is corrupted by the flaw.\\nA:H - The `strlen()` walk continues until it happens to find a zero byte and can fault on a KFENCE guard page \\u2014 enabled by default in production distro and Android kernels \\u2014 or run past mapped memory, oopsing the kernel; on KASAN builds it panics outright, and the attacker can repeat the attempt arbitrarily.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"268cb38e1802db560c73167e643f14a3dcb4b07c\", \"lessThan\": \"147a42bb02de8735cb08476be6d0917987d022c2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"268cb38e1802db560c73167e643f14a3dcb4b07c\", \"lessThan\": \"ad28612ebae1fcc1104bd432e99e99d87f6bfe09\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"268cb38e1802db560c73167e643f14a3dcb4b07c\", \"lessThan\": \"36a9d94dac28beef6b8abba46ba8874320d3e800\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"268cb38e1802db560c73167e643f14a3dcb4b07c\", \"lessThan\": \"ab9916321c95f5280b72b4c5055e269f98627efe\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"268cb38e1802db560c73167e643f14a3dcb4b07c\", \"lessThan\": \"a9bcc0b70d9baf3ff005874489a0dc9d023b54c3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"268cb38e1802db560c73167e643f14a3dcb4b07c\", \"lessThan\": \"c40c96d98e536fc1daaa125c2332b988615e30a4\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"268cb38e1802db560c73167e643f14a3dcb4b07c\", \"lessThan\": \"04317f4eb2aad312ad85c1a17ad81fe75f1f9bc7\", \"versionType\": \"git\"}], \"programFiles\": [\"net/netfilter/xt_LED.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.6.30\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"2.6.30\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.4.287\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.231\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.174\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.120\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.66\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.5\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.13\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/netfilter/xt_LED.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/147a42bb02de8735cb08476be6d0917987d022c2\"}, {\"url\": \"https://git.kernel.org/stable/c/ad28612ebae1fcc1104bd432e99e99d87f6bfe09\"}, {\"url\": \"https://git.kernel.org/stable/c/36a9d94dac28beef6b8abba46ba8874320d3e800\"}, {\"url\": \"https://git.kernel.org/stable/c/ab9916321c95f5280b72b4c5055e269f98627efe\"}, {\"url\": \"https://git.kernel.org/stable/c/a9bcc0b70d9baf3ff005874489a0dc9d023b54c3\"}, {\"url\": \"https://git.kernel.org/stable/c/c40c96d98e536fc1daaa125c2332b988615e30a4\"}, {\"url\": \"https://git.kernel.org/stable/c/04317f4eb2aad312ad85c1a17ad81fe75f1f9bc7\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnetfilter: x_tables: fix LED ID check in led_tg_check()\\n\\nSyzbot has reported the following BUG detected by KASAN:\\n\\nBUG: KASAN: slab-out-of-bounds in strlen+0x58/0x70\\nRead of size 1 at addr ffff8881022da0c8 by task repro/5879\\n...\\nCall Trace:\\n \u003cTASK\u003e\\n dump_stack_lvl+0x241/0x360\\n ? __pfx_dump_stack_lvl+0x10/0x10\\n ? __pfx__printk+0x10/0x10\\n ? _printk+0xd5/0x120\\n ? __virt_addr_valid+0x183/0x530\\n ? __virt_addr_valid+0x183/0x530\\n print_report+0x169/0x550\\n ? __virt_addr_valid+0x183/0x530\\n ? __virt_addr_valid+0x183/0x530\\n ? __virt_addr_valid+0x45f/0x530\\n ? __phys_addr+0xba/0x170\\n ? strlen+0x58/0x70\\n kasan_report+0x143/0x180\\n ? strlen+0x58/0x70\\n strlen+0x58/0x70\\n kstrdup+0x20/0x80\\n led_tg_check+0x18b/0x3c0\\n xt_check_target+0x3bb/0xa40\\n ? __pfx_xt_check_target+0x10/0x10\\n ? stack_depot_save_flags+0x6e4/0x830\\n ? nft_target_init+0x174/0xc30\\n nft_target_init+0x82d/0xc30\\n ? __pfx_nft_target_init+0x10/0x10\\n ? nf_tables_newrule+0x1609/0x2980\\n ? nf_tables_newrule+0x1609/0x2980\\n ? rcu_is_watching+0x15/0xb0\\n ? nf_tables_newrule+0x1609/0x2980\\n ? nf_tables_newrule+0x1609/0x2980\\n ? __kmalloc_noprof+0x21a/0x400\\n nf_tables_newrule+0x1860/0x2980\\n ? __pfx_nf_tables_newrule+0x10/0x10\\n ? __nla_parse+0x40/0x60\\n nfnetlink_rcv+0x14e5/0x2ab0\\n ? __pfx_validate_chain+0x10/0x10\\n ? __pfx_nfnetlink_rcv+0x10/0x10\\n ? __lock_acquire+0x1384/0x2050\\n ? netlink_deliver_tap+0x2e/0x1b0\\n ? __pfx_lock_release+0x10/0x10\\n ? netlink_deliver_tap+0x2e/0x1b0\\n netlink_unicast+0x7f8/0x990\\n ? __pfx_netlink_unicast+0x10/0x10\\n ? __virt_addr_valid+0x183/0x530\\n ? __check_object_size+0x48e/0x900\\n netlink_sendmsg+0x8e4/0xcb0\\n ? __pfx_netlink_sendmsg+0x10/0x10\\n ? aa_sock_msg_perm+0x91/0x160\\n ? __pfx_netlink_sendmsg+0x10/0x10\\n __sock_sendmsg+0x223/0x270\\n ____sys_sendmsg+0x52a/0x7e0\\n ? __pfx_____sys_sendmsg+0x10/0x10\\n __sys_sendmsg+0x292/0x380\\n ? __pfx___sys_sendmsg+0x10/0x10\\n ? lockdep_hardirqs_on_prepare+0x43d/0x780\\n ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10\\n ? exc_page_fault+0x590/0x8c0\\n ? do_syscall_64+0xb6/0x230\\n do_syscall_64+0xf3/0x230\\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\\n...\\n \u003c/TASK\u003e\\n\\nSince an invalid (without \u0027\\\\0\u0027 byte at all) byte sequence may be passed\\nfrom userspace, add an extra check to ensure that such a sequence is\\nrejected as possible ID and so never passed to \u0027kstrdup()\u0027 and further.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.287\", \"versionStartIncluding\": \"2.6.30\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.231\", \"versionStartIncluding\": \"2.6.30\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.174\", \"versionStartIncluding\": \"2.6.30\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.120\", \"versionStartIncluding\": \"2.6.30\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.66\", \"versionStartIncluding\": \"2.6.30\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.5\", \"versionStartIncluding\": \"2.6.30\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.13\", \"versionStartIncluding\": \"2.6.30\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:45:47.823Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-56650\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:45:47.823Z\", \"dateReserved\": \"2024-12-27T15:00:39.840Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-12-27T15:02:50.098Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.