CVE-2024-50188

CVE-2024-50188

High · published November 8, 2024

CVSS v3.1
7.8
EPSS
0%
Percentile
12.5
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

net: phy: dp83869: fix memory corruption when enabling fiber

When configuring the fiber port, the DP83869 PHY driver incorrectly

calls linkmode_set_bit() with a bit mask (1 << 10) rather than a bit

number (10). This corrupts some other memory location -- in case of

arm64 the priv pointer in the same structure.

Since the advertising flags are updated from supported at the end of the

function the incorrect line isn't needed at all and can be removed.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00225 · 12.5th percentile
Published
2024-11-08T11:15Z
Affected products (7)
ProductVersionsFixed in
linux/linux_kernel≥ 5.10, < 5.10.2275.10.227
linux/linux_kernel≥ 5.11, < 5.15.1685.15.168
linux/linux_kernel≥ 5.16, < 6.1.1136.1.113
linux/linux_kernel≥ 6.2, < 6.6.576.6.57
linux/linux_kernel≥ 6.7, < 6.11.46.11.4
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (10)
EPSS history
Timeline
  • 08 NOV 05:38Z
    net: phy: dp83869: fix memory corruption when enabling fiber
    cvelistv5