CVE-2024-50249

5.5 · MEDIUM

Published Nov 9, 2024 linux EPSS 0.22% (12th pctl) CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Overview

CVE-2024-50249 is a medium-severity vulnerability affecting linux linux_kernel. It was published on November 9, 2024 and has a CVSS 3.1 base score of 5.5 (MEDIUM).

This vulnerability has a CVSS 3.1 base score of 5.5, rated MEDIUM. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

ACPI: CPPC: Make rmw_lock a raw_spin_lock

The following BUG was triggered:

=============================

[ BUG: Invalid wait context ]

6.12.0-rc2-XXX #406 Not tainted

-----------------------------

kworker/1:1/62 is trying to lock:

ffffff8801593030 (&cpc_ptr->rmw_lock){+.+.}-{3:3}, at: cpc_write+0xcc/0x370

other info that might help us debug this:

context-{5:5}

2 locks held by kworker/1:1/62:

#0: ffffff897ef5ec98 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2c/0x50

#1: ffffff880154e238 (&sg_policy->update_lock){....}-{2:2}, at: sugov_update_shared+0x3c/0x280

stack backtrace:

CPU: 1 UID: 0 PID: 62 Comm: kworker/1:1 Not tainted 6.12.0-rc2-g9654bd3e8806 #406

Workqueue: 0x0 (events)

Call trace:

dump_backtrace+0xa4/0x130

show_stack+0x20/0x38

dump_stack_lvl+0x90/0xd0

dump_stack+0x18/0x28

__lock_acquire+0x480/0x1ad8

lock_acquire+0x114/0x310

_raw_spin_lock+0x50/0x70

cpc_write+0xcc/0x370

cpp

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

Vendor	Product	Versions	Status
linux	linux_kernel	>= 5.15.168, < 5.15.171	Affected

References

Ref git.kernel.org/stable/c/0eb2b767c42fac61ab23c4063eb456baa4c2c262 Ref git.kernel.org/stable/c/1c10941e34c5fdc0357e46a25bd130d9cf40b925 Ref git.kernel.org/stable/c/23039b4aaf1e82e0feea1060834d4ec34262e453 Ref git.kernel.org/stable/c/43b1df48d1e7000a214acd1a81b8012ca8a929c8 Ref git.kernel.org/stable/c/c46d6b02588000c27b7b869388c2c0278bd0d173 Ref lists.debian.org/debian-lts-announce/2025/01/msg00001.html

Frequently Asked Questions

What is CVE-2024-50249?

CVE-2024-50249 is a medium-severity vulnerability affecting linux linux_kernel. It was published on November 9, 2024 and has a CVSS 3.1 base score of 5.5 (MEDIUM).

How severe is CVE-2024-50249?

This vulnerability has a CVSS 3.1 base score of 5.5, rated MEDIUM. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

How do I fix or remediate CVE-2024-50249?

How can CyberStrike help with CVE-2024-50249?

CyberStrike's AI-powered security agents can automatically detect CVE-2024-50249 across your infrastructure using autonomous pentesting, DAST scanning, and HackBrowser. The platform continuously monitors for known vulnerabilities and provides actionable remediation guidance prioritized by real-world exploitability.

How CyberStrike Helps

Autonomous Discovery

AI agents map your attack surface to find vulnerabilities like this one.

Continuous Pentesting

Automated penetration testing that runs continuously, not just quarterly.

Code Review

AI-driven PR review catches vulnerable dependencies before they ship.

HackBrowser

Browser-based exploitation validates findings with real proof-of-concept.

Related MEDIUM CVEs from 2024

View all →

6.9

CVE-2023-3726

OCSInventory allow stored email template with special characters that lead to a Stored cross-site Sc

6.9

CVE-2023-51719