CVE-2024-50072— x86/bugs: Use code segment selector for VERW operand
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2024-50072
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
x86/bugs: Use code segment selector for VERW operand
Source: NVD (National Vulnerability Database)
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: x86/bugs: Use code segment selector for VERW operand Robert Gill reported below #GP in 32-bit mode when dosemu software was executing vm86() system call: general protection fault: 0000 [#1] PREEMPT SMP CPU: 4 PID: 4610 Comm: dosemu.bin Not tainted 6.6.21-gentoo-x86 #1 Hardware name: Dell Inc. PowerEdge 1950/0H723K, BIOS 2.7.0 10/30/2010 EIP: restore_all_switch_stack+0xbe/0xcf EAX: 00000000 EBX: 00000000 ECX: 00000000 EDX: 00000000 ESI: 00000000 EDI: 00000000 EBP: 00000000 ESP: ff8affdc DS: 0000 ES: 0000 FS: 0000 GS: 0033 SS: 0068 EFLAGS: 00010046 CR0: 80050033 CR2: 00c2101c CR3: 04b6d000 CR4: 000406d0 Call Trace: show_regs+0x70/0x78 die_addr+0x29/0x70 exc_general_protection+0x13c/0x348 exc_bounds+0x98/0x98 handle_exception+0x14d/0x14d exc_bounds+0x98/0x98 restore_all_switch_stack+0xbe/0xcf exc_bounds+0x98/0x98 restore_all_switch_stack+0xbe/0xcf This only happens in 32-bit mode when VERW based mitigations like MDS/RFDS are enabled. This is because segment registers with an arbitrary user value can result in #GP when executing VERW. Intel SDM vol. 2C documents the following behavior for VERW instruction: #GP(0) - If a memory operand effective address is outside the CS, DS, ES, FS, or GS segment limit. CLEAR_CPU_BUFFERS macro executes VERW instruction before returning to user space. Use %cs selector to reference VERW operand. This ensures VERW will not #GP for an arbitrary user %ds. [ mingo: Fixed the SOB chain. ]
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于在使用VERW指令时未正确使用代码段选择器，导致在执行vm86系统调用时出现一般保护性故障。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2024-50072
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-50072
请登录查看更多情报信息。
Same Patch Batch · Linux · 2024-10-29 · 21 CVEs total
| CVE-2024-50078 | Bluetooth: Call iso_exit() on module unload | |
| CVE-2024-50068 | mm/damon/tests/sysfs-kunit.h: fix memory leak in damon_sysfs_test_add_targets() | |
| CVE-2024-50069 | pinctrl: apple: check devm_kasprintf() returned value | |
| CVE-2024-50070 | pinctrl: stm32: check devm_kasprintf() returned value | |
| CVE-2024-50071 | pinctrl: nuvoton: fix a double free in ma35_pinctrl_dt_node_to_map_func() | |
| CVE-2024-50073 | tty: n_gsm: Fix use-after-free in gsm_cleanup_mux | |
| CVE-2024-50074 | parport: Proper fix for array out-of-bounds access | |
| CVE-2024-50075 | xhci: tegra: fix checked USB2 port number | |
| CVE-2024-50076 | vt: prevent kernel-infoleak in con_font_get() | |
| CVE-2024-50077 | Bluetooth: ISO: Fix multiple init when debugfs is disabled | |
| CVE-2024-50088 | btrfs: fix uninitialized pointer free in add_inode_ref() | |
| CVE-2024-50079 | io_uring/sqpoll: ensure task state is TASK_RUNNING when running task_work | |
| CVE-2024-50080 | ublk: don't allow user copy for unprivileged device | |
| CVE-2024-50081 | blk-mq: setup queue ->tag_set before initializing hctx | |
| CVE-2024-50082 | blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race | |
| CVE-2024-50083 | tcp: fix mptcp DSS corruption due to large pmtu xmit | |
| CVE-2024-50084 | net: microchip: vcap api: Fix memory leaks in vcap_api_encode_rule_test() | |
| CVE-2024-50085 | mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow | |
| CVE-2024-50086 | ksmbd: fix user-after-free from session log off | |
| CVE-2024-50087 | btrfs: fix uninitialized pointer free on read_alloc_one_name() error |
IV. Related Vulnerabilities
Same product: Linux
- CVE-2026-43500
rxrpc: Also unshare DATA/RESPONSE packets when paged frags a - CVE-2026-43475
scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT - CVE-2026-43474
fs: init flags_valid before calling vfs_fileattr_get - CVE-2026-43473
scsi: mpi3mr: Add NULL checks when resetting request and rep - CVE-2026-43472
unshare: fix unshare_fs() handling
Same vendor: Linux
- CVE-2026-43500
rxrpc: Also unshare DATA/RESPONSE packets when paged frags a - CVE-2026-43475
scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT - CVE-2026-43474
fs: init flags_valid before calling vfs_fileattr_get - CVE-2026-43473
scsi: mpi3mr: Add NULL checks when resetting request and rep - CVE-2026-43472
unshare: fix unshare_fs() handling
V. Comments for CVE-2024-50072
No comments yet