CVE-2024-50002: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-50002 is a vulnerability in the Linux kernel's static call mechanism discovered in 2024. The issue affects the staticcalldel_module() function when handling module initialization failures. The vulnerability impacts Linux kernel versions from 5.10 up to (excluding) 6.11.3 (NVD).

The vulnerability occurs in the static call mechanism when a module initialization fails. The staticcalldelmodule() function incorrectly assumes that key::mods points to a valid struct staticcallmod without proper validation. The issue stems from key::mods being part of a union structure where bit 0 differentiates between mods (bit clear) and sites (bit set) pointers. When memory allocation fails during _staticcallinit(), the function may attempt to dereference an invalid pointer, leading to a General Protection (#GP) fault (Kernel Patch). The vulnerability has been assigned a CVSS v3.1 base score of 5.5 MEDIUM (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) (NVD).

The vulnerability can lead to a system crash (denial of service) when a module initialization fails and the staticcalldel_module() function is invoked to clean up. This occurs due to improper handling of memory allocation failures, resulting in a General Protection fault (Kernel Patch).

The issue has been fixed in the Linux kernel through a patch that adds proper validation of the pointer type before dereferencing. The fix checks whether the key has a sites or mods pointer using staticcallkeyhasmods() before proceeding with the operation (Kernel Patch). Users should update their Linux kernel to versions that include this fix.