CVE-2024-50145: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-50145 affects the Linux kernel's octeon_ep driver, specifically in the __octep_oq_process_rx() function. The vulnerability was discovered by Linux Verification Center (linuxtesting.org) using SVACE and was disclosed on November 7, 2024. The issue affects Linux kernel versions from 5.19 up to versions before 6.1.115, 6.2 to before 6.6.59, and 6.7 to before 6.11.6 (NVD).

The vulnerability is a NULL pointer dereference issue in the Linux kernel's octeon_ep driver. The problem occurs when build_skb() returns NULL during memory allocation failure in the __octep_oq_process_rx() function. The CVSS v3.1 base score is 5.5 (Medium) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, indicating local access required with low complexity and privileges needed (NVD).

If exploited, this vulnerability can lead to a NULL pointer dereference, potentially causing a denial of service condition in the affected system. The impact is primarily on system availability, with no direct effect on confidentiality or integrity (NVD).

The vulnerability requires local access with low attack complexity. An attacker needs low privileges to exploit this issue. No known exploits in the wild have been reported at the time of assessment (NVD).

The vulnerability has been patched in the Linux kernel. The fix includes proper handling of SKB allocation failures in __octep_oq_process_rx() by implementing a helper function to unmmap/flush all fragment buffers used by dropped packets and incrementing an 'alloc_failures' counter to track such errors (Kernel Patch).