CVE-2024-50301: Linux Kernel Buffer Overflow Vulnerability

CVE-2024-50301 Overview

CVE-2024-50301 is an out-of-bounds read vulnerability in the Linux kernel's security/keys subsystem. The flaw resides in the key_task_permission() function called during nested keyring searches. When more than 32 keys with similar hashes are added to a keyring, the associative array can form a shortcut node at the root. The kernel then misinterprets the shortcut pointer as a key pointer, causing an out-of-bounds read reported by Kernel Address Sanitizer (KASAN). A local unprivileged user can trigger the condition by adding a crafted set of keys.

Critical Impact
A local, low-privileged user can trigger kernel memory disclosure and potential system instability through crafted keyring operations.

Affected Products

Linux Kernel (multiple stable branches prior to the patched commits)
Linux Kernel 6.12 release candidates rc1 through rc6
Downstream distributions including Debian LTS and Siemens industrial products (see advisories SSA-265688, SSA-355557, SSA-398330)

Discovery Timeline

2024-11-19 - CVE-2024-50301 published to the National Vulnerability Database (NVD)
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2024-50301

Vulnerability Analysis

The vulnerability is an out-of-bounds read [CWE-125] in security/keys/permission.c at line 54. During search_nested_keyrings() in security/keys/keyring.c, the traversal logic evaluates slot pointers within nodes of an associative array. When the walker encounters a metadata pointer with a non-null back_pointer, it descends into that node. However, when the current node is the root and a slot points to a shortcut, that shortcut is incorrectly treated as a keyring, which then feeds a bogus pointer to key_task_permission(). The subsequent call to uid_eq() and __kuid_val() reads memory beyond the allocated object, producing the KASAN slab-out-of-bounds report.

Root Cause

The classification helper keyring_ptr_is_keyring() relies on the KEYRING_PTR_SUBTYPE bit (0x2UL), which collides with ASSOC_ARRAY_PTR_SUBTYPE_MASK. As a result, a root-level slot pointing to a shortcut node satisfies the keyring test and is dereferenced as a struct key. The fix directs the traversal to jump to descend_to_node when the pointer is a shortcut, regardless of whether the current node is the root.

Attack Vector

Exploitation requires local access and low privileges. An attacker adds more than 32 keys whose hashes share the trailing pattern 0xxxxxxxe6, forcing the associative array to split a child node with a shortcut. Once the root's slot references that shortcut, subsequent keyring searches trigger the out-of-bounds read. The condition was independently reproduced by syzbot and by stress-ng workloads, confirming that no remote entry point exists but that local users can reliably reach the vulnerable path.

Detection Methods for CVE-2024-50301

Indicators of Compromise

KASAN kernel log entries reporting slab-out-of-bounds in key_task_permission or __kuid_val from include/linux/uidgid.h.
Unexpected kernel oops or warning traces originating from search_nested_keyrings+0x... in security/keys/keyring.c.
Unprivileged processes issuing large volumes of add_key(2) or keyctl(2) syscalls producing keys with clustered hash values.

Detection Strategies

Enable KASAN on test and staging kernels to surface the exact fault path before production exposure.
Audit auditd records for type=SYSCALL events referencing add_key, keyctl, and request_key from non-administrative users.
Correlate kernel ring-buffer messages (dmesg) with process telemetry to identify workloads generating high keyring churn.

Monitoring Recommendations

Ingest /var/log/kern.log and journalctl -k output into a centralized log platform and alert on KASAN, BUG:, and key_task_permission strings.
Track per-user counts of keyring-related syscalls with eBPF or Linux Audit to baseline normal behavior.
Monitor Linux distribution vendor advisories for kernel package updates matching the affected version ranges.

How to Mitigate CVE-2024-50301

Immediate Actions Required

Apply the upstream stable kernel patches referenced by commits 199c20fb, 1e433258, 3e79ad15, 4a74da04, 4efb69a0, bbad2d5b, c3ce634a, and e0a317ad.
Update Debian systems using the Debian LTS Announcement January 2025 and Debian LTS Announcement March 2025.
Industrial operators should review the Siemens advisories SSA-265688, SSA-355557, and SSA-398330 for product-specific firmware updates.

Patch Information

The upstream fix modifies search_nested_keyrings() so that when a slot pointer is a shortcut, control jumps unconditionally to descend_to_node, bypassing the misclassification as a keyring. Backports are available across all supported stable branches; consult the Kernel Commit Update 199c20f and companion stable-tree commits for branch-specific patches.

Workarounds

Restrict access to keyring syscalls for untrusted local users using seccomp filters that deny add_key, keyctl, and request_key where feasible.
Limit the number of keys a user can create by tuning /proc/sys/kernel/keys/maxkeys and /proc/sys/kernel/keys/maxbytes to reduce the ability to construct hash-colliding key sets.
Reduce local attack surface by removing shell access for service accounts and enforcing least-privilege execution contexts.

bash

# Configuration example: tighten per-user keyring limits
echo 200 > /proc/sys/kernel/user/maxkeys
echo 20000 > /proc/sys/kernel/user/maxbytes

# Verify the running kernel version after patching
uname -r