CVE-2024-50143 – This CVE addresses an uninitialized value vulne... (How to Fix)

Q: What is the severity of CVE-2024-50143?

CVE-2024-50143 has a CVSS score of 7.8 (HIGH). This CVE addresses an uninitialized value vulnerability in the Linux kernel's UDF filesystem driver. An attacker could exploit this to read uninitialized kernel memory, potentially leading to information disclosure or system crashes. All Linux systems using the UDF filesystem driver are affected.

📋 TL;DR

This CVE addresses an uninitialized value vulnerability in the Linux kernel's UDF filesystem driver. An attacker could exploit this to read uninitialized kernel memory, potentially leading to information disclosure or system crashes. All Linux systems using the UDF filesystem driver are affected.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific affected versions not explicitly stated in CVE, but patches available for multiple stable branches

Operating Systems: Linux distributions using vulnerable kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable when UDF filesystem is mounted. Most systems don't use UDF by default.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel memory information disclosure leading to privilege escalation or system compromise

🟠

Likely Case

Kernel panic or system crash causing denial of service

🟢

If Mitigated

No impact if UDF filesystem is not mounted or patch is applied

🌐 Internet-Facing: LOW - Requires local access or UDF filesystem mounting from untrusted sources

🏢 Internal Only: MEDIUM - Local users could trigger the vulnerability if they can mount UDF filesystems

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Syzkaller fuzzer discovered the bug. Exploitation requires ability to mount UDF filesystems.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Multiple stable kernel versions with commits: 0ce61b1f6b32, 1ac49babc952, 264db9d666ad, 417bd613bdbe, 4fc0d8660e39

Vendor Advisory: https://git.kernel.org/stable/c/0ce61b1f6b32df822b59c680cbe8e5ba5d335742

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version. 2. Reboot system. 3. Verify kernel version matches patched release.

🔧 Temporary Workarounds

Disable UDF module

linux

Prevent loading of UDF filesystem driver

echo 'install udf /bin/true' >> /etc/modprobe.d/disable-udf.conf
rmmod udf

Block UDF mounting

linux

Prevent mounting of UDF filesystems

echo 'udf' >> /etc/modprobe.d/blacklist.conf

🧯 If You Can't Patch

Restrict UDF filesystem mounting to trusted users only
Implement strict access controls on /dev/cdrom and other removable media devices

🔍 How to Verify

Check if Vulnerable:

Check if UDF module is loaded: lsmod | grep udf

Check Version:

uname -r

Verify Fix Applied:

Check kernel version includes patched commit: grep -q '0ce61b1f6b32\|1ac49babc952\|264db9d666ad\|417bd613bdbe\|4fc0d8660e39' /proc/version

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages
UDF filesystem mount failures
System crashes when accessing UDF media

Network Indicators:

None - local vulnerability only

SIEM Query:

source="kernel" AND ("UDF" OR "udf") AND ("panic" OR "BUG" OR "Oops")

📊 Metadata

CVE ID: CVE-2024-50143

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-908

Published: November 7, 2024

Last Updated: November 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-50143, you might also want to check these: