CVE-2024-50145 – A NULL pointer dereference vulnerability exists... (How to Fix)

Q: What is the severity of CVE-2024-50145?

CVE-2024-50145 has a CVSS score of 5.5 (MEDIUM). A NULL pointer dereference vulnerability exists in the Linux kernel's octeon_ep driver when handling SKB allocation failures during network packet processing. This could cause kernel crashes or system instability on systems using this specific network driver. Only Linux systems with the octeon_ep driver enabled are affected.

📋 TL;DR

A NULL pointer dereference vulnerability exists in the Linux kernel's octeon_ep driver when handling SKB allocation failures during network packet processing. This could cause kernel crashes or system instability on systems using this specific network driver. Only Linux systems with the octeon_ep driver enabled are affected.

💻 Affected Systems

Products:

Linux kernel with octeon_ep driver

Versions: Linux kernel versions before the fix commits (specific versions vary by distribution)

Operating Systems: Linux distributions using vulnerable kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable if octeon_ep driver is loaded and active (typically on systems with Octeon network hardware)

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash and denial of service, potentially requiring physical reboot of affected systems.

🟠

Likely Case

System instability or crashes when under high network load conditions that trigger memory allocation failures in the driver.

🟢

If Mitigated

Minor performance impact with dropped packets during memory pressure, but system remains stable.

🌐 Internet-Facing: LOW - Requires local system access or ability to send network traffic to affected interface.

🏢 Internal Only: MEDIUM - Internal attackers with network access could potentially trigger the condition through crafted traffic.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: NO

Unauthenticated Exploit: ✅ No

Complexity: HIGH

Exploitation requires ability to trigger memory allocation failures in kernel space and specific hardware/driver configuration.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Linux kernel with commits 09ce491112bbf0b866e2638d3e961c1c73d1f00b or later

Vendor Advisory: https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution. 2. Reboot system to load new kernel. 3. Verify octeon_ep driver is using patched code.

🔧 Temporary Workarounds

Disable octeon_ep driver

linux

Prevent loading of vulnerable driver module

echo 'blacklist octeon_ep' >> /etc/modprobe.d/blacklist.conf
rmmod octeon_ep

🧯 If You Can't Patch

Monitor system logs for kernel crashes or allocation failures
Implement network traffic controls to limit traffic to affected interfaces

🔍 How to Verify

Check if Vulnerable:

Check if octeon_ep driver is loaded: lsmod | grep octeon_ep && check kernel version against patched versions

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes fix commits and driver functions properly under network load

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages
NULL pointer dereference errors in dmesg
octeon_ep driver allocation failures

Network Indicators:

Unusual packet drops on affected interfaces
Network service interruptions

SIEM Query:

source="kernel" AND ("NULL pointer dereference" OR "octeon_ep" OR "kernel panic")

📊 Metadata

CVE ID: CVE-2024-50145

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-476

Published: November 7, 2024

Last Updated: November 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-50145, you might also want to check these: