CVE-2024-50184 – A vulnerability in the Linux kernel's virtio

Q: What is the severity of CVE-2024-50184?

CVE-2024-50184 has a CVSS score of 5.5 (MEDIUM). A vulnerability in the Linux kernel's virtio_pmem driver could cause system hangs when attempting to flush data from a non-activated persistent memory device. This affects systems using virtio_pmem with Linux kernels containing the vulnerable code. The issue allows local attackers to cause denial of service.

📋 TL;DR

A vulnerability in the Linux kernel's virtio_pmem driver could cause system hangs when attempting to flush data from a non-activated persistent memory device. This affects systems using virtio_pmem with Linux kernels containing the vulnerable code. The issue allows local attackers to cause denial of service.

💻 Affected Systems

Products:

Linux kernel virtio_pmem driver

Versions: Kernel versions containing vulnerable virtio_pmem code before fixes were applied

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems using virtio_pmem functionality with persistent memory devices.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

System becomes completely unresponsive requiring hard reboot, potentially causing data loss or corruption.

🟠

Likely Case

Local user or process triggers system hang requiring manual intervention to restore service.

🟢

If Mitigated

System continues operating normally with proper patching or workarounds.

🌐 Internet-Facing: LOW - Requires local access to trigger the vulnerability.

🏢 Internal Only: MEDIUM - Local users or compromised processes could cause system instability affecting availability.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: NO

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires local access and ability to trigger virtio_pmem flush operations on non-activated devices.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions with commit 4ce662fe4be6fbc2595d9ef4888b2b6e778c99ed or later fixes

Vendor Advisory: https://git.kernel.org/stable/c/4ce662fe4be6fbc2595d9ef4888b2b6e778c99ed

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution vendor. 2. Reboot system to load new kernel. 3. Verify kernel version after reboot.

🔧 Temporary Workarounds

Disable virtio_pmem module

linux

Prevent loading of vulnerable virtio_pmem driver

echo 'blacklist virtio_pmem' >> /etc/modprobe.d/blacklist-virtio_pmem.conf
update-initramfs -u
reboot

Avoid using virtio_pmem devices

linux

Do not configure or use virtio persistent memory devices

🧯 If You Can't Patch

Restrict local user access to systems using virtio_pmem
Monitor for system hangs and implement automated recovery procedures

🔍 How to Verify

Check if Vulnerable:

Check if virtio_pmem module is loaded: lsmod | grep virtio_pmem. If loaded and kernel version is unpatched, system is vulnerable.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is patched and virtio_pmem module loads without issues during system operation.

📡 Detection & Monitoring

Log Indicators:

System hang events
Kernel panic logs
Process timeouts related to virtio operations

Network Indicators:

None - local vulnerability only

SIEM Query:

search for 'kernel panic' OR 'system hang' OR 'virtio_pmem' in system logs

📊 Metadata

CVE ID: CVE-2024-50184

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-754

Published: November 8, 2024

Last Updated: November 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-50184, you might also want to check these: