🛡️ AZL-50694 — kernel

⚪ Unknown ✅ No Known Exploit OSV
N/A
CVSS Score
0 Low4 Medium7 High9 Critical10

Description

CVE-2024-47684 affecting package kernel for versions less than 5.15.173.1-1

In the Linux kernel, the following vulnerability has been resolved:

tcp: check skb is non-NULL in tcp_rto_delta_us()

We have some machines running stock Ubuntu 20.04.6 which is their 5.4.0-174-generic

kernel that are running ceph and recently hit a null ptr dereference in

tcp_rearm_rto(). Initially hitting it from the TLP path, but then later we also

saw it getting hit from the RACK case as well. Here are examples of the oops

messages we saw in each of those cases:

Jul 26 15:05:02 rx [11061395.780353] BUG: kernel NULL pointer dereference, address: 0000000000000020

Jul 26 15:05:02 rx [11061395.787572] #PF: supervisor read access in kernel mode

Jul 26 15:05:02 rx [11061395.792971] #PF: error_code(0x0000) - not-present page

Jul 26 15:05:02 rx [11061395.798362] PGD 0 P4D 0

Jul 26 15:05:02 rx [11061395.801164] Oops: 0000 [#1] SMP NOPTI

Jul 26 15:05:02 rx [11061395.805091] CPU: 0 PID: 9180 Comm: msgr-worker-1 Tainted: G W 5.4.0-174-generic #193-Ubuntu

Jul 26 15:05:02 rx [11061395.814996] Hardware name: Supermicro SMC 2x26 os-gen8 64C NVME-Y 256G/H12SSW-NTR, BIOS 2.5.V1.2U.NVMe.UEFI 05/09/2023

Jul 26 15:05:02 rx [11061395.825952] RIP: 0010:tcp_rearm_rto+0xe4/0x160

Jul 26 15:05:02 rx [11061395.830656] Code: 87 ca 04 00 00 00 5b 41 5c 41 5d 5d c3 c3 49 8b bc 24 40 06 00 00 eb 8d 48 bb cf f7 53 e3 a5 9b c4 20 4c 89 ef e8 0c fe 0e 00 <48> 8b 78 20 48 c1 ef 03 48 89 f8 41 8b bc 24 80 04 00 00 48 f7 e3

Jul 26 15:05:02 rx [11061395.849665] RSP: 0018:ffffb75d40003e08 EFLAGS: 00010246

Jul 26 15:05:02 rx [11061395.855149] RAX: 0000000000000000 RBX: 20c49ba5e353f7cf RCX: 0000000000000000

Jul 26 15:05:02 rx [11061395.862542] RDX: 0000000062177c30 RSI: 000000000000231c RDI: ffff9874ad283a60

Jul 26 15:05:02 rx [11061395.869933] RBP: ffffb75d40003e20 R08: 0000000000000000 R09: ffff987605e20aa8

Jul 26 15:05:02 rx [11061395.877318] R10: ffffb75d40003f00 R11: ffffb75d4460f740 R12: ffff9874ad283900

Jul 26 15:05:02 rx [11061395.884710] R13: ffff9874ad283a60 R14: ffff9874ad283980 R15: ffff9874ad283d30

Jul 26 15:05:02 rx [11061395.892095] FS: 00007f1ef4a2e700(0000) GS:ffff987605e00000(0000) knlGS:0000000000000000

Jul 26 15:05:02 rx [11061395.900438] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

Jul 26 15:05:02 rx [11061395.906435] CR2: 0000000000000020 CR3: 0000003e450ba003 CR4: 0000000000760ef0

Jul 26 15:05:02 rx [11061395.913822] PKRU: 55555554

Jul 26 15:05:02 rx [11061395.916786] Call Trace:

Jul 26 15:05:02 rx [11061395.919488]

Jul 26 15:05:02 rx [11061395.921765] ? show_regs.cold+0x1a/0x1f

Jul 26 15:05:02 rx [11061395.925859] ? __die+0x90/0xd9

Jul 26 15:05:02 rx [11061395.929169] ? no_context+0x196/0x380

Jul 26 15:05:02 rx [11061395.933088] ? ip6_protocol_deliver_rcu+0x4e0/0x4e0

Jul 26 15:05:02 rx [11061395.938216] ? ip6_sublist_rcv_finish+0x3d/0x50

Jul 26 15:05:02 rx [11061395.943000] ? __bad_area_nosemaphore+0x50/0x1a0

Jul 26 15:05:02 rx [11061395.947873] ? bad_area_nosemaphore+0x16/0x20

Jul 26 15:05:02 rx [11061395.952486] ? do_user_addr_fault+0x267/0x450

Jul 26 15:05:02 rx [11061395.957104] ? ipv6_list_rcv+0x112/0x140

Jul 26 15:05:02 rx [11061395.961279] ? __do_page_fault+0x58/0x90

Jul 26 15:05:02 rx [11061395.965458] ? do_page_fault+0x2c/0xe0

Jul 26 15:05:02 rx [11061395.969465] ? page_fault+0x34/0x40

Jul 26 15:05:02 rx [11061395.973217] ? tcp_rearm_rto+0xe4/0x160

Jul 26 15:05:02 rx [11061395.977313] ? tcp_rearm_rto+0xe4/0x160

Jul 26 15:05:02 rx [11061395.981408] tcp_send_loss_probe+0x10b/0x220

Jul 26 15:05:02 rx [11061395.985937] tcp_write_timer_handler+0x1b4/0x240

Jul 26 15:05:02 rx [11061395.990809] tcp_write_timer+0x9e/0xe0

Jul 26 15:05:02 rx [11061395.994814] ? tcp_write_timer_handler+0x240/0x240

Jul 26 15:05:02 rx [11061395.999866] call_timer_fn+0x32/0x130

Jul 26 15:05:02 rx [11061396.003782] __run_timers.part.0+0x180/0x280

Jul 26 15:05:02 rx [11061396.008309] ? recalibrate_cpu_khz+0x10/0x10

Jul 26 15:05:02 rx [11061396.012841] ? native_x2apic_icr_write+0x30/0x30

Jul 26 15:05:02 rx [11061396.017718] ? lapic_next_even

---truncated---

How this vulnerability can be exploited

This issue can be reached with local access to the system, attack complexity is low, an attacker needs low-level privileges on the target. No user interaction is required. The scope is unchanged, so the impact stays within the vulnerable component. Rated impact: confidentiality none, integrity none, availability high.

Affected software

AZL-50694 is recorded against 1 package.

  • kernel (fixed in 5.15.173.1-1)

Timeline and source

Published on 21 October 2024 and last revised on 21 April 2026. No public exploit is currently recorded for this entry. Record sourced from OSV.

References

nvd.nist.gov (Web)

Details

Severity Unknown
CVSS Score N/A
CVSS Vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE N/A
Public Exploit ✅ No
Source OSV
Published 2024-10-21
Updated 2026-08-12
Modified 2026-04-21
Fix URL N/A

Affected Packages

Software From version Fixed in
kernel — 5.15.173.1-1

Similar Threats

Free Vulnerability Check

Is your site affected by AZL-50694?

BotEraser helps you identify potentially vulnerable plugins and themes by checking your installation against AZL-50694 and other known CVE records.

Scan My Site Free →

No credit card required  ·  Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.