CVE-2024-50293: Software Security Vulnerability Vulnerability
HIGHCVE-2024-50293 is a HIGH (CVSS 7.8) security vulnerability vulnerability (CWE-416: Use After Free) affecting Software libraries in the Maven ecosystem. The weakness occurs when the product reuses or references memory after it has been freed. at some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.. Remediation is available in the latest vendor maintenance releases.
CVE-2024-50293 at a Glance
Security Impact
CVSS: 7.8
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
How to Fix CVE-2024-50293
To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Run the following command in your project directory to verify that all resolved dependencies use the patched release:
mvn dependency:treeHow to Check if You Are Affected
To determine whether your Java application is affected by CVE-2024-50293, inspect your build dependencies using the Maven Dependency Plugin:
mvn dependency:treeAnalyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.
Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-416: Use After Free, where the product reuses or references memory after it has been freed. at some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
References
Frequently Asked Questions
What is CVE-2024-50293?
Which Software versions are affected?
What version fixes CVE-2024-50293?
What is the CVSS score of CVE-2024-50293?
What CWE is associated with CVE-2024-50293?
How can I check Maven dependencies for CVE-2024-50293?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-px2p-6fmh-crpv",
"modified" : "2025-01-07T18:30:44Z",
"published" : "2024-11-19T03:31:08Z",
"aliases" : [ "CVE-2024-50293" ],
"details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: do not leave a dangling sk pointer in __smc_create()\n\nThanks to commit 4bbd360a5084 (\"socket: Print pf->create() when\nit does not clear sock->sk on failure.\"), syzbot found an issue with AF_SMC:\n\nsmc_create must clear sock->sk on failure, family: 43, type: 1, protocol: 0\n WARNING: CPU: 0 PID: 5827 at net/socket.c:1565 __sock_create+0x96f/0xa30 net/socket.c:1563\nModules linked in:\nCPU: 0 UID: 0 PID: 5827 Comm: syz-executor259 Not tainted 6.12.0-rc6-next-20241106-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024\n RIP: 0010:__sock_create+0x96f/0xa30 net/socket.c:1563\nCode: 03 00 74 08 4c 89 e7 e8 4f 3b 85 f8 49 8b 34 24 48 c7 c7 40 89 0c 8d 8b 54 24 04 8b 4c 24 0c 44 8b 44 24 08 e8 32 78 db f7 90 <0f> 0b 90 90 e9 d3 fd ff ff 89 e9 80 e1 07 fe c1 38 c1 0f 8c ee f7\nRSP: 0018:ffffc90003e4fda0 EFLAGS: 00010246\nRAX: 099c6f938c7f4700 RBX: 1ffffffff1a595fd RCX: ffff888034823c00\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\nRBP: 00000000ffffffe9 R08: ffffffff81567052 R09: 1ffff920007c9f50\nR10: dffffc0000000000 R11: fffff520007c9f51 R12: ffffffff8d2cafe8\nR13: 1ffffffff1a595fe R14: ffffffff9a789c40 R15: ffff8880764298c0\nFS: 000055557b518380(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007fa62ff43225 CR3: 0000000031628000 CR4: 00000000003526f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n <TASK>\n sock_create net/socket.c:1616 [inline]\n __sys_socket_create net/socket.c:1653 [inline]\n __sys_socket+0x150/0x3c0 net/socket.c:1700\n __do_sys_socket net/socket.c:1714 [inline]\n __se_sys_socket net/socket.c:1712 [inline]\n\nFor reference, see commit 2d859aff775d (\"Merge branch\n'do-not-leave-dangling-sk-pointers-in-pf-create-functions'\")",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
} ],
"affected" : [ ],
"references" : [ {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2024-50293"
}, {
"type" : "WEB",
"url" : "https://git.kernel.org/stable/c/d293958a8595ba566fb90b99da4d6263e14fee15"
}, {
"type" : "WEB",
"url" : "https://git.kernel.org/stable/c/d2cc492124e1f22daa1700f069bcc58788043381"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-416" ],
"severity" : "HIGH",
"github_reviewed" : false,
"github_reviewed_at" : null,
"nvd_published_at" : "2024-11-19T02:16:31Z"
}
}