CVE-2024-50035

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.58

Description: A vulnerability has been resolved in the Linux kernel related to the ppp async encode() function. The issue occurs when pppoe sendmsg() is called with a zero size, leading to ppp async encode() being called with an empty skb. This results in an uninit-value bug. The vulnerability is related to the ppp async encode() and ppp async push() functions in the drivers/net/ppp/ppp async.c file. The pppoe sendmsg() function is also involved in the issue.

Recommendations: To resolve the issue, update the Linux kernel to version 6.6.58 or later. As a temporary workaround, consider disabling the ppp async encode() function until a patch is available. Restrict access to the pppoe sendmsg() function to minimize the risk of exploitation. Avoid using the ppp async push() function in the affected API endpoint until the issue is resolved.