CVE-2024-50072 is a vulnerability identified in the Linux kernel affecting 32-bit mode operation specifically when executing the vm86() system call, as observed in the dosemu software environment. The root cause stems from the use of the VERW instruction, which is employed as part of mitigations against speculative execution side-channel attacks such as Microarchitectural Data Sampling (MDS) and Rogue Data Fetching Side-channel (RFDS). The VERW instruction verifies segment selectors, and if the memory operand effective address lies outside the limits of the code segment (CS), data segment (DS), extra segment (ES), FS, or GS, it triggers a general protection fault (#GP). In this vulnerability, the Linux kernel was using an arbitrary user-supplied segment register value for the VERW operand, which could cause a #GP exception in 32-bit mode. The issue was reported by Robert Gill and manifests as a general protection fault during context switching in the kernel, specifically in the restore_all_switch_stack function. The fix involves modifying the kernel to use the %cs (code segment) selector explicitly for the VERW operand, ensuring that the instruction does not fault due to invalid segment selectors provided by user space. This correction prevents the kernel from crashing due to invalid segment register values when returning to user space, thereby improving system stability and security. The vulnerability is relevant only in 32-bit mode with VERW-based mitigations enabled and does not affect 64-bit mode. The affected Linux kernel versions include several recent commits prior to the fix. No known exploits are reported in the wild, and no CVSS score has been assigned yet.

For European organizations, the impact of CVE-2024-50072 primarily concerns systems running 32-bit Linux kernels with VERW-based mitigations enabled, which is a relatively niche configuration given the widespread adoption of 64-bit systems. However, legacy systems, embedded devices, or specialized industrial control systems that still operate in 32-bit mode could be affected. The vulnerability can cause kernel crashes (general protection faults), leading to denial of service (DoS) conditions. This could disrupt critical services, especially in sectors relying on legacy Linux environments such as manufacturing, telecommunications, or government infrastructure. While the vulnerability does not directly enable privilege escalation or code execution, the resulting instability could be exploited by attackers to cause service interruptions or to facilitate further attacks by destabilizing the system. The lack of known exploits reduces immediate risk, but unpatched systems remain vulnerable to accidental or malicious triggering of kernel faults. European organizations with strict uptime requirements or those operating legacy Linux systems should prioritize patching to maintain operational continuity and security.

1. Apply the official Linux kernel patch that modifies the VERW operand to use the %cs selector, ensuring that the kernel does not fault on arbitrary user segment registers. This patch is included in kernel versions released after the fix date (post-October 2024). 2. Audit and identify any 32-bit Linux systems in the environment, especially those running legacy or embedded applications, and prioritize their update or replacement with 64-bit systems where feasible. 3. For systems that cannot be immediately patched, consider disabling VERW-based mitigations if the security policy allows, understanding the trade-offs with speculative execution attack protections. 4. Implement robust monitoring for kernel crashes and general protection faults to detect potential exploitation attempts or accidental triggers of this vulnerability. 5. Engage with hardware and software vendors to ensure compatibility and support for updated kernels, particularly in embedded or industrial contexts common in European infrastructure. 6. Conduct thorough regression testing after patch deployment to ensure system stability and compatibility with existing applications.