CVE-2024-50301 is a vulnerability in the Linux kernel's security keys subsystem, specifically within the key_task_permission function. The issue is a slab-out-of-bounds read detected by Kernel Address Sanitizer (KASAN), which occurs due to improper handling of keyring data structures during nested keyring searches. The vulnerability arises when the search_nested_keyrings function iterates through slots in a node of the keyring tree. If a slot pointer is a shortcut and the node is the root, the pointer may be incorrectly treated as a keyring pointer due to overlapping subtype values (KEYRING_PTR_SUBTYPE and ASSOC_ARRAY_PTR_SUBTYPE_MASK both being 0x2UL). This leads to an out-of-bounds read when the code dereferences the pointer as a keyring, resulting in a slab-out-of-bounds memory access. The vulnerability can be reproduced by adding more than 32 keys with similar hashes ending with the pattern '0xxxxxxxe6' to the keyring tree, causing the tree to split and form a structure where a root slot points to a shortcut. The flaw is fixed by ensuring that any shortcut pointer, regardless of whether the node is root or not, triggers a descent into the node rather than being treated as a keyring pointer. This vulnerability affects Linux kernel versions including commit b2a4df200d570b2c33a57e1ebfa5896e4bc81b69 and likely others in the 5.10 kernel series. No known exploits are reported in the wild at this time. The vulnerability was reported by syzbot, an automated kernel fuzzing tool, and is documented with detailed technical analysis and a proposed fix.

For European organizations, this vulnerability poses a risk primarily to systems running affected Linux kernel versions, especially those using the security keys subsystem extensively, such as servers, cloud infrastructure, and embedded devices. The out-of-bounds read could potentially lead to kernel crashes (denial of service) or information disclosure if exploited in a crafted environment. Although no direct privilege escalation or remote code execution is described, the memory corruption could be leveraged in complex attack chains. Given Linux's widespread use in European data centers, telecommunications, and critical infrastructure, unpatched systems could experience stability issues or be targeted for further exploitation attempts. The impact is heightened in environments where untrusted users or processes can add keys or manipulate the keyring subsystem, such as multi-tenant cloud platforms or containerized environments. The vulnerability's exploitation requires specific conditions (adding many keys with similar hashes), which may limit ease of exploitation but does not eliminate risk. Organizations relying on Linux kernel 5.10 or similar versions should consider this a significant security concern.

1. Apply the official Linux kernel patch that corrects the key_task_permission function to properly handle shortcut pointers in the keyring tree, ensuring the fix described in the advisory is implemented. 2. Upgrade Linux kernel versions to the latest stable release that includes this fix, preferably beyond the affected 5.10 series. 3. Restrict the ability to add keys to the security keyring subsystem to trusted users and processes only, minimizing the risk of malicious key insertion. 4. Monitor kernel logs for KASAN or slab-out-of-bounds errors that may indicate attempted exploitation or instability related to this vulnerability. 5. In containerized or multi-tenant environments, enforce strict namespace and capability isolation to prevent unprivileged users from manipulating kernel keyrings. 6. Conduct regular vulnerability scanning and patch management to ensure timely application of kernel security updates. 7. Consider deploying runtime security tools that can detect anomalous kernel memory access patterns or crashes related to keyring operations.