CVE-2024-50035

A flaw was found in the Linux kernel's Point-to-Point Protocol (PPP) implementation. A local attacker can exploit this vulnerability by sending a specially crafted message with a zero size to the pppoe_sendmsg() function, which leads to an uninitialized value being used in the ppp_async_encode() function. This can result in information disclosure and a denial of service (DoS).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

If PPPoE functionality is not required, the ppp_async kernel module can be blacklisted to prevent its loading. Create a file like /etc/modprobe.d/disable-ppp_async.conf with the content blacklist ppp_async. A system reboot or module reload may be required for the changes to take effect.