{ "dataType": "CVE_RECORD", "cveMetadata": { "cveId": "CVE-2024-35910", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-17T13:50:33.121Z", "datePublished": "2024-05-19T08:35:03.287Z", "dateUpdated": "2026-08-05T11:30:54.229Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:30:54.229Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: properly terminate timers for kernel sockets\n\nWe had various syzbot reports about tcp timers firing after\nthe corresponding netns has been dismantled.\n\nFortunately Josef Bacik could trigger the issue more often,\nand could test a patch I wrote two years ago.\n\nWhen TCP sockets are closed, we call inet_csk_clear_xmit_timers()\nto 'stop' the timers.\n\ninet_csk_clear_xmit_timers() can be called from any context,\nincluding when socket lock is held.\nThis is the reason it uses sk_stop_timer(), aka del_timer().\nThis means that ongoing timers might finish much later.\n\nFor user sockets, this is fine because each running timer\nholds a reference on the socket, and the user socket holds\na reference on the netns.\n\nFor kernel sockets, we risk that the netns is freed before\ntimer can complete, because kernel sockets do not hold\nreference on the netns.\n\nThis patch adds inet_csk_clear_xmit_timers_sync() function\nthat using sk_stop_timer_sync() to make sure all timers\nare terminated before the kernel socket is released.\nModules using kernel sockets close them in their netns exit()\nhandler.\n\nAlso add sock_not_owned_by_me() helper to get LOCKDEP\nsupport : inet_csk_clear_xmit_timers_sync() must not be called\nwhile socket lock is held.\n\nIt is very possible we can revert in the future commit\n3a58f13a881e (\"net: rds: acquire refcount on TCP sockets\")\nwhich attempted to solve the issue in rds only.\n(net/smc/af_smc.c and net/mptcp/subflow.c have similar code)\n\nWe probably can remove the check_net() tests from\ntcp_out_of_resources() and __tcp_close() in the future." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The necessary and sufficient trigger is dismantling a network namespace that holds kernel TCP sockets, which is a local operation (unshare/setns exit, `ip netns del`, container teardown, module unload). A remote peer can widen the window enormously by stalling the connection so retransmit/probe timers stay armed, but cannot alone cause the netns free.\nAC:L - The attacker drives both sides of the race: they keep TCP timers firing continuously (stalled/lossy peer, zero-window probes, keepalives, RTO min 200ms) and repeatedly create and destroy namespaces, retrying indefinitely at no cost. Per the race-condition rule this is Low, and syzbot plus Josef Bacik reproduced it repeatedly on stock configurations.\nPR:L - An unprivileged local user can create and destroy network namespaces through user namespaces (`unshare -Urn`), which is enabled by default on mainstream distributions, and in a container deployment an unprivileged tenant can force the netns teardown that races with the kernel socket close. No real root in the initial namespace is required to drive the trigger.\nUI:N - Namespace teardown and socket close happen automatically from the pernet exit handler with no victim action required. The attacker supplies both the traffic conditions and the teardown.\nS:U - The corruption is confined to kernel memory under the same security authority; there is no VM, IOMMU, or hypervisor boundary crossed. Standard kernel memory-corruption scoring applies.\nC:H - The timer handlers perform use-after-free reads of the freed `struct net` (sysctl fields, `check_net()`, the SNMP mib pointer) and then follow freed pointers into route/FIB structures, so reallocated kernel data is read and acted upon. A UAF of this kind yields an attacker-influenceable read primitive, warranting High.\nI:H - `__NET_INC_STATS(sock_net(sk), ...)` performs writes through a pointer loaded from the freed namespace, and `tcp_done()`/`tcp_retransmit_skb()` manipulate freed per-netns hash tables and dst state from softirq context. Since `struct net` slots can be reoccupied by a fresh namespace the attacker sprays, this is an exploitable write/type-confusion primitive, not merely a read.\nA:H - Confirmed kernel oops and panic in production from this bug class — a wild-pointer data abort in `fib_rules_lookup()` from the TCP timer path, plus multiple syzbot KASAN slab-use-after-free splats in `tcp_write_timer_handler()`. Any successful trigger crashes the host." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "include/net/inet_connection_sock.h", "include/net/sock.h", "net/ipv4/inet_connection_sock.c", "net/ipv4/tcp.c" ], "versions": [ { "version": "26abe14379f8e2fa3fd1bcf97c9a7ad9364886fe", "lessThan": "93f0133b9d589cc6e865f254ad9be3e9d8133f50", "status": "affected", "versionType": "git" }, { "version": "26abe14379f8e2fa3fd1bcf97c9a7ad9364886fe", "lessThan": "44e62f5d35678686734afd47c6a421ad30772e7f", "status": "affected", "versionType": "git" }, { "version": "26abe14379f8e2fa3fd1bcf97c9a7ad9364886fe", "lessThan": "e3e27d2b446deb1f643758a0c4731f5c22492810", "status": "affected", "versionType": "git" }, { "version": "26abe14379f8e2fa3fd1bcf97c9a7ad9364886fe", "lessThan": "2e43d8eba6edd1cf05a3a20fdd77688fa7ec16a4", "status": "affected", "versionType": "git" }, { "version": "26abe14379f8e2fa3fd1bcf97c9a7ad9364886fe", "lessThan": "91b243de910a9ac8476d40238ab3dbfeedd5b7de", "status": "affected", "versionType": "git" }, { "version": "26abe14379f8e2fa3fd1bcf97c9a7ad9364886fe", "lessThan": "c1ae4d1e76eacddaacb958b67cd942082f800c87", "status": "affected", "versionType": "git" }, { "version": "26abe14379f8e2fa3fd1bcf97c9a7ad9364886fe", "lessThan": "899265c1389fe022802aae73dbf13ee08837a35a", "status": "affected", "versionType": "git" }, { "version": "26abe14379f8e2fa3fd1bcf97c9a7ad9364886fe", "lessThan": "151c9c724d05d5b0dd8acd3e11cb69ef1f2dbada", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "include/net/inet_connection_sock.h", "include/net/sock.h", "net/ipv4/inet_connection_sock.c", "net/ipv4/tcp.c" ], "versions": [ { "version": "4.2", "status": "affected" }, { "version": "0", "lessThan": "4.2", "status": "unaffected", "versionType": "semver" }, { "version": "4.19.312", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.274", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.215", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.154", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.85", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.26", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.8.5", "lessThanOrEqual": "6.8.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.9", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "4.19.312" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "5.4.274" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "5.10.215" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "5.15.154" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "6.1.85" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "6.6.26" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "6.8.5" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "6.9" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/93f0133b9d589cc6e865f254ad9be3e9d8133f50" }, { "url": "https://git.kernel.org/stable/c/44e62f5d35678686734afd47c6a421ad30772e7f" }, { "url": "https://git.kernel.org/stable/c/e3e27d2b446deb1f643758a0c4731f5c22492810" }, { "url": "https://git.kernel.org/stable/c/2e43d8eba6edd1cf05a3a20fdd77688fa7ec16a4" }, { "url": "https://git.kernel.org/stable/c/91b243de910a9ac8476d40238ab3dbfeedd5b7de" }, { "url": "https://git.kernel.org/stable/c/c1ae4d1e76eacddaacb958b67cd942082f800c87" }, { "url": "https://git.kernel.org/stable/c/899265c1389fe022802aae73dbf13ee08837a35a" }, { "url": "https://git.kernel.org/stable/c/151c9c724d05d5b0dd8acd3e11cb69ef1f2dbada" } ], "title": "tcp: properly terminate timers for kernel sockets", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "problemTypes": [ { "descriptions": [ { "type": "CWE", "lang": "en", "description": "CWE-noinfo Not enough information" } ] } ], "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 5.8, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "LOW" } }, { "other": { "type": "ssvc", "content": { "timestamp": "2024-05-29T18:25:39.390284Z", "id": "CVE-2024-35910", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-29T19:44:27.885Z" } }, { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:21:48.925Z" }, "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/93f0133b9d589cc6e865f254ad9be3e9d8133f50", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/44e62f5d35678686734afd47c6a421ad30772e7f", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/e3e27d2b446deb1f643758a0c4731f5c22492810", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/2e43d8eba6edd1cf05a3a20fdd77688fa7ec16a4", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/91b243de910a9ac8476d40238ab3dbfeedd5b7de", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/c1ae4d1e76eacddaacb958b67cd942082f800c87", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/899265c1389fe022802aae73dbf13ee08837a35a", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/151c9c724d05d5b0dd8acd3e11cb69ef1f2dbada", "tags": [ "x_transferred" ] }, { "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html", "tags": [ "x_transferred" ] }, { "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html", "tags": [ "x_transferred" ] } ] }, { "x_adpType": "supplier", "providerMetadata": { "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-05-12T11:52:45.434Z" }, "affected": [ { "vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [ { "status": "affected", "version": "0", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "versions": [ { "status": "affected", "version": "V3.1.0", "lessThan": "V3.1.5", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "versions": [ { "status": "affected", "version": "V3.1.0", "lessThan": "V3.1.5", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "versions": [ { "status": "affected", "version": "V3.1.0", "lessThan": "V3.1.5", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "versions": [ { "status": "affected", "version": "V3.1.0", "lessThan": "V3.1.5", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP", "versions": [ { "status": "affected", "version": "V3.1.0", "lessThan": "V3.1.5", "versionType": "custom" } ], "defaultStatus": "unknown" } ], "references": [ { "url": "https://cert-portal.siemens.com/productcert/html/ssa-398330.html" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ] } ] }, "dataVersion": "5.2" }