{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-47659", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-09-30T16:00:12.935Z", "datePublished": "2024-10-09T14:02:54.070Z", "dateUpdated": "2026-08-05T11:39:15.379Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:39:15.379Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmack: tcp: ipv4, fix incorrect labeling\n\nCurrently, Smack mirrors the label of incoming tcp/ipv4 connections:\nwhen a label 'foo' connects to a label 'bar' with tcp/ipv4,\n'foo' always gets 'foo' in returned ipv4 packets. So,\n1) returned packets are incorrectly labeled ('foo' instead of 'bar')\n2) 'bar' can write to 'foo' without being authorized to write.\n\nHere is a scenario how to see this:\n\n* Take two machines, let's call them C and S,\n with active Smack in the default state\n (no settings, no rules, no labeled hosts, only builtin labels)\n\n* At S, add Smack rule 'foo bar w'\n (labels 'foo' and 'bar' are instantiated at S at this moment)\n\n* At S, at label 'bar', launch a program\n that listens for incoming tcp/ipv4 connections\n\n* From C, at label 'foo', connect to the listener at S.\n (label 'foo' is instantiated at C at this moment)\n Connection succeedes and works.\n\n* Send some data in both directions.\n* Collect network traffic of this connection.\n\nAll packets in both directions are labeled with the CIPSO\nof the label 'foo'. Hence, label 'bar' writes to 'foo' without\nbeing authorized, and even without ever being known at C.\n\nIf anybody cares: exactly the same happens with DCCP.\n\nThis behavior 1st manifested in release 2.6.29.4 (see Fixes below)\nand it looks unintentional. At least, no explanation was provided.\n\nI changed returned packes label into the 'bar',\nto bring it into line with the Smack documentation claims." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "baseScore": 9.1, "baseSeverity": "CRITICAL" }, "scenarios": [ { "lang": "en", "value": "AV:N - The flaw is in the `inet_conn_request` LSM hook reached from `tcp_v4_route_req()`/`tcp_conn_request()` on receipt of a TCP/IPv4 SYN, plus the syncookie and DCCP paths, so a remote peer triggers it by connecting over routable IPv4. The attacker-supplied CIPSO tag in the incoming packet is what selects the wrong label, making the attack entirely remote and packet-driven.\nAC:L - The mislabeling is deterministic — no race, no memory-layout dependence, no timing window; every accepted TCP/IPv4 connection from a host absent from the netlabel host list (the default Smack state) is mislabeled. CIPSO labeling is enabled by default at smackfs init and the built-in labels are pre-populated, so no unusual tuning is needed beyond Smack being the active LSM.\nPR:N - The hook runs during SYN processing, before the three-way handshake completes and long before any application-level authentication, so the attacker holds no credentials on the target. The attacker further chooses the CIPSO label presented (e.g. the built-in `@`/web label, which `smk_access()` grants against any object), so no policy-granted standing is required either.\nUI:N - Exploitation needs only a listening socket on the target; no administrator or user on the victim system must open, mount, or click anything. The connection and all subsequent mislabeled traffic are driven entirely by the attacker.\nS:U - The mislabeling and the resulting authorization failure both occur within the kernel's Smack MAC enforcement, the same security authority that owns the vulnerable code. No virtualization, IOMMU, or hypervisor boundary is crossed.\nC:H - All data the server sends is stamped with an attacker-chosen label instead of the server process's real label, so the peer's receive-side `smk_access()` check and any CIPSO-aware network enforcement are bypassed and data from a confined or high-sensitivity domain is delivered to a domain with no authorization to read it. With the built-in `@` (web) label the emitted data becomes readable by every subject, a total loss of the confidentiality control for that connection.\nI:H - Because the reply packets carry the receiver's own label, `smk_access(skp, ssp->smk_in, MAY_WRITE)` is satisfied by Smack's unconditional same-label rule, so a policy rule forbidding the server domain from writing to the client domain is completely bypassed — the commit states \"'bar' can write to 'foo' without being authorized to write.\" Arbitrary data is injected into a MAC domain that must not be written to, a total failure of the integrity control for that flow.\nA:N - The bug causes packets to carry the wrong security label; it produces no crash, oops, hang, deadlock, or resource exhaustion. Connections continue to operate normally — indeed more permissively than policy intends." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "security/smack/smack_lsm.c" ], "versions": [ { "version": "07feee8f812f7327a46186f7604df312c8c81962", "lessThan": "d3f56c653c65f170b172d3c23120bc64ada645d8", "status": "affected", "versionType": "git" }, { "version": "07feee8f812f7327a46186f7604df312c8c81962", "lessThan": "5b4b304f196c070342e32a4752e1fa2e22fc0671", "status": "affected", "versionType": "git" }, { "version": "07feee8f812f7327a46186f7604df312c8c81962", "lessThan": "a948ec993541db4ef392b555c37a1186f4d61670", "status": "affected", "versionType": "git" }, { "version": "07feee8f812f7327a46186f7604df312c8c81962", "lessThan": "0aea09e82eafa50a373fc8a4b84c1d4734751e2c", "status": "affected", "versionType": "git" }, { "version": "07feee8f812f7327a46186f7604df312c8c81962", "lessThan": "0776bcf9cb6de46fdd94d10118de1cf9b05f83b9", "status": "affected", "versionType": "git" }, { "version": "07feee8f812f7327a46186f7604df312c8c81962", "lessThan": "4be9fd15c3c88775bdf6fa37acabe6de85beebff", "status": "affected", "versionType": "git" }, { "version": "07feee8f812f7327a46186f7604df312c8c81962", "lessThan": "d3703fa94116fed91f64c7d1c7d284fb4369070f", "status": "affected", "versionType": "git" }, { "version": "07feee8f812f7327a46186f7604df312c8c81962", "lessThan": "2fe209d0ad2e2729f7e22b9b31a86cc3ff0db550", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "security/smack/smack_lsm.c" ], "versions": [ { "version": "2.6.30", "status": "affected" }, { "version": "0", "lessThan": "2.6.30", "status": "unaffected", "versionType": "semver" }, { "version": "4.19.322", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.284", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.226", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.167", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.109", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.50", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.10.9", "lessThanOrEqual": "6.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.11", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "4.19.322" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "5.4.284" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "5.10.226" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "5.15.167" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "6.1.109" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "6.6.50" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "6.10.9" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "6.11" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/d3f56c653c65f170b172d3c23120bc64ada645d8" }, { "url": "https://git.kernel.org/stable/c/5b4b304f196c070342e32a4752e1fa2e22fc0671" }, { "url": "https://git.kernel.org/stable/c/a948ec993541db4ef392b555c37a1186f4d61670" }, { "url": "https://git.kernel.org/stable/c/0aea09e82eafa50a373fc8a4b84c1d4734751e2c" }, { "url": "https://git.kernel.org/stable/c/0776bcf9cb6de46fdd94d10118de1cf9b05f83b9" }, { "url": "https://git.kernel.org/stable/c/4be9fd15c3c88775bdf6fa37acabe6de85beebff" }, { "url": "https://git.kernel.org/stable/c/d3703fa94116fed91f64c7d1c7d284fb4369070f" }, { "url": "https://git.kernel.org/stable/c/2fe209d0ad2e2729f7e22b9b31a86cc3ff0db550" } ], "title": "smack: tcp: ipv4, fix incorrect labeling", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2024-10-10T13:23:30.727932Z", "id": "CVE-2024-47659", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-10T13:23:46.221Z" } }, { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:20:23.105Z" } } ] } }