{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-47678", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-09-30T16:00:12.939Z", "datePublished": "2024-10-21T11:53:21.814Z", "dateUpdated": "2026-08-05T11:39:24.010Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:39:24.010Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nicmp: change the order of rate limits\n\nICMP messages are ratelimited :\n\nAfter the blamed commits, the two rate limiters are applied in this order:\n\n1) host wide ratelimit (icmp_global_allow())\n\n2) Per destination ratelimit (inetpeer based)\n\nIn order to avoid side-channels attacks, we need to apply\nthe per destination check first.\n\nThis patch makes the following change :\n\n1) icmp_global_allow() checks if the host wide limit is reached.\n But credits are not yet consumed. This is deferred to 3)\n\n2) The per destination limit is checked/updated.\n This might add a new node in inetpeer tree.\n\n3) icmp_global_consume() consumes tokens if prior operations succeeded.\n\nThis means that host wide ratelimit is still effective\nin keeping inetpeer tree small even under DDOS.\n\nAs a bonus, I removed icmp_global.lock as the fast path\ncan use a lock-free operation." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L", "baseScore": 9.4, "baseSeverity": "CRITICAL" }, "scenarios": [ { "lang": "en", "value": "AV:N - The vulnerable code is the ICMP output rate limiter in the IPv4/IPv6 stack, reached purely by processing received IP packets (e.g. a UDP datagram to a closed port via `__udp4_lib_rcv()` → `icmp_send()`), and the side channel is measured by an off-path host over the Internet. No local or adjacent access is required.\nAC:L - The attacker fully controls both sides: they generate the packets that drain the global bucket and separately probe its residual state from their own address, repeating at will to average out the `get_random_u32_below(3)` noise, and they can induce the victim resolver's in-flight query themselves rather than waiting for one. No condition of the target's memory layout or configuration that the attacker cannot influence is required — the ordering flaw is deterministic and present in default configurations.\nPR:N - No credentials, sockets, or capabilities are involved anywhere on the path — ICMP error generation happens for any unsolicited packet before any authentication, from any remote host.\nUI:N - The ICMP replies and the rate-limiter accounting occur entirely in kernel softirq context on packet receipt; no action by any local user or administrator is needed.\nS:U - The leaked state and the resulting impact remain within the security authority of the affected host's network stack; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - The shared global counter leaks whether and how many ICMP-eliciting packets the host processed for arbitrary third-party destinations, which recovers the secret ephemeral UDP source port of in-flight transactions (the SAD DNS primitive); that defeats UDP source-port randomization and exposes the confidentiality of DNS resolution and everything subsequently redirected by it.\nI:H - Recovering the source port lets an off-path attacker forge and win the race against the legitimate response, poisoning the resolver cache and arbitrarily redirecting the victim's traffic — full compromise of the integrity of the data the host relies on, consistent with the same attack class scored I:H previously.\nA:L - Because credits are consumed before the per-peer check, a single spoofed source address sending ~50 pps to closed ports exhausts the entire host-wide ICMP budget, suppressing legitimate ICMP error signalling (port unreachable, time exceeded) to every other peer and degrading network diagnostics and fast connection-failure signalling; there is no crash, so the impact is degradation rather than total loss." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "include/net/ip.h", "net/ipv4/icmp.c", "net/ipv6/icmp.c" ], "versions": [ { "version": "4cdf507d54525842dfd9f6313fdafba039084046", "lessThan": "997ba8889611891f91e8ad83583466aeab6239a3", "status": "affected", "versionType": "git" }, { "version": "4cdf507d54525842dfd9f6313fdafba039084046", "lessThan": "662ec52260cc07b9ae53ecd3925183c29d34288b", "status": "affected", "versionType": "git" }, { "version": "4cdf507d54525842dfd9f6313fdafba039084046", "lessThan": "a7722921adb046e3836eb84372241f32584bdb07", "status": "affected", "versionType": "git" }, { "version": "4cdf507d54525842dfd9f6313fdafba039084046", "lessThan": "483397b4ba280813e4a9c161a0a85172ddb43d19", "status": "affected", "versionType": "git" }, { "version": "4cdf507d54525842dfd9f6313fdafba039084046", "lessThan": "8c2bd38b95f75f3d2a08c93e35303e26d480d24e", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "include/net/ip.h", "net/ipv4/icmp.c", "net/ipv6/icmp.c" ], "versions": [ { "version": "3.18", "status": "affected" }, { "version": "0", "lessThan": "3.18", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.113", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.54", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.10.13", "lessThanOrEqual": "6.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.11.2", "lessThanOrEqual": "6.11.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.18", "versionEndExcluding": "6.1.113" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.18", "versionEndExcluding": "6.6.54" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.18", "versionEndExcluding": "6.10.13" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.18", "versionEndExcluding": "6.11.2" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.18", "versionEndExcluding": "6.12" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/997ba8889611891f91e8ad83583466aeab6239a3" }, { "url": "https://git.kernel.org/stable/c/662ec52260cc07b9ae53ecd3925183c29d34288b" }, { "url": "https://git.kernel.org/stable/c/a7722921adb046e3836eb84372241f32584bdb07" }, { "url": "https://git.kernel.org/stable/c/483397b4ba280813e4a9c161a0a85172ddb43d19" }, { "url": "https://git.kernel.org/stable/c/8c2bd38b95f75f3d2a08c93e35303e26d480d24e" } ], "title": "icmp: change the order of rate limits", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2024-47678", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-10-21T13:07:41.965400Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-21T13:14:17.106Z" } }, { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:20:43.545Z" } } ] } }