Vulnerability in Linux
CVE-2024-56638
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_inner: incorrect percpu area handling under softirq Softirq can interrupt ongoing packet from process context that is walking over the percpu area that contains inner header offsets. Disable bh and perform three checks before restoring the percpu inner header offsets to validate that the percpu area is valid for this skbuff: 1) If the NFT_PKTINFO_INNER_FULL flag is set on, then this skbuff has already been parsed before for inner header fetching to register. 2) Validate that the percpu area refers to this skbuff using the skbuff pointer as a cookie. If there is a cookie mismatch, then this skbuff needs to be parsed again. 3) Finally, validate if the percpu area refers to this tunnel type. Only after these three checks the percpu area is restored to a on-stack copy and bh is enabled again. After inner header fetching, the on-stack copy is stored back to the percpu area.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.002 (12.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 12th percentile — 12.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: 0.000
Affected products
- Linux — versions 3a07327d10a09379315c844c63f27941f5081e0a, 6.2, 0
- Linux Kernel — versions 6.13
Public proof-of-concept exploits
References
Frequently asked questions
- What is CVE-2024-56638?
- CVE-2024-56638 is a high-severity vulnerability in Linux. CVSS score: 7.8/10. Published 2024-12-27.
- How severe is CVE-2024-56638?
- High severity. CVSS v3 base score is 7.8 out of 10.
- Is CVE-2024-56638 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.