{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-46855", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-09-11T15:12:18.291Z", "datePublished": "2024-09-27T12:42:47.281Z", "dateUpdated": "2026-08-05T11:39:02.124Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:39:02.124Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_socket: fix sk refcount leaks\n\nWe must put 'sk' reference before returning." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:N - The leak occurs in `nft_socket_eval()`, the per-packet evaluation path invoked from the PREROUTING/INPUT netfilter hooks, and is driven entirely by attacker-supplied packet headers — `NF_INET_PRE_ROUTING` runs before early demux, so every received packet performs the refcounted socket lookup that is then leaked. A remote, off-host attacker sending TCP/UDP traffic at a firewall or router whose ruleset uses the `socket mark`/`wildcard`/`cgroupv2` expression reaches the defect with no local access.\nAC:L - The attacker creates every precondition themselves: opening and closing a TCP connection leaves a TIME_WAIT sock, and a bare SYN leaves a NEW_SYN_RECV request sock, both of which fail `sk_fullsock()` so each subsequent packet matching that tuple deterministically leaks a reference. There is no race, no memory-layout dependency, and no reliance on victim state — the leak is reproducible on every packet.\nPR:N - No credential, account, or capability on the target is needed; an unauthenticated remote host only has to emit packets that traverse the affected chain. The rule that reaches the expression is installed by the administrator, not the attacker, so nothing about the attacker's own privilege level gates the code path.\nUI:N - Rule evaluation happens automatically for every packet traversing the hook; no administrator or victim must open a file, mount anything, or take any action for the attacker's traffic to leak references.\nS:U - The leaked `struct sock`/`request_sock` objects and the resulting memory exhaustion are entirely within the kernel's own security authority in the nf_tables engine; no VM, IOMMU, or sandbox boundary is crossed.\nC:N - The missed `sock_gen_put()` neither reads out of bounds nor copies kernel memory anywhere the attacker can observe; the only kernel-address disclosure is the `refcount_warn_saturate()` splat in the target's dmesg, which the remote attacker cannot read. No data is exposed to the attacker.\nI:N - All three leaking paths set `NFT_BREAK` exactly as the fixed code does, so packet classification and the enforced ruleset are identical before and after the fix. Nothing is written out of bounds and `refcount_t` saturates rather than wrapping, so no use-after-free or write primitive arises.\nA:H - Every matching packet permanently leaks a socket object — leaked `reqsk`s also pin their listener and leaked full sockets pin their entire net namespace — giving an unauthenticated remote attacker an unbounded, self-paced kernel memory exhaustion primitive that ends in OOM and total loss of service. Sustained traffic against a single long-lived socket additionally drives `sk_refcnt` to `refcount_t` saturation, producing a WARN that panics the kernel outright on the `panic_on_warn=1` configurations standard in hardened, cloud, and CI fleets." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/netfilter/nft_socket.c" ], "versions": [ { "version": "039b1f4f24ecc8493b6bb9d70b4b78750d1b35c2", "lessThan": "076d281e90aaf4192799ecb9a1ed82321e133ecd", "status": "affected", "versionType": "git" }, { "version": "039b1f4f24ecc8493b6bb9d70b4b78750d1b35c2", "lessThan": "6572440f78b724c46070841a68254ebc534cde24", "status": "affected", "versionType": "git" }, { "version": "039b1f4f24ecc8493b6bb9d70b4b78750d1b35c2", "lessThan": "ddc7c423c4a5386bf865474c694b48178efd311a", "status": "affected", "versionType": "git" }, { "version": "039b1f4f24ecc8493b6bb9d70b4b78750d1b35c2", "lessThan": "33c2258bf8cb17fba9e58b111d4c4f4cf43a4896", "status": "affected", "versionType": "git" }, { "version": "039b1f4f24ecc8493b6bb9d70b4b78750d1b35c2", "lessThan": "83e6fb59040e8964888afcaa5612cc1243736715", "status": "affected", "versionType": "git" }, { "version": "039b1f4f24ecc8493b6bb9d70b4b78750d1b35c2", "lessThan": "1f68e097e20d3c695281a9c6433acc37be47fe11", "status": "affected", "versionType": "git" }, { "version": "039b1f4f24ecc8493b6bb9d70b4b78750d1b35c2", "lessThan": "8b26ff7af8c32cb4148b3e147c52f9e4c695209c", "status": "affected", "versionType": "git" }, { "version": "6934809432d23e9e0081f82d882b8fc765deeb4a", "status": "affected", "versionType": "git" }, { "version": "f63432cd1bb224f61216e4a4726ff29ddffbed98", "status": "affected", "versionType": "git" }, { "version": "4.19.76", "lessThan": "4.20", "status": "affected", "versionType": "semver" }, { "version": "5.2.18", "lessThan": "5.3", "status": "affected", "versionType": "semver" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/netfilter/nft_socket.c" ], "versions": [ { "version": "5.3", "status": "affected" }, { "version": "0", "lessThan": "5.3", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.295", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.239", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.168", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.111", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.52", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.10.11", "lessThanOrEqual": "6.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.11", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3", "versionEndExcluding": "5.4.295" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3", "versionEndExcluding": "5.10.239" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3", "versionEndExcluding": "5.15.168" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3", "versionEndExcluding": "6.1.111" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3", "versionEndExcluding": "6.6.52" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3", "versionEndExcluding": "6.10.11" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3", "versionEndExcluding": "6.11" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19.76" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2.18" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/076d281e90aaf4192799ecb9a1ed82321e133ecd" }, { "url": "https://git.kernel.org/stable/c/6572440f78b724c46070841a68254ebc534cde24" }, { "url": "https://git.kernel.org/stable/c/ddc7c423c4a5386bf865474c694b48178efd311a" }, { "url": "https://git.kernel.org/stable/c/33c2258bf8cb17fba9e58b111d4c4f4cf43a4896" }, { "url": "https://git.kernel.org/stable/c/83e6fb59040e8964888afcaa5612cc1243736715" }, { "url": "https://git.kernel.org/stable/c/1f68e097e20d3c695281a9c6433acc37be47fe11" }, { "url": "https://git.kernel.org/stable/c/8b26ff7af8c32cb4148b3e147c52f9e4c695209c" } ], "title": "netfilter: nft_socket: fix sk refcount leaks", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2024-09-29T13:58:06.943532Z", "id": "CVE-2024-46855", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-29T13:58:11.133Z" } }, { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:19:41.790Z" } } ] } }