GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-40954 (GCVE-0-2024-40954)

Vulnerability from cvelistv5 – Published: 2024-07-12 12:31 – Updated: 2026-08-05 11:34
VLAI
Title
net: do not leave a dangling sk pointer, when socket creation fails
Summary
In the Linux kernel, the following vulnerability has been resolved: net: do not leave a dangling sk pointer, when socket creation fails It is possible to trigger a use-after-free by: * attaching an fentry probe to __sock_release() and the probe calling the bpf_get_socket_cookie() helper * running traceroute -I 1.1.1.1 on a freshly booted VM A KASAN enabled kernel will log something like below (decoded and stripped): ================================================================== BUG: KASAN: slab-use-after-free in __sock_gen_cookie (./arch/x86/include/asm/atomic64_64.h:15 ./include/linux/atomic/atomic-arch-fallback.h:2583 ./include/linux/atomic/atomic-instrumented.h:1611 net/core/sock_diag.c:29) Read of size 8 at addr ffff888007110dd8 by task traceroute/299 CPU: 2 PID: 299 Comm: traceroute Tainted: G E 6.10.0-rc2+ #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 Call Trace: <TASK> dump_stack_lvl (lib/dump_stack.c:117 (discriminator 1)) print_report (mm/kasan/report.c:378 mm/kasan/report.c:488) ? __sock_gen_cookie (./arch/x86/include/asm/atomic64_64.h:15 ./include/linux/atomic/atomic-arch-fallback.h:2583 ./include/linux/atomic/atomic-instrumented.h:1611 net/core/sock_diag.c:29) kasan_report (mm/kasan/report.c:603) ? __sock_gen_cookie (./arch/x86/include/asm/atomic64_64.h:15 ./include/linux/atomic/atomic-arch-fallback.h:2583 ./include/linux/atomic/atomic-instrumented.h:1611 net/core/sock_diag.c:29) kasan_check_range (mm/kasan/generic.c:183 mm/kasan/generic.c:189) __sock_gen_cookie (./arch/x86/include/asm/atomic64_64.h:15 ./include/linux/atomic/atomic-arch-fallback.h:2583 ./include/linux/atomic/atomic-instrumented.h:1611 net/core/sock_diag.c:29) bpf_get_socket_ptr_cookie (./arch/x86/include/asm/preempt.h:94 ./include/linux/sock_diag.h:42 net/core/filter.c:5094 net/core/filter.c:5092) bpf_prog_875642cf11f1d139___sock_release+0x6e/0x8e bpf_trampoline_6442506592+0x47/0xaf __sock_release (net/socket.c:652) __sock_create (net/socket.c:1601) ... Allocated by task 299 on cpu 2 at 78.328492s: kasan_save_stack (mm/kasan/common.c:48) kasan_save_track (mm/kasan/common.c:68) __kasan_slab_alloc (mm/kasan/common.c:312 mm/kasan/common.c:338) kmem_cache_alloc_noprof (mm/slub.c:3941 mm/slub.c:4000 mm/slub.c:4007) sk_prot_alloc (net/core/sock.c:2075) sk_alloc (net/core/sock.c:2134) inet_create (net/ipv4/af_inet.c:327 net/ipv4/af_inet.c:252) __sock_create (net/socket.c:1572) __sys_socket (net/socket.c:1660 net/socket.c:1644 net/socket.c:1706) __x64_sys_socket (net/socket.c:1718) do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) Freed by task 299 on cpu 2 at 78.328502s: kasan_save_stack (mm/kasan/common.c:48) kasan_save_track (mm/kasan/common.c:68) kasan_save_free_info (mm/kasan/generic.c:582) poison_slab_object (mm/kasan/common.c:242) __kasan_slab_free (mm/kasan/common.c:256) kmem_cache_free (mm/slub.c:4437 mm/slub.c:4511) __sk_destruct (net/core/sock.c:2117 net/core/sock.c:2208) inet_create (net/ipv4/af_inet.c:397 net/ipv4/af_inet.c:252) __sock_create (net/socket.c:1572) __sys_socket (net/socket.c:1660 net/socket.c:1644 net/socket.c:1706) __x64_sys_socket (net/socket.c:1718) do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) Fix this by clearing the struct socket reference in sk_common_release() to cover all protocol families create functions, which may already attached the reference to the sk object with sock_init_data().
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 17:03 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: c5dbb89fc2ac013afe67b9e4fcb3743c02b567cd , < 78e4aa528a7b1204219d808310524344f627d069 (git)
Affected: c5dbb89fc2ac013afe67b9e4fcb3743c02b567cd , < 893eeba94c40d513cd0fe6539330ebdaea208c0e (git)
Affected: c5dbb89fc2ac013afe67b9e4fcb3743c02b567cd , < 454c454ed645fed051216b79622f7cb69c1638f5 (git)
Affected: c5dbb89fc2ac013afe67b9e4fcb3743c02b567cd , < 5dfe2408fd7dc4d2e7ac38a116ff0a37b1cfd3b9 (git)
Affected: c5dbb89fc2ac013afe67b9e4fcb3743c02b567cd , < 6cd4a78d962bebbaf8beb7d2ead3f34120e3f7b2 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.12
Unaffected: 0 , < 5.12 (semver)
Unaffected: 5.15.162 , ≤ 5.15.* (semver)
Unaffected: 6.1.96 , ≤ 6.1.* (semver)
Unaffected: 6.6.36 , ≤ 6.6.* (semver)
Unaffected: 6.9.7 , ≤ 6.9.* (semver)
Unaffected: 6.10 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T21:58:18.562Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/78e4aa528a7b1204219d808310524344f627d069"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/893eeba94c40d513cd0fe6539330ebdaea208c0e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/454c454ed645fed051216b79622f7cb69c1638f5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/5dfe2408fd7dc4d2e7ac38a116ff0a37b1cfd3b9"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/6cd4a78d962bebbaf8beb7d2ead3f34120e3f7b2"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-40954",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:03:48.944366Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:24.382Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/sock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "78e4aa528a7b1204219d808310524344f627d069",
              "status": "affected",
              "version": "c5dbb89fc2ac013afe67b9e4fcb3743c02b567cd",
              "versionType": "git"
            },
            {
              "lessThan": "893eeba94c40d513cd0fe6539330ebdaea208c0e",
              "status": "affected",
              "version": "c5dbb89fc2ac013afe67b9e4fcb3743c02b567cd",
              "versionType": "git"
            },
            {
              "lessThan": "454c454ed645fed051216b79622f7cb69c1638f5",
              "status": "affected",
              "version": "c5dbb89fc2ac013afe67b9e4fcb3743c02b567cd",
              "versionType": "git"
            },
            {
              "lessThan": "5dfe2408fd7dc4d2e7ac38a116ff0a37b1cfd3b9",
              "status": "affected",
              "version": "c5dbb89fc2ac013afe67b9e4fcb3743c02b567cd",
              "versionType": "git"
            },
            {
              "lessThan": "6cd4a78d962bebbaf8beb7d2ead3f34120e3f7b2",
              "status": "affected",
              "version": "c5dbb89fc2ac013afe67b9e4fcb3743c02b567cd",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/sock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.12"
            },
            {
              "lessThan": "5.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.162",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.162",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.96",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.36",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.7",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: do not leave a dangling sk pointer, when socket creation fails\n\nIt is possible to trigger a use-after-free by:\n  * attaching an fentry probe to __sock_release() and the probe calling the\n    bpf_get_socket_cookie() helper\n  * running traceroute -I 1.1.1.1 on a freshly booted VM\n\nA KASAN enabled kernel will log something like below (decoded and stripped):\n==================================================================\nBUG: KASAN: slab-use-after-free in __sock_gen_cookie (./arch/x86/include/asm/atomic64_64.h:15 ./include/linux/atomic/atomic-arch-fallback.h:2583 ./include/linux/atomic/atomic-instrumented.h:1611 net/core/sock_diag.c:29)\nRead of size 8 at addr ffff888007110dd8 by task traceroute/299\n\nCPU: 2 PID: 299 Comm: traceroute Tainted: G            E      6.10.0-rc2+ #2\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014\nCall Trace:\n \u003cTASK\u003e\ndump_stack_lvl (lib/dump_stack.c:117 (discriminator 1))\nprint_report (mm/kasan/report.c:378 mm/kasan/report.c:488)\n? __sock_gen_cookie (./arch/x86/include/asm/atomic64_64.h:15 ./include/linux/atomic/atomic-arch-fallback.h:2583 ./include/linux/atomic/atomic-instrumented.h:1611 net/core/sock_diag.c:29)\nkasan_report (mm/kasan/report.c:603)\n? __sock_gen_cookie (./arch/x86/include/asm/atomic64_64.h:15 ./include/linux/atomic/atomic-arch-fallback.h:2583 ./include/linux/atomic/atomic-instrumented.h:1611 net/core/sock_diag.c:29)\nkasan_check_range (mm/kasan/generic.c:183 mm/kasan/generic.c:189)\n__sock_gen_cookie (./arch/x86/include/asm/atomic64_64.h:15 ./include/linux/atomic/atomic-arch-fallback.h:2583 ./include/linux/atomic/atomic-instrumented.h:1611 net/core/sock_diag.c:29)\nbpf_get_socket_ptr_cookie (./arch/x86/include/asm/preempt.h:94 ./include/linux/sock_diag.h:42 net/core/filter.c:5094 net/core/filter.c:5092)\nbpf_prog_875642cf11f1d139___sock_release+0x6e/0x8e\nbpf_trampoline_6442506592+0x47/0xaf\n__sock_release (net/socket.c:652)\n__sock_create (net/socket.c:1601)\n...\nAllocated by task 299 on cpu 2 at 78.328492s:\nkasan_save_stack (mm/kasan/common.c:48)\nkasan_save_track (mm/kasan/common.c:68)\n__kasan_slab_alloc (mm/kasan/common.c:312 mm/kasan/common.c:338)\nkmem_cache_alloc_noprof (mm/slub.c:3941 mm/slub.c:4000 mm/slub.c:4007)\nsk_prot_alloc (net/core/sock.c:2075)\nsk_alloc (net/core/sock.c:2134)\ninet_create (net/ipv4/af_inet.c:327 net/ipv4/af_inet.c:252)\n__sock_create (net/socket.c:1572)\n__sys_socket (net/socket.c:1660 net/socket.c:1644 net/socket.c:1706)\n__x64_sys_socket (net/socket.c:1718)\ndo_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83)\nentry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n\nFreed by task 299 on cpu 2 at 78.328502s:\nkasan_save_stack (mm/kasan/common.c:48)\nkasan_save_track (mm/kasan/common.c:68)\nkasan_save_free_info (mm/kasan/generic.c:582)\npoison_slab_object (mm/kasan/common.c:242)\n__kasan_slab_free (mm/kasan/common.c:256)\nkmem_cache_free (mm/slub.c:4437 mm/slub.c:4511)\n__sk_destruct (net/core/sock.c:2117 net/core/sock.c:2208)\ninet_create (net/ipv4/af_inet.c:397 net/ipv4/af_inet.c:252)\n__sock_create (net/socket.c:1572)\n__sys_socket (net/socket.c:1660 net/socket.c:1644 net/socket.c:1706)\n__x64_sys_socket (net/socket.c:1718)\ndo_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83)\nentry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n\nFix this by clearing the struct socket reference in sk_common_release() to cover\nall protocol families create functions, which may already attached the\nreference to the sk object with sock_init_data()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The dangling pointer is created by the local `socket(2)` syscall reaching `__sock_create()` \u2192 `inet_create()` and failing after `sock_init_data()`; no packet or remote peer data is involved in reaching the vulnerable code. The dereference likewise happens in the syscalling task\u0027s own context.\nAC:L - `ping_init_sock()` returns -EACCES for every user under the kernel-default empty `ping_group_range` ([1,0]), so `socket(AF_INET, SOCK_DGRAM, IPPROTO_ICMP)` frees `sk` and leaves `sock-\u003esk` dangling deterministically on every attempt, with no race to win and no memory layout outside the attacker\u0027s influence. On a target running the socket-lifecycle eBPF instrumentation that constitutes the vulnerable configuration, the freed-object access follows unconditionally.\nPR:L - Any ordinary unprivileged local account \u2014 including an unprivileged container tenant \u2014 can issue the failing `socket()` call; there is no capability check, no user-namespace requirement, and even `traceroute` run by a normal user triggers it. The privileges needed to install the tracing probe belong to the host\u0027s monitoring stack, not to the attacker.\nUI:N - The attacker performs the entire sequence with a single syscall from their own process; no other user must open a file, mount anything, or take any action.\nS:U - The freed `struct sock` and the corrupting access are both inside the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is a slab use-after-free read of the freed `struct sock` (`atomic64_read(\u0026sk-\u003esk_cookie)` at a controllable offset into a reallocated object), and the value read is returned to the reader \u2014 a UAF read of kernel heap contents that can disclose whatever has been sprayed into the reclaimed slot.\nI:H - `__sock_gen_cookie()` does not merely read: with `sk_cookie == 0` it performs an `atomic64_cmpxchg()`, writing 8 bytes into the freed object, so a reallocated victim structure occupying that slot is corrupted at a fixed offset. A use-after-free write into sprayed heap memory is a real corruption primitive with control-flow-hijack potential.\nA:H - The use-after-free reliably produces KASAN slab-use-after-free reports and, on a production kernel, corrupts arbitrary reclaimed slab objects, causing oopses and panics; the trigger can be repeated in a tight loop by an unprivileged user."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:34:13.912Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/78e4aa528a7b1204219d808310524344f627d069"
        },
        {
          "url": "https://git.kernel.org/stable/c/893eeba94c40d513cd0fe6539330ebdaea208c0e"
        },
        {
          "url": "https://git.kernel.org/stable/c/454c454ed645fed051216b79622f7cb69c1638f5"
        },
        {
          "url": "https://git.kernel.org/stable/c/5dfe2408fd7dc4d2e7ac38a116ff0a37b1cfd3b9"
        },
        {
          "url": "https://git.kernel.org/stable/c/6cd4a78d962bebbaf8beb7d2ead3f34120e3f7b2"
        }
      ],
      "title": "net: do not leave a dangling sk pointer, when socket creation fails",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-40954",
    "datePublished": "2024-07-12T12:31:57.517Z",
    "dateReserved": "2024-07-12T12:17:45.592Z",
    "dateUpdated": "2026-08-05T11:34:13.912Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-40954",
      "date": "2026-09-16",
      "epss": "0.00258",
      "percentile": "0.17624"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.12\", \"versionEndExcluding\": \"5.15.162\", \"matchCriteriaId\": \"BD852924-11EF-4EBB-B88D-50A6300754D3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.16\", \"versionEndExcluding\": \"6.1.96\", \"matchCriteriaId\": \"61E887B4-732A-40D2-9983-CC6F281EBFB7\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.2\", \"versionEndExcluding\": \"6.6.36\", \"matchCriteriaId\": \"E1046C95-860A-45B0-B718-2B29F65BFF10\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.9.7\", \"matchCriteriaId\": \"0A047AF2-94AC-4A3A-B32D-6AB930D8EF1C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.10:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"2EBB4392-5FA6-4DA9-9772-8F9C750109FA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.10:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"331C2F14-12C7-45D5-893D-8C52EE38EA10\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.10:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"3173713D-909A-4DD3-9DD4-1E171EB057EE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.10:rc4:*:*:*:*:*:*\", \"matchCriteriaId\": \"79F18AFA-40F7-43F0-BA30-7BDB65F918B9\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: do not leave a dangling sk pointer, when socket creation fails\\n\\nIt is possible to trigger a use-after-free by:\\n  * attaching an fentry probe to __sock_release() and the probe calling the\\n    bpf_get_socket_cookie() helper\\n  * running traceroute -I 1.1.1.1 on a freshly booted VM\\n\\nA KASAN enabled kernel will log something like below (decoded and stripped):\\n==================================================================\\nBUG: KASAN: slab-use-after-free in __sock_gen_cookie (./arch/x86/include/asm/atomic64_64.h:15 ./include/linux/atomic/atomic-arch-fallback.h:2583 ./include/linux/atomic/atomic-instrumented.h:1611 net/core/sock_diag.c:29)\\nRead of size 8 at addr ffff888007110dd8 by task traceroute/299\\n\\nCPU: 2 PID: 299 Comm: traceroute Tainted: G            E      6.10.0-rc2+ #2\\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014\\nCall Trace:\\n \u003cTASK\u003e\\ndump_stack_lvl (lib/dump_stack.c:117 (discriminator 1))\\nprint_report (mm/kasan/report.c:378 mm/kasan/report.c:488)\\n? __sock_gen_cookie (./arch/x86/include/asm/atomic64_64.h:15 ./include/linux/atomic/atomic-arch-fallback.h:2583 ./include/linux/atomic/atomic-instrumented.h:1611 net/core/sock_diag.c:29)\\nkasan_report (mm/kasan/report.c:603)\\n? __sock_gen_cookie (./arch/x86/include/asm/atomic64_64.h:15 ./include/linux/atomic/atomic-arch-fallback.h:2583 ./include/linux/atomic/atomic-instrumented.h:1611 net/core/sock_diag.c:29)\\nkasan_check_range (mm/kasan/generic.c:183 mm/kasan/generic.c:189)\\n__sock_gen_cookie (./arch/x86/include/asm/atomic64_64.h:15 ./include/linux/atomic/atomic-arch-fallback.h:2583 ./include/linux/atomic/atomic-instrumented.h:1611 net/core/sock_diag.c:29)\\nbpf_get_socket_ptr_cookie (./arch/x86/include/asm/preempt.h:94 ./include/linux/sock_diag.h:42 net/core/filter.c:5094 net/core/filter.c:5092)\\nbpf_prog_875642cf11f1d139___sock_release+0x6e/0x8e\\nbpf_trampoline_6442506592+0x47/0xaf\\n__sock_release (net/socket.c:652)\\n__sock_create (net/socket.c:1601)\\n...\\nAllocated by task 299 on cpu 2 at 78.328492s:\\nkasan_save_stack (mm/kasan/common.c:48)\\nkasan_save_track (mm/kasan/common.c:68)\\n__kasan_slab_alloc (mm/kasan/common.c:312 mm/kasan/common.c:338)\\nkmem_cache_alloc_noprof (mm/slub.c:3941 mm/slub.c:4000 mm/slub.c:4007)\\nsk_prot_alloc (net/core/sock.c:2075)\\nsk_alloc (net/core/sock.c:2134)\\ninet_create (net/ipv4/af_inet.c:327 net/ipv4/af_inet.c:252)\\n__sock_create (net/socket.c:1572)\\n__sys_socket (net/socket.c:1660 net/socket.c:1644 net/socket.c:1706)\\n__x64_sys_socket (net/socket.c:1718)\\ndo_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83)\\nentry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\\n\\nFreed by task 299 on cpu 2 at 78.328502s:\\nkasan_save_stack (mm/kasan/common.c:48)\\nkasan_save_track (mm/kasan/common.c:68)\\nkasan_save_free_info (mm/kasan/generic.c:582)\\npoison_slab_object (mm/kasan/common.c:242)\\n__kasan_slab_free (mm/kasan/common.c:256)\\nkmem_cache_free (mm/slub.c:4437 mm/slub.c:4511)\\n__sk_destruct (net/core/sock.c:2117 net/core/sock.c:2208)\\ninet_create (net/ipv4/af_inet.c:397 net/ipv4/af_inet.c:252)\\n__sock_create (net/socket.c:1572)\\n__sys_socket (net/socket.c:1660 net/socket.c:1644 net/socket.c:1706)\\n__x64_sys_socket (net/socket.c:1718)\\ndo_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83)\\nentry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\\n\\nFix this by clearing the struct socket reference in sk_common_release() to cover\\nall protocol families create functions, which may already attached the\\nreference to the sk object with sock_init_data().\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: no deja un puntero sk colgando cuando falla la creaci\\u00f3n del socket. Es posible activar un use-after-free: * adjuntando una sonda fentry a __sock_release() y el sonda que llama al asistente bpf_get_socket_cookie() * ejecuta traceroute -I 1.1.1.1 en una m\\u00e1quina virtual reci\\u00e9n iniciada. Un kernel habilitado para KASAN registrar\\u00e1 algo como lo siguiente (decodificado y eliminado): =============== ==================================================== = ERROR: KASAN: slab-use-after-free en __sock_gen_cookie (./arch/x86/include/asm/atomic64_64.h:15 ./include/linux/atomic/atomic-arch-fallback.h:2583 ./include /linux/atomic/atomic-instrumented.h:1611 net/core/sock_diag.c:29) Lectura de tama\\u00f1o 8 en la direcci\\u00f3n ffff888007110dd8 mediante tarea traceroute/299 CPU: 2 PID: 299 Comm: traceroute Contaminado: GE 6.10.0- rc2+ #2 Nombre del hardware: PC est\\u00e1ndar QEMU (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 01/04/2014 Seguimiento de llamadas:  dump_stack_lvl (lib/dump_stack.c:117 ( discriminador 1)) print_report (mm/kasan/report.c:378 mm/kasan/report.c:488)? __sock_gen_cookie (./arch/x86/include/asm/atomic64_64.h:15 ./include/linux/atomic/atomic-arch-fallback.h:2583 ./include/linux/atomic/atomic-instrumented.h:1611 neto /core/sock_diag.c:29) kasan_report (mm/kasan/report.c:603)? __sock_gen_cookie (./arch/x86/include/asm/atomic64_64.h:15 ./include/linux/atomic/atomic-arch-fallback.h:2583 ./include/linux/atomic/atomic-instrumented.h:1611 neto /core/sock_diag.c:29) kasan_check_range (mm/kasan/generic.c:183 mm/kasan/generic.c:189) __sock_gen_cookie (./arch/x86/include/asm/atomic64_64.h:15 ./include /linux/atomic/atomic-arch-fallback.h:2583 ./include/linux/atomic/atomic-instrumented.h:1611 net/core/sock_diag.c:29) bpf_get_socket_ptr_cookie (./arch/x86/include/asm /preempt.h:94 ./include/linux/sock_diag.h:42 net/core/filter.c:5094 net/core/filter.c:5092) bpf_prog_875642cf11f1d139___sock_release+0x6e/0x8e bpf_trampoline_6442506592+0x47/0xaf __ calcet\\u00edn_release (net/ socket.c:652) __sock_create (net/socket.c:1601) ... Asignado por la tarea 299 en la CPU 2 en 78.328492s: kasan_save_stack (mm/kasan/common.c:48) kasan_save_track (mm/kasan/common. c:68) __kasan_slab_alloc (mm/kasan/common.c:312 mm/kasan/common.c:338) kmem_cache_alloc_noprof (mm/slub.c:3941 mm/slub.c:4000 mm/slub.c:4007) sk_prot_alloc (net/core/sock.c:2075) sk_alloc (net/core/sock.c:2134) inet_create (net/ipv4/af_inet.c:327 net/ipv4/af_inet.c:252) __sock_create (net/socket. c:1572) __sys_socket (net/socket.c:1660 net/socket.c:1644 net/socket.c:1706) __x64_sys_socket (net/socket.c:1718) do_syscall_64 (arch/x86/entry/common.c: 52 arch/x86/entry/common.c:83) Entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) Liberado por la tarea 299 en la CPU 2 a las 78.328502s: kasan_save_stack (mm/kasan/common.c:48) kasan_save_track (mm/kasan/common.c:68) kasan_save_free_info (mm/kasan/generic.c:582) veneno_slab_object (mm/kasan/common.c:242) __kasan_slab_free (mm/kasan/common.c:256) kmem_cache_free ( mm/slub.c:4437 mm/slub.c:4511) __sk_destruct (net/core/sock.c:2117 net/core/sock.c:2208) inet_create (net/ipv4/af_inet.c:397 net/ipv4 /af_inet.c:252) __sock_create (net/socket.c:1572) __sys_socket (net/socket.c:1660 net/socket.c:1644 net/socket.c:1706) __x64_sys_socket (net/socket.c:1718 ) do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) Entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) Solucione este problema borrando la referencia del socket de estructura en sk_common_release () para cubrir todas las familias de protocolos, cree funciones, que pueden ya adjuntar la referencia al objeto sk con sock_init_data().\"}]",
      "id": "CVE-2024-40954",
      "lastModified": "2024-11-21T09:31:56.400",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}]}",
      "published": "2024-07-12T13:15:17.627",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/454c454ed645fed051216b79622f7cb69c1638f5\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/5dfe2408fd7dc4d2e7ac38a116ff0a37b1cfd3b9\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/6cd4a78d962bebbaf8beb7d2ead3f34120e3f7b2\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/78e4aa528a7b1204219d808310524344f627d069\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/893eeba94c40d513cd0fe6539330ebdaea208c0e\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/454c454ed645fed051216b79622f7cb69c1638f5\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/5dfe2408fd7dc4d2e7ac38a116ff0a37b1cfd3b9\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/6cd4a78d962bebbaf8beb7d2ead3f34120e3f7b2\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/78e4aa528a7b1204219d808310524344f627d069\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/893eeba94c40d513cd0fe6539330ebdaea208c0e\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-416\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-40954\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-07-12T13:15:17.627\",\"lastModified\":\"2026-08-04T11:19:09.170\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: do not leave a dangling sk pointer, when socket creation fails\\n\\nIt is possible to trigger a use-after-free by:\\n  * attaching an fentry probe to __sock_release() and the probe calling the\\n    bpf_get_socket_cookie() helper\\n  * running traceroute -I 1.1.1.1 on a freshly booted VM\\n\\nA KASAN enabled kernel will log something like below (decoded and stripped):\\n==================================================================\\nBUG: KASAN: slab-use-after-free in __sock_gen_cookie (./arch/x86/include/asm/atomic64_64.h:15 ./include/linux/atomic/atomic-arch-fallback.h:2583 ./include/linux/atomic/atomic-instrumented.h:1611 net/core/sock_diag.c:29)\\nRead of size 8 at addr ffff888007110dd8 by task traceroute/299\\n\\nCPU: 2 PID: 299 Comm: traceroute Tainted: G            E      6.10.0-rc2+ #2\\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014\\nCall Trace:\\n \u003cTASK\u003e\\ndump_stack_lvl (lib/dump_stack.c:117 (discriminator 1))\\nprint_report (mm/kasan/report.c:378 mm/kasan/report.c:488)\\n? __sock_gen_cookie (./arch/x86/include/asm/atomic64_64.h:15 ./include/linux/atomic/atomic-arch-fallback.h:2583 ./include/linux/atomic/atomic-instrumented.h:1611 net/core/sock_diag.c:29)\\nkasan_report (mm/kasan/report.c:603)\\n? __sock_gen_cookie (./arch/x86/include/asm/atomic64_64.h:15 ./include/linux/atomic/atomic-arch-fallback.h:2583 ./include/linux/atomic/atomic-instrumented.h:1611 net/core/sock_diag.c:29)\\nkasan_check_range (mm/kasan/generic.c:183 mm/kasan/generic.c:189)\\n__sock_gen_cookie (./arch/x86/include/asm/atomic64_64.h:15 ./include/linux/atomic/atomic-arch-fallback.h:2583 ./include/linux/atomic/atomic-instrumented.h:1611 net/core/sock_diag.c:29)\\nbpf_get_socket_ptr_cookie (./arch/x86/include/asm/preempt.h:94 ./include/linux/sock_diag.h:42 net/core/filter.c:5094 net/core/filter.c:5092)\\nbpf_prog_875642cf11f1d139___sock_release+0x6e/0x8e\\nbpf_trampoline_6442506592+0x47/0xaf\\n__sock_release (net/socket.c:652)\\n__sock_create (net/socket.c:1601)\\n...\\nAllocated by task 299 on cpu 2 at 78.328492s:\\nkasan_save_stack (mm/kasan/common.c:48)\\nkasan_save_track (mm/kasan/common.c:68)\\n__kasan_slab_alloc (mm/kasan/common.c:312 mm/kasan/common.c:338)\\nkmem_cache_alloc_noprof (mm/slub.c:3941 mm/slub.c:4000 mm/slub.c:4007)\\nsk_prot_alloc (net/core/sock.c:2075)\\nsk_alloc (net/core/sock.c:2134)\\ninet_create (net/ipv4/af_inet.c:327 net/ipv4/af_inet.c:252)\\n__sock_create (net/socket.c:1572)\\n__sys_socket (net/socket.c:1660 net/socket.c:1644 net/socket.c:1706)\\n__x64_sys_socket (net/socket.c:1718)\\ndo_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83)\\nentry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\\n\\nFreed by task 299 on cpu 2 at 78.328502s:\\nkasan_save_stack (mm/kasan/common.c:48)\\nkasan_save_track (mm/kasan/common.c:68)\\nkasan_save_free_info (mm/kasan/generic.c:582)\\npoison_slab_object (mm/kasan/common.c:242)\\n__kasan_slab_free (mm/kasan/common.c:256)\\nkmem_cache_free (mm/slub.c:4437 mm/slub.c:4511)\\n__sk_destruct (net/core/sock.c:2117 net/core/sock.c:2208)\\ninet_create (net/ipv4/af_inet.c:397 net/ipv4/af_inet.c:252)\\n__sock_create (net/socket.c:1572)\\n__sys_socket (net/socket.c:1660 net/socket.c:1644 net/socket.c:1706)\\n__x64_sys_socket (net/socket.c:1718)\\ndo_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83)\\nentry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\\n\\nFix this by clearing the struct socket reference in sk_common_release() to cover\\nall protocol families create functions, which may already attached the\\nreference to the sk object with sock_init_data().\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: no deja un puntero sk colgando cuando falla la creaci\u00f3n del socket. Es posible activar un use-after-free: * adjuntando una sonda fentry a __sock_release() y el sonda que llama al asistente bpf_get_socket_cookie() * ejecuta traceroute -I 1.1.1.1 en una m\u00e1quina virtual reci\u00e9n iniciada. Un kernel habilitado para KASAN registrar\u00e1 algo como lo siguiente (decodificado y eliminado): =============== ==================================================== = ERROR: KASAN: slab-use-after-free en __sock_gen_cookie (./arch/x86/include/asm/atomic64_64.h:15 ./include/linux/atomic/atomic-arch-fallback.h:2583 ./include /linux/atomic/atomic-instrumented.h:1611 net/core/sock_diag.c:29) Lectura de tama\u00f1o 8 en la direcci\u00f3n ffff888007110dd8 mediante tarea traceroute/299 CPU: 2 PID: 299 Comm: traceroute Contaminado: GE 6.10.0- rc2+ #2 Nombre del hardware: PC est\u00e1ndar QEMU (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 01/04/2014 Seguimiento de llamadas:  dump_stack_lvl (lib/dump_stack.c:117 ( discriminador 1)) print_report (mm/kasan/report.c:378 mm/kasan/report.c:488)? __sock_gen_cookie (./arch/x86/include/asm/atomic64_64.h:15 ./include/linux/atomic/atomic-arch-fallback.h:2583 ./include/linux/atomic/atomic-instrumented.h:1611 neto /core/sock_diag.c:29) kasan_report (mm/kasan/report.c:603)? __sock_gen_cookie (./arch/x86/include/asm/atomic64_64.h:15 ./include/linux/atomic/atomic-arch-fallback.h:2583 ./include/linux/atomic/atomic-instrumented.h:1611 neto /core/sock_diag.c:29) kasan_check_range (mm/kasan/generic.c:183 mm/kasan/generic.c:189) __sock_gen_cookie (./arch/x86/include/asm/atomic64_64.h:15 ./include /linux/atomic/atomic-arch-fallback.h:2583 ./include/linux/atomic/atomic-instrumented.h:1611 net/core/sock_diag.c:29) bpf_get_socket_ptr_cookie (./arch/x86/include/asm /preempt.h:94 ./include/linux/sock_diag.h:42 net/core/filter.c:5094 net/core/filter.c:5092) bpf_prog_875642cf11f1d139___sock_release+0x6e/0x8e bpf_trampoline_6442506592+0x47/0xaf __ calcet\u00edn_release (net/ socket.c:652) __sock_create (net/socket.c:1601) ... Asignado por la tarea 299 en la CPU 2 en 78.328492s: kasan_save_stack (mm/kasan/common.c:48) kasan_save_track (mm/kasan/common. c:68) __kasan_slab_alloc (mm/kasan/common.c:312 mm/kasan/common.c:338) kmem_cache_alloc_noprof (mm/slub.c:3941 mm/slub.c:4000 mm/slub.c:4007) sk_prot_alloc (net/core/sock.c:2075) sk_alloc (net/core/sock.c:2134) inet_create (net/ipv4/af_inet.c:327 net/ipv4/af_inet.c:252) __sock_create (net/socket. c:1572) __sys_socket (net/socket.c:1660 net/socket.c:1644 net/socket.c:1706) __x64_sys_socket (net/socket.c:1718) do_syscall_64 (arch/x86/entry/common.c: 52 arch/x86/entry/common.c:83) Entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) Liberado por la tarea 299 en la CPU 2 a las 78.328502s: kasan_save_stack (mm/kasan/common.c:48) kasan_save_track (mm/kasan/common.c:68) kasan_save_free_info (mm/kasan/generic.c:582) veneno_slab_object (mm/kasan/common.c:242) __kasan_slab_free (mm/kasan/common.c:256) kmem_cache_free ( mm/slub.c:4437 mm/slub.c:4511) __sk_destruct (net/core/sock.c:2117 net/core/sock.c:2208) inet_create (net/ipv4/af_inet.c:397 net/ipv4 /af_inet.c:252) __sock_create (net/socket.c:1572) __sys_socket (net/socket.c:1660 net/socket.c:1644 net/socket.c:1706) __x64_sys_socket (net/socket.c:1718 ) do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) Entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) Solucione este problema borrando la referencia del socket de estructura en sk_common_release () para cubrir todas las familias de protocolos, cree funciones, que pueden ya adjuntar la referencia al objeto sk con sock_init_data().\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/core/sock.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"c5dbb89fc2ac013afe67b9e4fcb3743c02b567cd\",\"lessThan\":\"78e4aa528a7b1204219d808310524344f627d069\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c5dbb89fc2ac013afe67b9e4fcb3743c02b567cd\",\"lessThan\":\"893eeba94c40d513cd0fe6539330ebdaea208c0e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c5dbb89fc2ac013afe67b9e4fcb3743c02b567cd\",\"lessThan\":\"454c454ed645fed051216b79622f7cb69c1638f5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c5dbb89fc2ac013afe67b9e4fcb3743c02b567cd\",\"lessThan\":\"5dfe2408fd7dc4d2e7ac38a116ff0a37b1cfd3b9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c5dbb89fc2ac013afe67b9e4fcb3743c02b567cd\",\"lessThan\":\"6cd4a78d962bebbaf8beb7d2ead3f34120e3f7b2\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/core/sock.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.12\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.12\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.162\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.96\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.36\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9.7\",\"lessThanOrEqual\":\"6.9.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T17:03:48.944366Z\",\"id\":\"CVE-2024-40954\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.12\",\"versionEndExcluding\":\"5.15.162\",\"matchCriteriaId\":\"BD852924-11EF-4EBB-B88D-50A6300754D3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.96\",\"matchCriteriaId\":\"61E887B4-732A-40D2-9983-CC6F281EBFB7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.36\",\"matchCriteriaId\":\"E1046C95-860A-45B0-B718-2B29F65BFF10\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.9.7\",\"matchCriteriaId\":\"0A047AF2-94AC-4A3A-B32D-6AB930D8EF1C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"2EBB4392-5FA6-4DA9-9772-8F9C750109FA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"331C2F14-12C7-45D5-893D-8C52EE38EA10\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"3173713D-909A-4DD3-9DD4-1E171EB057EE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"79F18AFA-40F7-43F0-BA30-7BDB65F918B9\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/454c454ed645fed051216b79622f7cb69c1638f5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5dfe2408fd7dc4d2e7ac38a116ff0a37b1cfd3b9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6cd4a78d962bebbaf8beb7d2ead3f34120e3f7b2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/78e4aa528a7b1204219d808310524344f627d069\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/893eeba94c40d513cd0fe6539330ebdaea208c0e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/454c454ed645fed051216b79622f7cb69c1638f5\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5dfe2408fd7dc4d2e7ac38a116ff0a37b1cfd3b9\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6cd4a78d962bebbaf8beb7d2ead3f34120e3f7b2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/78e4aa528a7b1204219d808310524344f627d069\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/893eeba94c40d513cd0fe6539330ebdaea208c0e\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T18:37:45+00:00",
      "cve": "CVE-2024-40954",
      "id": "CVE-2024-40954",
      "initial_release_date": "2024-07-12T00:00:00+00:00",
      "product_status:fixed": "429",
      "product_status:known_affected": "64",
      "product_status:known_not_affected": "8",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: do not leave a dangling sk pointer, when socket creation fails",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-40954.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-22T01:38:00Z",
      "cve": "CVE-2024-40954",
      "id": "CVE-2024-40954",
      "initial_release_date": "2024-07-16T02:34:21Z",
      "product_status:known_affected": "295",
      "product_status:known_not_affected": "169",
      "product_status:recommended": "938",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-40954",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-40954.json",
      "version": "120"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/78e4aa528a7b1204219d808310524344f627d069\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/893eeba94c40d513cd0fe6539330ebdaea208c0e\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/454c454ed645fed051216b79622f7cb69c1638f5\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/5dfe2408fd7dc4d2e7ac38a116ff0a37b1cfd3b9\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/6cd4a78d962bebbaf8beb7d2ead3f34120e3f7b2\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T21:58:18.562Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-40954\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T17:03:48.944366Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:22.455Z\"}}], \"cna\": {\"title\": \"net: do not leave a dangling sk pointer, when socket creation fails\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The dangling pointer is created by the local `socket(2)` syscall reaching `__sock_create()` \\u2192 `inet_create()` and failing after `sock_init_data()`; no packet or remote peer data is involved in reaching the vulnerable code. The dereference likewise happens in the syscalling task\u0027s own context.\\nAC:L - `ping_init_sock()` returns -EACCES for every user under the kernel-default empty `ping_group_range` ([1,0]), so `socket(AF_INET, SOCK_DGRAM, IPPROTO_ICMP)` frees `sk` and leaves `sock-\u003esk` dangling deterministically on every attempt, with no race to win and no memory layout outside the attacker\u0027s influence. On a target running the socket-lifecycle eBPF instrumentation that constitutes the vulnerable configuration, the freed-object access follows unconditionally.\\nPR:L - Any ordinary unprivileged local account \\u2014 including an unprivileged container tenant \\u2014 can issue the failing `socket()` call; there is no capability check, no user-namespace requirement, and even `traceroute` run by a normal user triggers it. The privileges needed to install the tracing probe belong to the host\u0027s monitoring stack, not to the attacker.\\nUI:N - The attacker performs the entire sequence with a single syscall from their own process; no other user must open a file, mount anything, or take any action.\\nS:U - The freed `struct sock` and the corrupting access are both inside the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\\nC:H - This is a slab use-after-free read of the freed `struct sock` (`atomic64_read(\u0026sk-\u003esk_cookie)` at a controllable offset into a reallocated object), and the value read is returned to the reader \\u2014 a UAF read of kernel heap contents that can disclose whatever has been sprayed into the reclaimed slot.\\nI:H - `__sock_gen_cookie()` does not merely read: with `sk_cookie == 0` it performs an `atomic64_cmpxchg()`, writing 8 bytes into the freed object, so a reallocated victim structure occupying that slot is corrupted at a fixed offset. A use-after-free write into sprayed heap memory is a real corruption primitive with control-flow-hijack potential.\\nA:H - The use-after-free reliably produces KASAN slab-use-after-free reports and, on a production kernel, corrupts arbitrary reclaimed slab objects, causing oopses and panics; the trigger can be repeated in a tight loop by an unprivileged user.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"c5dbb89fc2ac013afe67b9e4fcb3743c02b567cd\", \"lessThan\": \"78e4aa528a7b1204219d808310524344f627d069\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c5dbb89fc2ac013afe67b9e4fcb3743c02b567cd\", \"lessThan\": \"893eeba94c40d513cd0fe6539330ebdaea208c0e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c5dbb89fc2ac013afe67b9e4fcb3743c02b567cd\", \"lessThan\": \"454c454ed645fed051216b79622f7cb69c1638f5\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c5dbb89fc2ac013afe67b9e4fcb3743c02b567cd\", \"lessThan\": \"5dfe2408fd7dc4d2e7ac38a116ff0a37b1cfd3b9\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c5dbb89fc2ac013afe67b9e4fcb3743c02b567cd\", \"lessThan\": \"6cd4a78d962bebbaf8beb7d2ead3f34120e3f7b2\", \"versionType\": \"git\"}], \"programFiles\": [\"net/core/sock.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.12\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.12\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.162\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.96\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.36\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9.7\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/core/sock.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/78e4aa528a7b1204219d808310524344f627d069\"}, {\"url\": \"https://git.kernel.org/stable/c/893eeba94c40d513cd0fe6539330ebdaea208c0e\"}, {\"url\": \"https://git.kernel.org/stable/c/454c454ed645fed051216b79622f7cb69c1638f5\"}, {\"url\": \"https://git.kernel.org/stable/c/5dfe2408fd7dc4d2e7ac38a116ff0a37b1cfd3b9\"}, {\"url\": \"https://git.kernel.org/stable/c/6cd4a78d962bebbaf8beb7d2ead3f34120e3f7b2\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: do not leave a dangling sk pointer, when socket creation fails\\n\\nIt is possible to trigger a use-after-free by:\\n  * attaching an fentry probe to __sock_release() and the probe calling the\\n    bpf_get_socket_cookie() helper\\n  * running traceroute -I 1.1.1.1 on a freshly booted VM\\n\\nA KASAN enabled kernel will log something like below (decoded and stripped):\\n==================================================================\\nBUG: KASAN: slab-use-after-free in __sock_gen_cookie (./arch/x86/include/asm/atomic64_64.h:15 ./include/linux/atomic/atomic-arch-fallback.h:2583 ./include/linux/atomic/atomic-instrumented.h:1611 net/core/sock_diag.c:29)\\nRead of size 8 at addr ffff888007110dd8 by task traceroute/299\\n\\nCPU: 2 PID: 299 Comm: traceroute Tainted: G            E      6.10.0-rc2+ #2\\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014\\nCall Trace:\\n \u003cTASK\u003e\\ndump_stack_lvl (lib/dump_stack.c:117 (discriminator 1))\\nprint_report (mm/kasan/report.c:378 mm/kasan/report.c:488)\\n? __sock_gen_cookie (./arch/x86/include/asm/atomic64_64.h:15 ./include/linux/atomic/atomic-arch-fallback.h:2583 ./include/linux/atomic/atomic-instrumented.h:1611 net/core/sock_diag.c:29)\\nkasan_report (mm/kasan/report.c:603)\\n? __sock_gen_cookie (./arch/x86/include/asm/atomic64_64.h:15 ./include/linux/atomic/atomic-arch-fallback.h:2583 ./include/linux/atomic/atomic-instrumented.h:1611 net/core/sock_diag.c:29)\\nkasan_check_range (mm/kasan/generic.c:183 mm/kasan/generic.c:189)\\n__sock_gen_cookie (./arch/x86/include/asm/atomic64_64.h:15 ./include/linux/atomic/atomic-arch-fallback.h:2583 ./include/linux/atomic/atomic-instrumented.h:1611 net/core/sock_diag.c:29)\\nbpf_get_socket_ptr_cookie (./arch/x86/include/asm/preempt.h:94 ./include/linux/sock_diag.h:42 net/core/filter.c:5094 net/core/filter.c:5092)\\nbpf_prog_875642cf11f1d139___sock_release+0x6e/0x8e\\nbpf_trampoline_6442506592+0x47/0xaf\\n__sock_release (net/socket.c:652)\\n__sock_create (net/socket.c:1601)\\n...\\nAllocated by task 299 on cpu 2 at 78.328492s:\\nkasan_save_stack (mm/kasan/common.c:48)\\nkasan_save_track (mm/kasan/common.c:68)\\n__kasan_slab_alloc (mm/kasan/common.c:312 mm/kasan/common.c:338)\\nkmem_cache_alloc_noprof (mm/slub.c:3941 mm/slub.c:4000 mm/slub.c:4007)\\nsk_prot_alloc (net/core/sock.c:2075)\\nsk_alloc (net/core/sock.c:2134)\\ninet_create (net/ipv4/af_inet.c:327 net/ipv4/af_inet.c:252)\\n__sock_create (net/socket.c:1572)\\n__sys_socket (net/socket.c:1660 net/socket.c:1644 net/socket.c:1706)\\n__x64_sys_socket (net/socket.c:1718)\\ndo_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83)\\nentry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\\n\\nFreed by task 299 on cpu 2 at 78.328502s:\\nkasan_save_stack (mm/kasan/common.c:48)\\nkasan_save_track (mm/kasan/common.c:68)\\nkasan_save_free_info (mm/kasan/generic.c:582)\\npoison_slab_object (mm/kasan/common.c:242)\\n__kasan_slab_free (mm/kasan/common.c:256)\\nkmem_cache_free (mm/slub.c:4437 mm/slub.c:4511)\\n__sk_destruct (net/core/sock.c:2117 net/core/sock.c:2208)\\ninet_create (net/ipv4/af_inet.c:397 net/ipv4/af_inet.c:252)\\n__sock_create (net/socket.c:1572)\\n__sys_socket (net/socket.c:1660 net/socket.c:1644 net/socket.c:1706)\\n__x64_sys_socket (net/socket.c:1718)\\ndo_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83)\\nentry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\\n\\nFix this by clearing the struct socket reference in sk_common_release() to cover\\nall protocol families create functions, which may already attached the\\nreference to the sk object with sock_init_data().\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.162\", \"versionStartIncluding\": \"5.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.96\", \"versionStartIncluding\": \"5.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.36\", \"versionStartIncluding\": \"5.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9.7\", \"versionStartIncluding\": \"5.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10\", \"versionStartIncluding\": \"5.12\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:34:13.912Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-40954\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:34:13.912Z\", \"dateReserved\": \"2024-07-12T12:17:45.592Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-07-12T12:31:57.517Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.