GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-35976 (GCVE-0-2024-35976)

Vulnerability from cvelistv5 – Published: 2024-05-20 09:42 – Updated: 2026-08-05 11:31
VLAI
Title
xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING
Summary
In the Linux kernel, the following vulnerability has been resolved: xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING syzbot reported an illegal copy in xsk_setsockopt() [1] Make sure to validate setsockopt() @optlen parameter. [1] BUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset include/linux/sockptr.h:49 [inline] BUG: KASAN: slab-out-of-bounds in copy_from_sockptr include/linux/sockptr.h:55 [inline] BUG: KASAN: slab-out-of-bounds in xsk_setsockopt+0x909/0xa40 net/xdp/xsk.c:1420 Read of size 4 at addr ffff888028c6cde3 by task syz-executor.0/7549 CPU: 0 PID: 7549 Comm: syz-executor.0 Not tainted 6.8.0-syzkaller-08951-gfe46a7dd189e #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 copy_from_sockptr_offset include/linux/sockptr.h:49 [inline] copy_from_sockptr include/linux/sockptr.h:55 [inline] xsk_setsockopt+0x909/0xa40 net/xdp/xsk.c:1420 do_sock_setsockopt+0x3af/0x720 net/socket.c:2311 __sys_setsockopt+0x1ae/0x250 net/socket.c:2334 __do_sys_setsockopt net/socket.c:2343 [inline] __se_sys_setsockopt net/socket.c:2340 [inline] __x64_sys_setsockopt+0xb5/0xd0 net/socket.c:2340 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x6d/0x75 RIP: 0033:0x7fb40587de69 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fb40665a0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 RAX: ffffffffffffffda RBX: 00007fb4059abf80 RCX: 00007fb40587de69 RDX: 0000000000000005 RSI: 000000000000011b RDI: 0000000000000006 RBP: 00007fb4058ca47a R08: 0000000000000002 R09: 0000000000000000 R10: 0000000020001980 R11: 0000000000000246 R12: 0000000000000000 R13: 000000000000000b R14: 00007fb4059abf80 R15: 00007fff57ee4d08 </TASK> Allocated by task 7549: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:370 [inline] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:387 kasan_kmalloc include/linux/kasan.h:211 [inline] __do_kmalloc_node mm/slub.c:3966 [inline] __kmalloc+0x233/0x4a0 mm/slub.c:3979 kmalloc include/linux/slab.h:632 [inline] __cgroup_bpf_run_filter_setsockopt+0xd2f/0x1040 kernel/bpf/cgroup.c:1869 do_sock_setsockopt+0x6b4/0x720 net/socket.c:2293 __sys_setsockopt+0x1ae/0x250 net/socket.c:2334 __do_sys_setsockopt net/socket.c:2343 [inline] __se_sys_setsockopt net/socket.c:2340 [inline] __x64_sys_setsockopt+0xb5/0xd0 net/socket.c:2340 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x6d/0x75 The buggy address belongs to the object at ffff888028c6cde0 which belongs to the cache kmalloc-8 of size 8 The buggy address is located 1 bytes to the right of allocated 2-byte region [ffff888028c6cde0, ffff888028c6cde2) The buggy address belongs to the physical page: page:ffffea0000a31b00 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888028c6c9c0 pfn:0x28c6c anon flags: 0xfff00000000800(slab|node=0|zone=1|lastcpupid=0x7ff) page_type: 0xffffffff() raw: 00fff00000000800 ffff888014c41280 0000000000000000 dead000000000001 raw: ffff888028c6c9c0 0000000080800057 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 6648, tgid 6644 (syz-executor.0), ts 133906047828, free_ts 133859922223 set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook+0x1ea/0x210 mm/page_alloc.c:1533 prep_new_page mm/page_alloc.c: ---truncated---
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
6.7 (Medium)
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-20 14:37 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 423f38329d267969130fb6f2c685f73d72687558 , < beb99266830520e15fbc6ca8cc5a5240d76851fd (git)
Affected: 423f38329d267969130fb6f2c685f73d72687558 , < 0b45c25d60e38f5c2cb6823f886773a34323306d (git)
Affected: 423f38329d267969130fb6f2c685f73d72687558 , < a82984b3c6a7e8c7937dba6e857ddf829d149417 (git)
Affected: 423f38329d267969130fb6f2c685f73d72687558 , < f0a068de65d5b7358e9aff792716afa9333f3922 (git)
Affected: 423f38329d267969130fb6f2c685f73d72687558 , < 2a523f14a3f53b46ff0e1fafd215b0bc5f6783aa (git)
Affected: 423f38329d267969130fb6f2c685f73d72687558 , < b143e19dc28c3211f050f7848d87d9b0a170e10c (git)
Affected: 423f38329d267969130fb6f2c685f73d72687558 , < 2eb979fbb2479bcd7e049f2f9978b6590dd8a0e6 (git)
Affected: 423f38329d267969130fb6f2c685f73d72687558 , < 237f3cf13b20db183d3706d997eedc3c49eacd44 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.18
Unaffected: 0 , < 4.18 (semver)
Unaffected: 4.19.317 , ≤ 4.19.* (semver)
Unaffected: 5.4.278 , ≤ 5.4.* (semver)
Unaffected: 5.10.216 , ≤ 5.10.* (semver)
Unaffected: 5.15.156 , ≤ 5.15.* (semver)
Unaffected: 6.1.87 , ≤ 6.1.* (semver)
Unaffected: 6.6.28 , ≤ 6.6.* (semver)
Unaffected: 6.8.7 , ≤ 6.8.* (semver)
Unaffected: 6.9 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
linux linux_kernel Affected: 4.18
    cpe:2.3:o:linux:linux_kernel:4.18:*:*:*:*:*:*:*
Create a notification for this product.
Siemens RUGGEDCOM RST2428P Affected: 0 , < V3.1 (custom)
guessed Create a notification for this product.
Siemens SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family Unaffected: 0 , < * (custom)
guessed Create a notification for this product.
Siemens SCALANCE XCM-/XRM-/XCH-/XRH-300 family Affected: 0 , < V3.1 (custom)
guessed Create a notification for this product.
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem Affected: 0 , < * (custom)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:4.18:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "status": "affected",
                "version": "4.18"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "NONE",
              "baseScore": 6.7,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-35976",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-20T14:37:56.972231Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-787",
                "description": "CWE-787 Out-of-bounds Write",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:34:07.661Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T17:20:53.592Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/beb99266830520e15fbc6ca8cc5a5240d76851fd"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0b45c25d60e38f5c2cb6823f886773a34323306d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a82984b3c6a7e8c7937dba6e857ddf829d149417"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f0a068de65d5b7358e9aff792716afa9333f3922"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/2a523f14a3f53b46ff0e1fafd215b0bc5f6783aa"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b143e19dc28c3211f050f7848d87d9b0a170e10c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/2eb979fbb2479bcd7e049f2f9978b6590dd8a0e6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/237f3cf13b20db183d3706d997eedc3c49eacd44"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM RST2428P",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XCM-/XRM-/XCH-/XRH-300 family",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T11:53:21.943Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-613116.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/xdp/xsk.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "beb99266830520e15fbc6ca8cc5a5240d76851fd",
              "status": "affected",
              "version": "423f38329d267969130fb6f2c685f73d72687558",
              "versionType": "git"
            },
            {
              "lessThan": "0b45c25d60e38f5c2cb6823f886773a34323306d",
              "status": "affected",
              "version": "423f38329d267969130fb6f2c685f73d72687558",
              "versionType": "git"
            },
            {
              "lessThan": "a82984b3c6a7e8c7937dba6e857ddf829d149417",
              "status": "affected",
              "version": "423f38329d267969130fb6f2c685f73d72687558",
              "versionType": "git"
            },
            {
              "lessThan": "f0a068de65d5b7358e9aff792716afa9333f3922",
              "status": "affected",
              "version": "423f38329d267969130fb6f2c685f73d72687558",
              "versionType": "git"
            },
            {
              "lessThan": "2a523f14a3f53b46ff0e1fafd215b0bc5f6783aa",
              "status": "affected",
              "version": "423f38329d267969130fb6f2c685f73d72687558",
              "versionType": "git"
            },
            {
              "lessThan": "b143e19dc28c3211f050f7848d87d9b0a170e10c",
              "status": "affected",
              "version": "423f38329d267969130fb6f2c685f73d72687558",
              "versionType": "git"
            },
            {
              "lessThan": "2eb979fbb2479bcd7e049f2f9978b6590dd8a0e6",
              "status": "affected",
              "version": "423f38329d267969130fb6f2c685f73d72687558",
              "versionType": "git"
            },
            {
              "lessThan": "237f3cf13b20db183d3706d997eedc3c49eacd44",
              "status": "affected",
              "version": "423f38329d267969130fb6f2c685f73d72687558",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/xdp/xsk.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.18"
            },
            {
              "lessThan": "4.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.317",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.278",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.156",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.87",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.28",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.317",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.278",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.216",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.156",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.87",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.28",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.7",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING\n\nsyzbot reported an illegal copy in xsk_setsockopt() [1]\n\nMake sure to validate setsockopt() @optlen parameter.\n\n[1]\n\n BUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset include/linux/sockptr.h:49 [inline]\n BUG: KASAN: slab-out-of-bounds in copy_from_sockptr include/linux/sockptr.h:55 [inline]\n BUG: KASAN: slab-out-of-bounds in xsk_setsockopt+0x909/0xa40 net/xdp/xsk.c:1420\nRead of size 4 at addr ffff888028c6cde3 by task syz-executor.0/7549\n\nCPU: 0 PID: 7549 Comm: syz-executor.0 Not tainted 6.8.0-syzkaller-08951-gfe46a7dd189e #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024\nCall Trace:\n \u003cTASK\u003e\n  __dump_stack lib/dump_stack.c:88 [inline]\n  dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114\n  print_address_description mm/kasan/report.c:377 [inline]\n  print_report+0x169/0x550 mm/kasan/report.c:488\n  kasan_report+0x143/0x180 mm/kasan/report.c:601\n  copy_from_sockptr_offset include/linux/sockptr.h:49 [inline]\n  copy_from_sockptr include/linux/sockptr.h:55 [inline]\n  xsk_setsockopt+0x909/0xa40 net/xdp/xsk.c:1420\n  do_sock_setsockopt+0x3af/0x720 net/socket.c:2311\n  __sys_setsockopt+0x1ae/0x250 net/socket.c:2334\n  __do_sys_setsockopt net/socket.c:2343 [inline]\n  __se_sys_setsockopt net/socket.c:2340 [inline]\n  __x64_sys_setsockopt+0xb5/0xd0 net/socket.c:2340\n do_syscall_64+0xfb/0x240\n entry_SYSCALL_64_after_hwframe+0x6d/0x75\nRIP: 0033:0x7fb40587de69\nCode: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007fb40665a0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000036\nRAX: ffffffffffffffda RBX: 00007fb4059abf80 RCX: 00007fb40587de69\nRDX: 0000000000000005 RSI: 000000000000011b RDI: 0000000000000006\nRBP: 00007fb4058ca47a R08: 0000000000000002 R09: 0000000000000000\nR10: 0000000020001980 R11: 0000000000000246 R12: 0000000000000000\nR13: 000000000000000b R14: 00007fb4059abf80 R15: 00007fff57ee4d08\n \u003c/TASK\u003e\n\nAllocated by task 7549:\n  kasan_save_stack mm/kasan/common.c:47 [inline]\n  kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\n  poison_kmalloc_redzone mm/kasan/common.c:370 [inline]\n  __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:387\n  kasan_kmalloc include/linux/kasan.h:211 [inline]\n  __do_kmalloc_node mm/slub.c:3966 [inline]\n  __kmalloc+0x233/0x4a0 mm/slub.c:3979\n  kmalloc include/linux/slab.h:632 [inline]\n  __cgroup_bpf_run_filter_setsockopt+0xd2f/0x1040 kernel/bpf/cgroup.c:1869\n  do_sock_setsockopt+0x6b4/0x720 net/socket.c:2293\n  __sys_setsockopt+0x1ae/0x250 net/socket.c:2334\n  __do_sys_setsockopt net/socket.c:2343 [inline]\n  __se_sys_setsockopt net/socket.c:2340 [inline]\n  __x64_sys_setsockopt+0xb5/0xd0 net/socket.c:2340\n do_syscall_64+0xfb/0x240\n entry_SYSCALL_64_after_hwframe+0x6d/0x75\n\nThe buggy address belongs to the object at ffff888028c6cde0\n which belongs to the cache kmalloc-8 of size 8\nThe buggy address is located 1 bytes to the right of\n allocated 2-byte region [ffff888028c6cde0, ffff888028c6cde2)\n\nThe buggy address belongs to the physical page:\npage:ffffea0000a31b00 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888028c6c9c0 pfn:0x28c6c\nanon flags: 0xfff00000000800(slab|node=0|zone=1|lastcpupid=0x7ff)\npage_type: 0xffffffff()\nraw: 00fff00000000800 ffff888014c41280 0000000000000000 dead000000000001\nraw: ffff888028c6c9c0 0000000080800057 00000001ffffffff 0000000000000000\npage dumped because: kasan: bad access detected\npage_owner tracks the page as allocated\npage last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 6648, tgid 6644 (syz-executor.0), ts 133906047828, free_ts 133859922223\n  set_page_owner include/linux/page_owner.h:31 [inline]\n  post_alloc_hook+0x1ea/0x210 mm/page_alloc.c:1533\n  prep_new_page mm/page_alloc.c:\n---truncated---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached purely through the local `setsockopt(2)` syscall on an AF_XDP socket; no network input is processed. There is no remote or adjacent-network trigger for `xsk_setsockopt()`.\nAC:L - A single deterministic `setsockopt(fd, SOL_XDP, XDP_UMEM_FILL_RING, buf, 2)` call triggers the over-read every time \u2014 no race, no memory-layout grooming, and no condition outside the attacker\u0027s control. The attacker fully controls the short `optlen` value that causes the unchecked 4-byte copy.\nPR:L - Creating the AF_XDP socket needs `ns_capable(net-\u003euser_ns, CAP_NET_RAW)`, which any unprivileged user obtains with `unshare -Urn`, and which containers (Docker\u0027s default set) grant outright. No real root in the initial namespace is required.\nUI:N - The attacker performs the entire sequence \u2014 socket creation and the malformed setsockopt \u2014 in its own process. No victim action, mount, or file open is needed.\nS:U - The over-read and its consequences stay within the kernel\u0027s own security authority on the same host. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The unchecked `memcpy()` reads kernel slab memory beyond the allocated object into `entries`, exposing uninitialized/adjacent heap residue that the attacker can subsequently observe via the resulting ring size through `xsk_mmap()`\u0027s size validation. Out-of-bounds reads of kernel heap are scored High.\nI:N - The defect is strictly a read; no out-of-bounds write, type confusion, or control-flow corruption occurs. The `entries` value it influences is already fully attacker-supplied through the legitimate path, so no integrity is gained.\nA:H - The access is a KASAN-detected slab out-of-bounds read that produces a kernel splat and panics on builds running `panic_on_warn`, and the resulting garbage ring size drives failing large vmalloc allocations. Any such memory-safety violation is scored as a High availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:31:20.690Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/beb99266830520e15fbc6ca8cc5a5240d76851fd"
        },
        {
          "url": "https://git.kernel.org/stable/c/0b45c25d60e38f5c2cb6823f886773a34323306d"
        },
        {
          "url": "https://git.kernel.org/stable/c/a82984b3c6a7e8c7937dba6e857ddf829d149417"
        },
        {
          "url": "https://git.kernel.org/stable/c/f0a068de65d5b7358e9aff792716afa9333f3922"
        },
        {
          "url": "https://git.kernel.org/stable/c/2a523f14a3f53b46ff0e1fafd215b0bc5f6783aa"
        },
        {
          "url": "https://git.kernel.org/stable/c/b143e19dc28c3211f050f7848d87d9b0a170e10c"
        },
        {
          "url": "https://git.kernel.org/stable/c/2eb979fbb2479bcd7e049f2f9978b6590dd8a0e6"
        },
        {
          "url": "https://git.kernel.org/stable/c/237f3cf13b20db183d3706d997eedc3c49eacd44"
        }
      ],
      "title": "xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-35976",
    "datePublished": "2024-05-20T09:42:02.415Z",
    "dateReserved": "2024-05-17T13:50:33.143Z",
    "dateUpdated": "2026-08-05T11:31:20.690Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-35976",
      "date": "2026-09-15",
      "epss": "0.00259",
      "percentile": "0.17725"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nxsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING\\n\\nsyzbot reported an illegal copy in xsk_setsockopt() [1]\\n\\nMake sure to validate setsockopt() @optlen parameter.\\n\\n[1]\\n\\n BUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset include/linux/sockptr.h:49 [inline]\\n BUG: KASAN: slab-out-of-bounds in copy_from_sockptr include/linux/sockptr.h:55 [inline]\\n BUG: KASAN: slab-out-of-bounds in xsk_setsockopt+0x909/0xa40 net/xdp/xsk.c:1420\\nRead of size 4 at addr ffff888028c6cde3 by task syz-executor.0/7549\\n\\nCPU: 0 PID: 7549 Comm: syz-executor.0 Not tainted 6.8.0-syzkaller-08951-gfe46a7dd189e #0\\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024\\nCall Trace:\\n \u003cTASK\u003e\\n  __dump_stack lib/dump_stack.c:88 [inline]\\n  dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114\\n  print_address_description mm/kasan/report.c:377 [inline]\\n  print_report+0x169/0x550 mm/kasan/report.c:488\\n  kasan_report+0x143/0x180 mm/kasan/report.c:601\\n  copy_from_sockptr_offset include/linux/sockptr.h:49 [inline]\\n  copy_from_sockptr include/linux/sockptr.h:55 [inline]\\n  xsk_setsockopt+0x909/0xa40 net/xdp/xsk.c:1420\\n  do_sock_setsockopt+0x3af/0x720 net/socket.c:2311\\n  __sys_setsockopt+0x1ae/0x250 net/socket.c:2334\\n  __do_sys_setsockopt net/socket.c:2343 [inline]\\n  __se_sys_setsockopt net/socket.c:2340 [inline]\\n  __x64_sys_setsockopt+0xb5/0xd0 net/socket.c:2340\\n do_syscall_64+0xfb/0x240\\n entry_SYSCALL_64_after_hwframe+0x6d/0x75\\nRIP: 0033:0x7fb40587de69\\nCode: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48\\nRSP: 002b:00007fb40665a0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000036\\nRAX: ffffffffffffffda RBX: 00007fb4059abf80 RCX: 00007fb40587de69\\nRDX: 0000000000000005 RSI: 000000000000011b RDI: 0000000000000006\\nRBP: 00007fb4058ca47a R08: 0000000000000002 R09: 0000000000000000\\nR10: 0000000020001980 R11: 0000000000000246 R12: 0000000000000000\\nR13: 000000000000000b R14: 00007fb4059abf80 R15: 00007fff57ee4d08\\n \u003c/TASK\u003e\\n\\nAllocated by task 7549:\\n  kasan_save_stack mm/kasan/common.c:47 [inline]\\n  kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\\n  poison_kmalloc_redzone mm/kasan/common.c:370 [inline]\\n  __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:387\\n  kasan_kmalloc include/linux/kasan.h:211 [inline]\\n  __do_kmalloc_node mm/slub.c:3966 [inline]\\n  __kmalloc+0x233/0x4a0 mm/slub.c:3979\\n  kmalloc include/linux/slab.h:632 [inline]\\n  __cgroup_bpf_run_filter_setsockopt+0xd2f/0x1040 kernel/bpf/cgroup.c:1869\\n  do_sock_setsockopt+0x6b4/0x720 net/socket.c:2293\\n  __sys_setsockopt+0x1ae/0x250 net/socket.c:2334\\n  __do_sys_setsockopt net/socket.c:2343 [inline]\\n  __se_sys_setsockopt net/socket.c:2340 [inline]\\n  __x64_sys_setsockopt+0xb5/0xd0 net/socket.c:2340\\n do_syscall_64+0xfb/0x240\\n entry_SYSCALL_64_after_hwframe+0x6d/0x75\\n\\nThe buggy address belongs to the object at ffff888028c6cde0\\n which belongs to the cache kmalloc-8 of size 8\\nThe buggy address is located 1 bytes to the right of\\n allocated 2-byte region [ffff888028c6cde0, ffff888028c6cde2)\\n\\nThe buggy address belongs to the physical page:\\npage:ffffea0000a31b00 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888028c6c9c0 pfn:0x28c6c\\nanon flags: 0xfff00000000800(slab|node=0|zone=1|lastcpupid=0x7ff)\\npage_type: 0xffffffff()\\nraw: 00fff00000000800 ffff888014c41280 0000000000000000 dead000000000001\\nraw: ffff888028c6c9c0 0000000080800057 00000001ffffffff 0000000000000000\\npage dumped because: kasan: bad access detected\\npage_owner tracks the page as allocated\\npage last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 6648, tgid 6644 (syz-executor.0), ts 133906047828, free_ts 133859922223\\n  set_page_owner include/linux/page_owner.h:31 [inline]\\n  post_alloc_hook+0x1ea/0x210 mm/page_alloc.c:1533\\n  prep_new_page mm/page_alloc.c:\\n---truncated---\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: xsk: validar la entrada del usuario para XDP_{UMEM|COMPLETION}_FILL_RING syzbot inform\\u00f3 una copia ilegal en xsk_setsockopt() [1] Aseg\\u00farese de validar el par\\u00e1metro @optlen setsockopt(). [1] BUG: KASAN: losa fuera de l\\u00edmites en copy_from_sockptr_offset include/linux/sockptr.h:49 [en l\\u00ednea] ERROR: KASAN: losa fuera de l\\u00edmites en copy_from_sockptr include/linux/sockptr.h:55 [en l\\u00ednea] ERROR: KASAN: losa fuera de l\\u00edmites en xsk_setsockopt+0x909/0xa40 net/xdp/xsk.c:1420 Lectura de tama\\u00f1o 4 en la direcci\\u00f3n ffff888028c6cde3 mediante la tarea syz-executor.0/7549 CPU: 0 PID: 7549 Comm: syz-executor.0 No contaminado 6.8.0-syzkaller-08951-gfe46a7dd189e #0 Nombre del hardware: Google Google Compute Engine/Google Compute Engine, BIOS Google 27/03/2024 Seguimiento de llamadas:  __dump_stack lib/dump_stack .c:88 [en l\\u00ednea] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 print_address_description mm/kasan/report.c:377 [en l\\u00ednea] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/ 0x180 mm/kasan/report.c:601 copy_from_sockptr_offset include/linux/sockptr.h:49 [en l\\u00ednea] copy_from_sockptr include/linux/sockptr.h:55 [en l\\u00ednea] xsk_setsockopt+0x909/0xa40 net/xdp/xsk.c:1420 do_sock_setsockopt+0x3af/0x720 net/socket.c:2311 __sys_setsockopt+0x1ae/0x250 net/socket.c:2334 __do_sys_setsockopt net/socket.c:2343 [en l\\u00ednea] __se_sys_setsockopt net/socket.c:2340 [en l\\u00ednea] x64_sys_setsockopt+0xb5/ 0xd0 net/socket.c:2340 do_syscall_64+0xfb/0x240 Entry_SYSCALL_64_after_hwframe+0x6d/0x75 RIP: 0033:0x7fb40587de69 C\\u00f3digo: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u0026lt;48\u0026gt; 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 0c8 EFLAGS: 00000246 ORIG_RAX : 0000000000000036 RAX: ffffffffffffffda RBX: 00007fb4059abf80 RCX: 00007fb40587de69 RDX: 0000000000000005 RSI: 000000000000011b RDI: 000000000 0000006 RBP: 00007fb4058ca47a R08: 0000000000000002 R09: 0000000000000000 R10: 0000000020001980 R11: 0000000000000246 R12: 000000000 0000000 R13: 000000000000000b R14: 00007fb4059abf80 R15: 00007fff57ee4d08  Asignado por tarea 7549: kasan_save_stack mm/kasan/common.c:47 [en l\\u00ednea] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 veneno_kmalloc_redzone mm/kasan/common.c:370 [en l\\u00ednea] __kasan_kmalloc+0x98/ 0xb0 mm/kasan/common.c:387 kasan_kmalloc include/linux/kasan.h:211 [en l\\u00ednea] __do_kmalloc_node mm/slub.c:3966 [en l\\u00ednea] __kmalloc+0x233/0x4a0 mm/slub.c:3979 kmalloc include/linux /slab.h:632 [en l\\u00ednea] __cgroup_bpf_run_filter_setsockopt+0xd2f/0x1040 kernel/bpf/cgroup.c:1869 do_sock_setsockopt+0x6b4/0x720 net/socket.c:2293 __sys_setsockopt+0x1ae/0x250 334 __do_sys_setsockopt net/ socket.c:2343 [en l\\u00ednea] __se_sys_setsockopt net/socket.c:2340 [en l\\u00ednea] __x64_sys_setsockopt+0xb5/0xd0 net/socket.c:2340 do_syscall_64+0xfb/0x240 Entry_SYSCALL_64_after_hwframe+0x6d/0x75 El error la direcci\\u00f3n pertenece al objeto en ffff888028c6cde0 que pertenece al cach\\u00e9 kmalloc-8 de tama\\u00f1o 8 La direcci\\u00f3n con errores se encuentra 1 byte a la derecha de la regi\\u00f3n asignada de 2 bytes [ffff888028c6cde0, ffff888028c6cde2) La direcci\\u00f3n con errores pertenece a la p\\u00e1gina f\\u00edsica: p\\u00e1gina:ffffea0000a31b00 refcount:1 mapcount:0 Mapeo: 00000000000000000000 \\u00cdNDICE: 0xffff888028c6c9c0 pfn: 0x28c6c Anon Flags: 0xffff00000000800 (Slab | Node = 0 | Zone = 1 | LastCpupid = 0x7ff) Page_Type: 0xffffffffffff () RAW: 00FFF000000800 0000000000000000 Dead000000000001 Raw: FFFFF888028C6C9C0 000000000080800057 00000001FFFFFFFFFFFFFFF 0000000000000000 P\\u00e1gina arrojada porque: Kasan : mal acceso detectado page_owner rastrea la p\\u00e1gina como p\\u00e1gina asignada por \\u00faltima vez mediante orden 0, migrar tipo Inamovible, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 6648, tgid 6644 (syz-executor.0), ts 133906047828, free_ts 133859922223 set _page_owner incluye /linux/page_owner.h:31 [en l\\u00ednea] post_alloc_hook+0x1ea/0x210 mm/page_alloc.c:1533 prep_new_page mm/page_alloc.c: ---truncado---\"}]",
      "id": "CVE-2024-35976",
      "lastModified": "2024-11-21T09:21:20.397",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N\", \"baseScore\": 6.7, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 1.4, \"impactScore\": 5.2}]}",
      "published": "2024-05-20T10:15:12.273",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/0b45c25d60e38f5c2cb6823f886773a34323306d\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/237f3cf13b20db183d3706d997eedc3c49eacd44\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/2a523f14a3f53b46ff0e1fafd215b0bc5f6783aa\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/2eb979fbb2479bcd7e049f2f9978b6590dd8a0e6\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/a82984b3c6a7e8c7937dba6e857ddf829d149417\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/b143e19dc28c3211f050f7848d87d9b0a170e10c\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/beb99266830520e15fbc6ca8cc5a5240d76851fd\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/f0a068de65d5b7358e9aff792716afa9333f3922\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/0b45c25d60e38f5c2cb6823f886773a34323306d\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/237f3cf13b20db183d3706d997eedc3c49eacd44\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/2a523f14a3f53b46ff0e1fafd215b0bc5f6783aa\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/2eb979fbb2479bcd7e049f2f9978b6590dd8a0e6\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/a82984b3c6a7e8c7937dba6e857ddf829d149417\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/b143e19dc28c3211f050f7848d87d9b0a170e10c\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/beb99266830520e15fbc6ca8cc5a5240d76851fd\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/f0a068de65d5b7358e9aff792716afa9333f3922\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": "[{\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-787\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-35976\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-20T10:15:12.273\",\"lastModified\":\"2026-08-04T11:18:17.667\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nxsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING\\n\\nsyzbot reported an illegal copy in xsk_setsockopt() [1]\\n\\nMake sure to validate setsockopt() @optlen parameter.\\n\\n[1]\\n\\n BUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset include/linux/sockptr.h:49 [inline]\\n BUG: KASAN: slab-out-of-bounds in copy_from_sockptr include/linux/sockptr.h:55 [inline]\\n BUG: KASAN: slab-out-of-bounds in xsk_setsockopt+0x909/0xa40 net/xdp/xsk.c:1420\\nRead of size 4 at addr ffff888028c6cde3 by task syz-executor.0/7549\\n\\nCPU: 0 PID: 7549 Comm: syz-executor.0 Not tainted 6.8.0-syzkaller-08951-gfe46a7dd189e #0\\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024\\nCall Trace:\\n \u003cTASK\u003e\\n  __dump_stack lib/dump_stack.c:88 [inline]\\n  dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114\\n  print_address_description mm/kasan/report.c:377 [inline]\\n  print_report+0x169/0x550 mm/kasan/report.c:488\\n  kasan_report+0x143/0x180 mm/kasan/report.c:601\\n  copy_from_sockptr_offset include/linux/sockptr.h:49 [inline]\\n  copy_from_sockptr include/linux/sockptr.h:55 [inline]\\n  xsk_setsockopt+0x909/0xa40 net/xdp/xsk.c:1420\\n  do_sock_setsockopt+0x3af/0x720 net/socket.c:2311\\n  __sys_setsockopt+0x1ae/0x250 net/socket.c:2334\\n  __do_sys_setsockopt net/socket.c:2343 [inline]\\n  __se_sys_setsockopt net/socket.c:2340 [inline]\\n  __x64_sys_setsockopt+0xb5/0xd0 net/socket.c:2340\\n do_syscall_64+0xfb/0x240\\n entry_SYSCALL_64_after_hwframe+0x6d/0x75\\nRIP: 0033:0x7fb40587de69\\nCode: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48\\nRSP: 002b:00007fb40665a0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000036\\nRAX: ffffffffffffffda RBX: 00007fb4059abf80 RCX: 00007fb40587de69\\nRDX: 0000000000000005 RSI: 000000000000011b RDI: 0000000000000006\\nRBP: 00007fb4058ca47a R08: 0000000000000002 R09: 0000000000000000\\nR10: 0000000020001980 R11: 0000000000000246 R12: 0000000000000000\\nR13: 000000000000000b R14: 00007fb4059abf80 R15: 00007fff57ee4d08\\n \u003c/TASK\u003e\\n\\nAllocated by task 7549:\\n  kasan_save_stack mm/kasan/common.c:47 [inline]\\n  kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\\n  poison_kmalloc_redzone mm/kasan/common.c:370 [inline]\\n  __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:387\\n  kasan_kmalloc include/linux/kasan.h:211 [inline]\\n  __do_kmalloc_node mm/slub.c:3966 [inline]\\n  __kmalloc+0x233/0x4a0 mm/slub.c:3979\\n  kmalloc include/linux/slab.h:632 [inline]\\n  __cgroup_bpf_run_filter_setsockopt+0xd2f/0x1040 kernel/bpf/cgroup.c:1869\\n  do_sock_setsockopt+0x6b4/0x720 net/socket.c:2293\\n  __sys_setsockopt+0x1ae/0x250 net/socket.c:2334\\n  __do_sys_setsockopt net/socket.c:2343 [inline]\\n  __se_sys_setsockopt net/socket.c:2340 [inline]\\n  __x64_sys_setsockopt+0xb5/0xd0 net/socket.c:2340\\n do_syscall_64+0xfb/0x240\\n entry_SYSCALL_64_after_hwframe+0x6d/0x75\\n\\nThe buggy address belongs to the object at ffff888028c6cde0\\n which belongs to the cache kmalloc-8 of size 8\\nThe buggy address is located 1 bytes to the right of\\n allocated 2-byte region [ffff888028c6cde0, ffff888028c6cde2)\\n\\nThe buggy address belongs to the physical page:\\npage:ffffea0000a31b00 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888028c6c9c0 pfn:0x28c6c\\nanon flags: 0xfff00000000800(slab|node=0|zone=1|lastcpupid=0x7ff)\\npage_type: 0xffffffff()\\nraw: 00fff00000000800 ffff888014c41280 0000000000000000 dead000000000001\\nraw: ffff888028c6c9c0 0000000080800057 00000001ffffffff 0000000000000000\\npage dumped because: kasan: bad access detected\\npage_owner tracks the page as allocated\\npage last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 6648, tgid 6644 (syz-executor.0), ts 133906047828, free_ts 133859922223\\n  set_page_owner include/linux/page_owner.h:31 [inline]\\n  post_alloc_hook+0x1ea/0x210 mm/page_alloc.c:1533\\n  prep_new_page mm/page_alloc.c:\\n---truncated---\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: xsk: validar la entrada del usuario para XDP_{UMEM|COMPLETION}_FILL_RING syzbot inform\u00f3 una copia ilegal en xsk_setsockopt() [1] Aseg\u00farese de validar el par\u00e1metro @optlen setsockopt(). [1] BUG: KASAN: losa fuera de l\u00edmites en copy_from_sockptr_offset include/linux/sockptr.h:49 [en l\u00ednea] ERROR: KASAN: losa fuera de l\u00edmites en copy_from_sockptr include/linux/sockptr.h:55 [en l\u00ednea] ERROR: KASAN: losa fuera de l\u00edmites en xsk_setsockopt+0x909/0xa40 net/xdp/xsk.c:1420 Lectura de tama\u00f1o 4 en la direcci\u00f3n ffff888028c6cde3 mediante la tarea syz-executor.0/7549 CPU: 0 PID: 7549 Comm: syz-executor.0 No contaminado 6.8.0-syzkaller-08951-gfe46a7dd189e #0 Nombre del hardware: Google Google Compute Engine/Google Compute Engine, BIOS Google 27/03/2024 Seguimiento de llamadas:  __dump_stack lib/dump_stack .c:88 [en l\u00ednea] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 print_address_description mm/kasan/report.c:377 [en l\u00ednea] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/ 0x180 mm/kasan/report.c:601 copy_from_sockptr_offset include/linux/sockptr.h:49 [en l\u00ednea] copy_from_sockptr include/linux/sockptr.h:55 [en l\u00ednea] xsk_setsockopt+0x909/0xa40 net/xdp/xsk.c:1420 do_sock_setsockopt+0x3af/0x720 net/socket.c:2311 __sys_setsockopt+0x1ae/0x250 net/socket.c:2334 __do_sys_setsockopt net/socket.c:2343 [en l\u00ednea] __se_sys_setsockopt net/socket.c:2340 [en l\u00ednea] x64_sys_setsockopt+0xb5/ 0xd0 net/socket.c:2340 do_syscall_64+0xfb/0x240 Entry_SYSCALL_64_after_hwframe+0x6d/0x75 RIP: 0033:0x7fb40587de69 C\u00f3digo: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u0026lt;48\u0026gt; 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 0c8 EFLAGS: 00000246 ORIG_RAX : 0000000000000036 RAX: ffffffffffffffda RBX: 00007fb4059abf80 RCX: 00007fb40587de69 RDX: 0000000000000005 RSI: 000000000000011b RDI: 000000000 0000006 RBP: 00007fb4058ca47a R08: 0000000000000002 R09: 0000000000000000 R10: 0000000020001980 R11: 0000000000000246 R12: 000000000 0000000 R13: 000000000000000b R14: 00007fb4059abf80 R15: 00007fff57ee4d08  Asignado por tarea 7549: kasan_save_stack mm/kasan/common.c:47 [en l\u00ednea] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 veneno_kmalloc_redzone mm/kasan/common.c:370 [en l\u00ednea] __kasan_kmalloc+0x98/ 0xb0 mm/kasan/common.c:387 kasan_kmalloc include/linux/kasan.h:211 [en l\u00ednea] __do_kmalloc_node mm/slub.c:3966 [en l\u00ednea] __kmalloc+0x233/0x4a0 mm/slub.c:3979 kmalloc include/linux /slab.h:632 [en l\u00ednea] __cgroup_bpf_run_filter_setsockopt+0xd2f/0x1040 kernel/bpf/cgroup.c:1869 do_sock_setsockopt+0x6b4/0x720 net/socket.c:2293 __sys_setsockopt+0x1ae/0x250 334 __do_sys_setsockopt net/ socket.c:2343 [en l\u00ednea] __se_sys_setsockopt net/socket.c:2340 [en l\u00ednea] __x64_sys_setsockopt+0xb5/0xd0 net/socket.c:2340 do_syscall_64+0xfb/0x240 Entry_SYSCALL_64_after_hwframe+0x6d/0x75 El error la direcci\u00f3n pertenece al objeto en ffff888028c6cde0 que pertenece al cach\u00e9 kmalloc-8 de tama\u00f1o 8 La direcci\u00f3n con errores se encuentra 1 byte a la derecha de la regi\u00f3n asignada de 2 bytes [ffff888028c6cde0, ffff888028c6cde2) La direcci\u00f3n con errores pertenece a la p\u00e1gina f\u00edsica: p\u00e1gina:ffffea0000a31b00 refcount:1 mapcount:0 Mapeo: 00000000000000000000 \u00cdNDICE: 0xffff888028c6c9c0 pfn: 0x28c6c Anon Flags: 0xffff00000000800 (Slab | Node = 0 | Zone = 1 | LastCpupid = 0x7ff) Page_Type: 0xffffffffffff () RAW: 00FFF000000800 0000000000000000 Dead000000000001 Raw: FFFFF888028C6C9C0 000000000080800057 00000001FFFFFFFFFFFFFFF 0000000000000000 P\u00e1gina arrojada porque: Kasan : mal acceso detectado page_owner rastrea la p\u00e1gina como p\u00e1gina asignada por \u00faltima vez mediante orden 0, migrar tipo Inamovible, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 6648, tgid 6644 (syz-executor.0), ts 133906047828, free_ts 133859922223 set _page_owner incluye /linux/page_owner.h:31 [en l\u00ednea] post_alloc_hook+0x1ea/0x210 mm/page_alloc.c:1533 prep_new_page mm/page_alloc.c: ---truncado---\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/xdp/xsk.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"423f38329d267969130fb6f2c685f73d72687558\",\"lessThan\":\"beb99266830520e15fbc6ca8cc5a5240d76851fd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"423f38329d267969130fb6f2c685f73d72687558\",\"lessThan\":\"0b45c25d60e38f5c2cb6823f886773a34323306d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"423f38329d267969130fb6f2c685f73d72687558\",\"lessThan\":\"a82984b3c6a7e8c7937dba6e857ddf829d149417\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"423f38329d267969130fb6f2c685f73d72687558\",\"lessThan\":\"f0a068de65d5b7358e9aff792716afa9333f3922\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"423f38329d267969130fb6f2c685f73d72687558\",\"lessThan\":\"2a523f14a3f53b46ff0e1fafd215b0bc5f6783aa\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"423f38329d267969130fb6f2c685f73d72687558\",\"lessThan\":\"b143e19dc28c3211f050f7848d87d9b0a170e10c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"423f38329d267969130fb6f2c685f73d72687558\",\"lessThan\":\"2eb979fbb2479bcd7e049f2f9978b6590dd8a0e6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"423f38329d267969130fb6f2c685f73d72687558\",\"lessThan\":\"237f3cf13b20db183d3706d997eedc3c49eacd44\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/xdp/xsk.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.317\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.278\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.216\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.156\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.87\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.28\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8.7\",\"lessThanOrEqual\":\"6.8.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"affectedData\":[{\"vendor\":\"linux\",\"product\":\"linux_kernel\",\"defaultStatus\":\"unknown\",\"cpes\":[\"cpe:2.3:o:linux:linux_kernel:4.18:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"4.18\",\"status\":\"affected\"}]}]},{\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\",\"affectedData\":[{\"vendor\":\"Siemens\",\"product\":\"RUGGEDCOM RST2428P\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"V3.1\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"unaffected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SCALANCE XCM-/XRM-/XCH-/XRH-300 family\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"V3.1\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N\",\"baseScore\":6.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.4,\"impactScore\":5.2}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-05-20T14:37:56.972231Z\",\"id\":\"CVE-2024-35976\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.18\",\"versionEndExcluding\":\"4.19.317\",\"matchCriteriaId\":\"8199FAA4-7C5C-4F16-9452-571C053D3402\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.278\",\"matchCriteriaId\":\"7FDBF235-DA18-49A1-8690-6C7272FD0701\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.216\",\"matchCriteriaId\":\"A44ABF89-F1BD-4C9A-895D-7596650DCD27\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.156\",\"matchCriteriaId\":\"E80AFAB4-A9F3-415C-8D6C-52D1C13F1531\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.87\",\"matchCriteriaId\":\"BDA59296-EDB8-44CD-98E4-C08C051569E6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.28\",\"matchCriteriaId\":\"8D6315B0-B3BA-406C-B0DB-51D9A63753F0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.8.7\",\"matchCriteriaId\":\"531BDFB5-EF6A-4707-902E-146368303499\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"22BEDD49-2C6D-402D-9DBF-6646F6ECD10B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"DF73CB2A-DFFD-46FB-9BFE-AA394F27EA37\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"52048DDA-FC5A-4363-95A0-A6357B4D7F8C\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0b45c25d60e38f5c2cb6823f886773a34323306d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/237f3cf13b20db183d3706d997eedc3c49eacd44\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2a523f14a3f53b46ff0e1fafd215b0bc5f6783aa\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2eb979fbb2479bcd7e049f2f9978b6590dd8a0e6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a82984b3c6a7e8c7937dba6e857ddf829d149417\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b143e19dc28c3211f050f7848d87d9b0a170e10c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/beb99266830520e15fbc6ca8cc5a5240d76851fd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f0a068de65d5b7358e9aff792716afa9333f3922\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/0b45c25d60e38f5c2cb6823f886773a34323306d\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/237f3cf13b20db183d3706d997eedc3c49eacd44\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2a523f14a3f53b46ff0e1fafd215b0bc5f6783aa\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2eb979fbb2479bcd7e049f2f9978b6590dd8a0e6\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a82984b3c6a7e8c7937dba6e857ddf829d149417\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b143e19dc28c3211f050f7848d87d9b0a170e10c\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/beb99266830520e15fbc6ca8cc5a5240d76851fd\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f0a068de65d5b7358e9aff792716afa9333f3922\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-265688.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\"},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-613116.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-06-28T08:04:39+00:00",
      "cve": "CVE-2024-35976",
      "id": "CVE-2024-35976",
      "initial_release_date": "2024-05-20T00:00:00+00:00",
      "product_status:fixed": "280",
      "product_status:known_affected": "70",
      "product_status:known_not_affected": "50",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-35976.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-09T00:33:07Z",
      "cve": "CVE-2024-35976",
      "id": "CVE-2024-35976",
      "initial_release_date": "2024-05-21T01:58:35Z",
      "product_status:known_affected": "533",
      "product_status:known_not_affected": "86",
      "product_status:recommended": "736",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-35976",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-35976.json",
      "version": "94"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/beb99266830520e15fbc6ca8cc5a5240d76851fd\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/0b45c25d60e38f5c2cb6823f886773a34323306d\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/a82984b3c6a7e8c7937dba6e857ddf829d149417\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/f0a068de65d5b7358e9aff792716afa9333f3922\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/2a523f14a3f53b46ff0e1fafd215b0bc5f6783aa\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/b143e19dc28c3211f050f7848d87d9b0a170e10c\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/2eb979fbb2479bcd7e049f2f9978b6590dd8a0e6\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/237f3cf13b20db183d3706d997eedc3c49eacd44\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-04T17:20:53.592Z\"}}, {\"affected\": [{\"vendor\": \"Siemens\", \"product\": \"RUGGEDCOM RST2428P\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"V3.1\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SCALANCE XCM-/XRM-/XCH-/XRH-300 family\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"V3.1\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"x_adpType\": \"supplier\", \"references\": [{\"url\": \"https://cert-portal.siemens.com/productcert/html/ssa-265688.html\"}, {\"url\": \"https://cert-portal.siemens.com/productcert/html/ssa-613116.html\"}], \"providerMetadata\": {\"orgId\": \"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\", \"shortName\": \"siemens-SADP\", \"dateUpdated\": \"2026-05-12T11:53:21.943Z\"}}, {\"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.7, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-35976\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-20T14:37:56.972231Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:4.18:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.18\"}], \"defaultStatus\": \"unknown\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-787\", \"description\": \"CWE-787 Out-of-bounds Write\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-20T14:23:47.544Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.1, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerability is reached purely through the local `setsockopt(2)` syscall on an AF_XDP socket; no network input is processed. There is no remote or adjacent-network trigger for `xsk_setsockopt()`.\\nAC:L - A single deterministic `setsockopt(fd, SOL_XDP, XDP_UMEM_FILL_RING, buf, 2)` call triggers the over-read every time \\u2014 no race, no memory-layout grooming, and no condition outside the attacker\u0027s control. The attacker fully controls the short `optlen` value that causes the unchecked 4-byte copy.\\nPR:L - Creating the AF_XDP socket needs `ns_capable(net-\u003euser_ns, CAP_NET_RAW)`, which any unprivileged user obtains with `unshare -Urn`, and which containers (Docker\u0027s default set) grant outright. No real root in the initial namespace is required.\\nUI:N - The attacker performs the entire sequence \\u2014 socket creation and the malformed setsockopt \\u2014 in its own process. No victim action, mount, or file open is needed.\\nS:U - The over-read and its consequences stay within the kernel\u0027s own security authority on the same host. No VM, IOMMU, or sandbox boundary is crossed.\\nC:H - The unchecked `memcpy()` reads kernel slab memory beyond the allocated object into `entries`, exposing uninitialized/adjacent heap residue that the attacker can subsequently observe via the resulting ring size through `xsk_mmap()`\u0027s size validation. Out-of-bounds reads of kernel heap are scored High.\\nI:N - The defect is strictly a read; no out-of-bounds write, type confusion, or control-flow corruption occurs. The `entries` value it influences is already fully attacker-supplied through the legitimate path, so no integrity is gained.\\nA:H - The access is a KASAN-detected slab out-of-bounds read that produces a kernel splat and panics on builds running `panic_on_warn`, and the resulting garbage ring size drives failing large vmalloc allocations. Any such memory-safety violation is scored as a High availability impact.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"423f38329d267969130fb6f2c685f73d72687558\", \"lessThan\": \"beb99266830520e15fbc6ca8cc5a5240d76851fd\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"423f38329d267969130fb6f2c685f73d72687558\", \"lessThan\": \"0b45c25d60e38f5c2cb6823f886773a34323306d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"423f38329d267969130fb6f2c685f73d72687558\", \"lessThan\": \"a82984b3c6a7e8c7937dba6e857ddf829d149417\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"423f38329d267969130fb6f2c685f73d72687558\", \"lessThan\": \"f0a068de65d5b7358e9aff792716afa9333f3922\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"423f38329d267969130fb6f2c685f73d72687558\", \"lessThan\": \"2a523f14a3f53b46ff0e1fafd215b0bc5f6783aa\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"423f38329d267969130fb6f2c685f73d72687558\", \"lessThan\": \"b143e19dc28c3211f050f7848d87d9b0a170e10c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"423f38329d267969130fb6f2c685f73d72687558\", \"lessThan\": \"2eb979fbb2479bcd7e049f2f9978b6590dd8a0e6\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"423f38329d267969130fb6f2c685f73d72687558\", \"lessThan\": \"237f3cf13b20db183d3706d997eedc3c49eacd44\", \"versionType\": \"git\"}], \"programFiles\": [\"net/xdp/xsk.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.18\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.18\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.19.317\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.278\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.216\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.156\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.87\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.28\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.7\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/xdp/xsk.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/beb99266830520e15fbc6ca8cc5a5240d76851fd\"}, {\"url\": \"https://git.kernel.org/stable/c/0b45c25d60e38f5c2cb6823f886773a34323306d\"}, {\"url\": \"https://git.kernel.org/stable/c/a82984b3c6a7e8c7937dba6e857ddf829d149417\"}, {\"url\": \"https://git.kernel.org/stable/c/f0a068de65d5b7358e9aff792716afa9333f3922\"}, {\"url\": \"https://git.kernel.org/stable/c/2a523f14a3f53b46ff0e1fafd215b0bc5f6783aa\"}, {\"url\": \"https://git.kernel.org/stable/c/b143e19dc28c3211f050f7848d87d9b0a170e10c\"}, {\"url\": \"https://git.kernel.org/stable/c/2eb979fbb2479bcd7e049f2f9978b6590dd8a0e6\"}, {\"url\": \"https://git.kernel.org/stable/c/237f3cf13b20db183d3706d997eedc3c49eacd44\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nxsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING\\n\\nsyzbot reported an illegal copy in xsk_setsockopt() [1]\\n\\nMake sure to validate setsockopt() @optlen parameter.\\n\\n[1]\\n\\n BUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset include/linux/sockptr.h:49 [inline]\\n BUG: KASAN: slab-out-of-bounds in copy_from_sockptr include/linux/sockptr.h:55 [inline]\\n BUG: KASAN: slab-out-of-bounds in xsk_setsockopt+0x909/0xa40 net/xdp/xsk.c:1420\\nRead of size 4 at addr ffff888028c6cde3 by task syz-executor.0/7549\\n\\nCPU: 0 PID: 7549 Comm: syz-executor.0 Not tainted 6.8.0-syzkaller-08951-gfe46a7dd189e #0\\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024\\nCall Trace:\\n \u003cTASK\u003e\\n  __dump_stack lib/dump_stack.c:88 [inline]\\n  dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114\\n  print_address_description mm/kasan/report.c:377 [inline]\\n  print_report+0x169/0x550 mm/kasan/report.c:488\\n  kasan_report+0x143/0x180 mm/kasan/report.c:601\\n  copy_from_sockptr_offset include/linux/sockptr.h:49 [inline]\\n  copy_from_sockptr include/linux/sockptr.h:55 [inline]\\n  xsk_setsockopt+0x909/0xa40 net/xdp/xsk.c:1420\\n  do_sock_setsockopt+0x3af/0x720 net/socket.c:2311\\n  __sys_setsockopt+0x1ae/0x250 net/socket.c:2334\\n  __do_sys_setsockopt net/socket.c:2343 [inline]\\n  __se_sys_setsockopt net/socket.c:2340 [inline]\\n  __x64_sys_setsockopt+0xb5/0xd0 net/socket.c:2340\\n do_syscall_64+0xfb/0x240\\n entry_SYSCALL_64_after_hwframe+0x6d/0x75\\nRIP: 0033:0x7fb40587de69\\nCode: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48\\nRSP: 002b:00007fb40665a0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000036\\nRAX: ffffffffffffffda RBX: 00007fb4059abf80 RCX: 00007fb40587de69\\nRDX: 0000000000000005 RSI: 000000000000011b RDI: 0000000000000006\\nRBP: 00007fb4058ca47a R08: 0000000000000002 R09: 0000000000000000\\nR10: 0000000020001980 R11: 0000000000000246 R12: 0000000000000000\\nR13: 000000000000000b R14: 00007fb4059abf80 R15: 00007fff57ee4d08\\n \u003c/TASK\u003e\\n\\nAllocated by task 7549:\\n  kasan_save_stack mm/kasan/common.c:47 [inline]\\n  kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\\n  poison_kmalloc_redzone mm/kasan/common.c:370 [inline]\\n  __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:387\\n  kasan_kmalloc include/linux/kasan.h:211 [inline]\\n  __do_kmalloc_node mm/slub.c:3966 [inline]\\n  __kmalloc+0x233/0x4a0 mm/slub.c:3979\\n  kmalloc include/linux/slab.h:632 [inline]\\n  __cgroup_bpf_run_filter_setsockopt+0xd2f/0x1040 kernel/bpf/cgroup.c:1869\\n  do_sock_setsockopt+0x6b4/0x720 net/socket.c:2293\\n  __sys_setsockopt+0x1ae/0x250 net/socket.c:2334\\n  __do_sys_setsockopt net/socket.c:2343 [inline]\\n  __se_sys_setsockopt net/socket.c:2340 [inline]\\n  __x64_sys_setsockopt+0xb5/0xd0 net/socket.c:2340\\n do_syscall_64+0xfb/0x240\\n entry_SYSCALL_64_after_hwframe+0x6d/0x75\\n\\nThe buggy address belongs to the object at ffff888028c6cde0\\n which belongs to the cache kmalloc-8 of size 8\\nThe buggy address is located 1 bytes to the right of\\n allocated 2-byte region [ffff888028c6cde0, ffff888028c6cde2)\\n\\nThe buggy address belongs to the physical page:\\npage:ffffea0000a31b00 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888028c6c9c0 pfn:0x28c6c\\nanon flags: 0xfff00000000800(slab|node=0|zone=1|lastcpupid=0x7ff)\\npage_type: 0xffffffff()\\nraw: 00fff00000000800 ffff888014c41280 0000000000000000 dead000000000001\\nraw: ffff888028c6c9c0 0000000080800057 00000001ffffffff 0000000000000000\\npage dumped because: kasan: bad access detected\\npage_owner tracks the page as allocated\\npage last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 6648, tgid 6644 (syz-executor.0), ts 133906047828, free_ts 133859922223\\n  set_page_owner include/linux/page_owner.h:31 [inline]\\n  post_alloc_hook+0x1ea/0x210 mm/page_alloc.c:1533\\n  prep_new_page mm/page_alloc.c:\\n---truncated---\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.317\", \"versionStartIncluding\": \"4.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.278\", \"versionStartIncluding\": \"4.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.216\", \"versionStartIncluding\": \"4.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.156\", \"versionStartIncluding\": \"4.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.87\", \"versionStartIncluding\": \"4.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.28\", \"versionStartIncluding\": \"4.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.7\", \"versionStartIncluding\": \"4.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9\", \"versionStartIncluding\": \"4.18\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:31:20.690Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-35976\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:31:20.690Z\", \"dateReserved\": \"2024-05-17T13:50:33.143Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-20T09:42:02.415Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.