SECUFOCUSNOW
Home›CVE index›CVE-2024-57982
Review reviewHigh

CVE-2024-57982

Linux Linux, linux kernel

In the Linux kernel, the following vulnerability has been resolved: xfrm: state: fix out-of-bounds read during lookup lookup and resize can run in parallel. The xfrm_state_hash_generation seqlock ensures a retry, but the hash functions can observe a hmask value that is too large for the new hlist array. rehash does: rcu_assign_pointer(net->xfrm.state_bydst, ndst) [..] net->xfrm.state_hmask = nhashmask; While state lookup does: h = xfrm_dst_hash(net, daddr, saddr, tmpl->reqid, encap_family); hlist_for_each_entry_rcu(x, net->xfrm.state_bydst + h, bydst) { This is only safe in case the update...

CVSS
7.1
EPSS
-
- percentile
CISA KEV
Not listed
Published
2025.02.27
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability-
Technical severityCVSS 7.1

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: xfrm: state: fix out-of-bounds read during lookup lookup and resize can run in parallel. The xfrm_state_hash_generation seqlock ensures a retry, but the hash functions can observe a hmask value that is too large for the new hlist array. rehash does: rcu_assign_pointer(net->xfrm.state_bydst, ndst) [..] net->xfrm.state_hmask = nhashmask; While state lookup does: h = xfrm_dst_hash(net, daddr, saddr, tmpl->reqid, encap_family); hlist_for_each_entry_rcu(x, net->xfrm.state_bydst + h, bydst) { This is only safe in case the update...

Affected product and versions

Product
Linux Linux, linux kernel
Affected versions
>= c2f672fc94642bae96821a393f342edcfa9794a6 < b86dc510308d7a8955f3f47a4fea4bef887653e4, >= c2f672fc94642bae96821a393f342edcfa9794a6 < a16871c7832ea6435abb6e0b58289ae7dcb7e4fc, >= c2f672fc94642bae96821a393f342edcfa9794a6 < dd4c2a174994238d55ab54da2545543d36f4e0d0, >= c2f672fc94642bae96821a393f342edcfa9794a6 < e952837f3ddb0ff726d5b582aa1aad9aa38d024d, >= 4.9, >= 4.9 < 6.12.13, >= 6.13 < 6.13.2
Fixed versions
6.12.13, 6.13.2

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux Linux, linux kernel and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CWE
CWE-125