GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-47659 (GCVE-0-2024-47659)

Vulnerability from cvelistv5 – Published: 2024-10-09 14:02 – Updated: 2026-08-05 11:39
VLAI
Title
smack: tcp: ipv4, fix incorrect labeling
Summary
In the Linux kernel, the following vulnerability has been resolved: smack: tcp: ipv4, fix incorrect labeling Currently, Smack mirrors the label of incoming tcp/ipv4 connections: when a label 'foo' connects to a label 'bar' with tcp/ipv4, 'foo' always gets 'foo' in returned ipv4 packets. So, 1) returned packets are incorrectly labeled ('foo' instead of 'bar') 2) 'bar' can write to 'foo' without being authorized to write. Here is a scenario how to see this: * Take two machines, let's call them C and S, with active Smack in the default state (no settings, no rules, no labeled hosts, only builtin labels) * At S, add Smack rule 'foo bar w' (labels 'foo' and 'bar' are instantiated at S at this moment) * At S, at label 'bar', launch a program that listens for incoming tcp/ipv4 connections * From C, at label 'foo', connect to the listener at S. (label 'foo' is instantiated at C at this moment) Connection succeedes and works. * Send some data in both directions. * Collect network traffic of this connection. All packets in both directions are labeled with the CIPSO of the label 'foo'. Hence, label 'bar' writes to 'foo' without being authorized, and even without ever being known at C. If anybody cares: exactly the same happens with DCCP. This behavior 1st manifested in release 2.6.29.4 (see Fixes below) and it looks unintentional. At least, no explanation was provided. I changed returned packes label into the 'bar', to bring it into line with the Smack documentation claims.
Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-10 13:23 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 07feee8f812f7327a46186f7604df312c8c81962 , < d3f56c653c65f170b172d3c23120bc64ada645d8 (git)
Affected: 07feee8f812f7327a46186f7604df312c8c81962 , < 5b4b304f196c070342e32a4752e1fa2e22fc0671 (git)
Affected: 07feee8f812f7327a46186f7604df312c8c81962 , < a948ec993541db4ef392b555c37a1186f4d61670 (git)
Affected: 07feee8f812f7327a46186f7604df312c8c81962 , < 0aea09e82eafa50a373fc8a4b84c1d4734751e2c (git)
Affected: 07feee8f812f7327a46186f7604df312c8c81962 , < 0776bcf9cb6de46fdd94d10118de1cf9b05f83b9 (git)
Affected: 07feee8f812f7327a46186f7604df312c8c81962 , < 4be9fd15c3c88775bdf6fa37acabe6de85beebff (git)
Affected: 07feee8f812f7327a46186f7604df312c8c81962 , < d3703fa94116fed91f64c7d1c7d284fb4369070f (git)
Affected: 07feee8f812f7327a46186f7604df312c8c81962 , < 2fe209d0ad2e2729f7e22b9b31a86cc3ff0db550 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.30
Unaffected: 0 , < 2.6.30 (semver)
Unaffected: 4.19.322 , ≤ 4.19.* (semver)
Unaffected: 5.4.284 , ≤ 5.4.* (semver)
Unaffected: 5.10.226 , ≤ 5.10.* (semver)
Unaffected: 5.15.167 , ≤ 5.15.* (semver)
Unaffected: 6.1.109 , ≤ 6.1.* (semver)
Unaffected: 6.6.50 , ≤ 6.6.* (semver)
Unaffected: 6.10.9 , ≤ 6.10.* (semver)
Unaffected: 6.11 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47659",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-10T13:23:30.727932Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-10T13:23:46.221Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:20:23.105Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "security/smack/smack_lsm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d3f56c653c65f170b172d3c23120bc64ada645d8",
              "status": "affected",
              "version": "07feee8f812f7327a46186f7604df312c8c81962",
              "versionType": "git"
            },
            {
              "lessThan": "5b4b304f196c070342e32a4752e1fa2e22fc0671",
              "status": "affected",
              "version": "07feee8f812f7327a46186f7604df312c8c81962",
              "versionType": "git"
            },
            {
              "lessThan": "a948ec993541db4ef392b555c37a1186f4d61670",
              "status": "affected",
              "version": "07feee8f812f7327a46186f7604df312c8c81962",
              "versionType": "git"
            },
            {
              "lessThan": "0aea09e82eafa50a373fc8a4b84c1d4734751e2c",
              "status": "affected",
              "version": "07feee8f812f7327a46186f7604df312c8c81962",
              "versionType": "git"
            },
            {
              "lessThan": "0776bcf9cb6de46fdd94d10118de1cf9b05f83b9",
              "status": "affected",
              "version": "07feee8f812f7327a46186f7604df312c8c81962",
              "versionType": "git"
            },
            {
              "lessThan": "4be9fd15c3c88775bdf6fa37acabe6de85beebff",
              "status": "affected",
              "version": "07feee8f812f7327a46186f7604df312c8c81962",
              "versionType": "git"
            },
            {
              "lessThan": "d3703fa94116fed91f64c7d1c7d284fb4369070f",
              "status": "affected",
              "version": "07feee8f812f7327a46186f7604df312c8c81962",
              "versionType": "git"
            },
            {
              "lessThan": "2fe209d0ad2e2729f7e22b9b31a86cc3ff0db550",
              "status": "affected",
              "version": "07feee8f812f7327a46186f7604df312c8c81962",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "security/smack/smack_lsm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.30"
            },
            {
              "lessThan": "2.6.30",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.322",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.284",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.226",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.167",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.322",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.284",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.226",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.167",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.109",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.50",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.9",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmack: tcp: ipv4, fix incorrect labeling\n\nCurrently, Smack mirrors the label of incoming tcp/ipv4 connections:\nwhen a label \u0027foo\u0027 connects to a label \u0027bar\u0027 with tcp/ipv4,\n\u0027foo\u0027 always gets \u0027foo\u0027 in returned ipv4 packets. So,\n1) returned packets are incorrectly labeled (\u0027foo\u0027 instead of \u0027bar\u0027)\n2) \u0027bar\u0027 can write to \u0027foo\u0027 without being authorized to write.\n\nHere is a scenario how to see this:\n\n* Take two machines, let\u0027s call them C and S,\n   with active Smack in the default state\n   (no settings, no rules, no labeled hosts, only builtin labels)\n\n* At S, add Smack rule \u0027foo bar w\u0027\n   (labels \u0027foo\u0027 and \u0027bar\u0027 are instantiated at S at this moment)\n\n* At S, at label \u0027bar\u0027, launch a program\n   that listens for incoming tcp/ipv4 connections\n\n* From C, at label \u0027foo\u0027, connect to the listener at S.\n   (label \u0027foo\u0027 is instantiated at C at this moment)\n   Connection succeedes and works.\n\n* Send some data in both directions.\n* Collect network traffic of this connection.\n\nAll packets in both directions are labeled with the CIPSO\nof the label \u0027foo\u0027. Hence, label \u0027bar\u0027 writes to \u0027foo\u0027 without\nbeing authorized, and even without ever being known at C.\n\nIf anybody cares: exactly the same happens with DCCP.\n\nThis behavior 1st manifested in release 2.6.29.4 (see Fixes below)\nand it looks unintentional. At least, no explanation was provided.\n\nI changed returned packes label into the \u0027bar\u0027,\nto bring it into line with the Smack documentation claims."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The flaw is in the `inet_conn_request` LSM hook reached from `tcp_v4_route_req()`/`tcp_conn_request()` on receipt of a TCP/IPv4 SYN, plus the syncookie and DCCP paths, so a remote peer triggers it by connecting over routable IPv4. The attacker-supplied CIPSO tag in the incoming packet is what selects the wrong label, making the attack entirely remote and packet-driven.\nAC:L - The mislabeling is deterministic \u2014 no race, no memory-layout dependence, no timing window; every accepted TCP/IPv4 connection from a host absent from the netlabel host list (the default Smack state) is mislabeled. CIPSO labeling is enabled by default at smackfs init and the built-in labels are pre-populated, so no unusual tuning is needed beyond Smack being the active LSM.\nPR:N - The hook runs during SYN processing, before the three-way handshake completes and long before any application-level authentication, so the attacker holds no credentials on the target. The attacker further chooses the CIPSO label presented (e.g. the built-in `@`/web label, which `smk_access()` grants against any object), so no policy-granted standing is required either.\nUI:N - Exploitation needs only a listening socket on the target; no administrator or user on the victim system must open, mount, or click anything. The connection and all subsequent mislabeled traffic are driven entirely by the attacker.\nS:U - The mislabeling and the resulting authorization failure both occur within the kernel\u0027s Smack MAC enforcement, the same security authority that owns the vulnerable code. No virtualization, IOMMU, or hypervisor boundary is crossed.\nC:H - All data the server sends is stamped with an attacker-chosen label instead of the server process\u0027s real label, so the peer\u0027s receive-side `smk_access()` check and any CIPSO-aware network enforcement are bypassed and data from a confined or high-sensitivity domain is delivered to a domain with no authorization to read it. With the built-in `@` (web) label the emitted data becomes readable by every subject, a total loss of the confidentiality control for that connection.\nI:H - Because the reply packets carry the receiver\u0027s own label, `smk_access(skp, ssp-\u003esmk_in, MAY_WRITE)` is satisfied by Smack\u0027s unconditional same-label rule, so a policy rule forbidding the server domain from writing to the client domain is completely bypassed \u2014 the commit states \"\u0027bar\u0027 can write to \u0027foo\u0027 without being authorized to write.\" Arbitrary data is injected into a MAC domain that must not be written to, a total failure of the integrity control for that flow.\nA:N - The bug causes packets to carry the wrong security label; it produces no crash, oops, hang, deadlock, or resource exhaustion. Connections continue to operate normally \u2014 indeed more permissively than policy intends."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:39:15.379Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d3f56c653c65f170b172d3c23120bc64ada645d8"
        },
        {
          "url": "https://git.kernel.org/stable/c/5b4b304f196c070342e32a4752e1fa2e22fc0671"
        },
        {
          "url": "https://git.kernel.org/stable/c/a948ec993541db4ef392b555c37a1186f4d61670"
        },
        {
          "url": "https://git.kernel.org/stable/c/0aea09e82eafa50a373fc8a4b84c1d4734751e2c"
        },
        {
          "url": "https://git.kernel.org/stable/c/0776bcf9cb6de46fdd94d10118de1cf9b05f83b9"
        },
        {
          "url": "https://git.kernel.org/stable/c/4be9fd15c3c88775bdf6fa37acabe6de85beebff"
        },
        {
          "url": "https://git.kernel.org/stable/c/d3703fa94116fed91f64c7d1c7d284fb4369070f"
        },
        {
          "url": "https://git.kernel.org/stable/c/2fe209d0ad2e2729f7e22b9b31a86cc3ff0db550"
        }
      ],
      "title": "smack: tcp: ipv4, fix incorrect labeling",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-47659",
    "datePublished": "2024-10-09T14:02:54.070Z",
    "dateReserved": "2024-09-30T16:00:12.935Z",
    "dateUpdated": "2026-08-05T11:39:15.379Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-47659",
      "date": "2026-09-17",
      "epss": "0.00775",
      "percentile": "0.54095"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "security/smack/smack_lsm.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "d3f56c653c65f170b172d3c23120bc64ada645d8",
                    "status": "affected",
                    "version": "07feee8f812f7327a46186f7604df312c8c81962",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5b4b304f196c070342e32a4752e1fa2e22fc0671",
                    "status": "affected",
                    "version": "07feee8f812f7327a46186f7604df312c8c81962",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a948ec993541db4ef392b555c37a1186f4d61670",
                    "status": "affected",
                    "version": "07feee8f812f7327a46186f7604df312c8c81962",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0aea09e82eafa50a373fc8a4b84c1d4734751e2c",
                    "status": "affected",
                    "version": "07feee8f812f7327a46186f7604df312c8c81962",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0776bcf9cb6de46fdd94d10118de1cf9b05f83b9",
                    "status": "affected",
                    "version": "07feee8f812f7327a46186f7604df312c8c81962",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4be9fd15c3c88775bdf6fa37acabe6de85beebff",
                    "status": "affected",
                    "version": "07feee8f812f7327a46186f7604df312c8c81962",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d3703fa94116fed91f64c7d1c7d284fb4369070f",
                    "status": "affected",
                    "version": "07feee8f812f7327a46186f7604df312c8c81962",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2fe209d0ad2e2729f7e22b9b31a86cc3ff0db550",
                    "status": "affected",
                    "version": "07feee8f812f7327a46186f7604df312c8c81962",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "security/smack/smack_lsm.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "2.6.30"
                  },
                  {
                    "lessThan": "2.6.30",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.19.*",
                    "status": "unaffected",
                    "version": "4.19.322",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.4.*",
                    "status": "unaffected",
                    "version": "5.4.284",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.226",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.167",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.109",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.50",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.10.*",
                    "status": "unaffected",
                    "version": "6.10.9",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.11",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "29162FB8-5FA4-4DC4-86CE-5EB0CAEEF2F3",
                    "versionEndExcluding": "4.19.322",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6265A402-9C3C-438F-BFC5-4194B2568B85",
                    "versionEndExcluding": "5.4.284",
                    "versionStartIncluding": "4.20",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "864FC17C-501A-4823-A643-6F35D65D8A97",
                    "versionEndExcluding": "5.10.226",
                    "versionStartIncluding": "5.5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "043405A4-25FE-45D4-A7BB-2A0C3B7D17C1",
                    "versionEndExcluding": "5.15.167",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "790F505A-7933-48F1-B038-380A8BC5C153",
                    "versionEndExcluding": "6.1.109",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A56A0460-B122-44D6-B0E6-26CE9C891536",
                    "versionEndExcluding": "6.6.50",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F4469C96-A86B-4CC3-B2D5-C21B6B72641B",
                    "versionEndExcluding": "6.10.9",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmack: tcp: ipv4, fix incorrect labeling\n\nCurrently, Smack mirrors the label of incoming tcp/ipv4 connections:\nwhen a label \u0027foo\u0027 connects to a label \u0027bar\u0027 with tcp/ipv4,\n\u0027foo\u0027 always gets \u0027foo\u0027 in returned ipv4 packets. So,\n1) returned packets are incorrectly labeled (\u0027foo\u0027 instead of \u0027bar\u0027)\n2) \u0027bar\u0027 can write to \u0027foo\u0027 without being authorized to write.\n\nHere is a scenario how to see this:\n\n* Take two machines, let\u0027s call them C and S,\n   with active Smack in the default state\n   (no settings, no rules, no labeled hosts, only builtin labels)\n\n* At S, add Smack rule \u0027foo bar w\u0027\n   (labels \u0027foo\u0027 and \u0027bar\u0027 are instantiated at S at this moment)\n\n* At S, at label \u0027bar\u0027, launch a program\n   that listens for incoming tcp/ipv4 connections\n\n* From C, at label \u0027foo\u0027, connect to the listener at S.\n   (label \u0027foo\u0027 is instantiated at C at this moment)\n   Connection succeedes and works.\n\n* Send some data in both directions.\n* Collect network traffic of this connection.\n\nAll packets in both directions are labeled with the CIPSO\nof the label \u0027foo\u0027. Hence, label \u0027bar\u0027 writes to \u0027foo\u0027 without\nbeing authorized, and even without ever being known at C.\n\nIf anybody cares: exactly the same happens with DCCP.\n\nThis behavior 1st manifested in release 2.6.29.4 (see Fixes below)\nand it looks unintentional. At least, no explanation was provided.\n\nI changed returned packes label into the \u0027bar\u0027,\nto bring it into line with the Smack documentation claims."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: smack: tcp: ipv4, corregir etiquetado incorrecto Actualmente, Smack refleja la etiqueta de las conexiones entrantes tcp/ipv4: cuando una etiqueta \u0027foo\u0027 se conecta a una etiqueta \u0027bar\u0027 con tcp/ipv4, \u0027foo\u0027 siempre obtiene \u0027foo\u0027 en los paquetes ipv4 devueltos. Por lo tanto, 1) los paquetes devueltos est\u00e1n etiquetados incorrectamente (\u0027foo\u0027 en lugar de \u0027bar\u0027) 2) \u0027bar\u0027 puede escribir en \u0027foo\u0027 sin estar autorizado para escribir. Aqu\u00ed hay un escenario para ver esto: * Tome dos m\u00e1quinas, llam\u00e9moslas C y S, con Smack activo en el estado predeterminado (sin configuraciones, sin reglas, sin hosts etiquetados, solo etiquetas incorporadas) * En S, agregue la regla de Smack \u0027foo bar w\u0027 (las etiquetas \u0027foo\u0027 y \u0027bar\u0027 est\u00e1n instanciadas en S en este momento) * En S, en la etiqueta \u0027bar\u0027, inicie un programa que escuche conexiones entrantes tcp/ipv4 * Desde C, en la etiqueta \u0027foo\u0027, con\u00e9ctese al oyente en S. (la etiqueta \u0027foo\u0027 est\u00e1 instanciada en C en este momento) La conexi\u00f3n es exitosa y funciona. * Env\u00ede algunos datos en ambas direcciones. * Recolecte tr\u00e1fico de red de esta conexi\u00f3n. Todos los paquetes en ambas direcciones est\u00e1n etiquetados con el CIPSO de la etiqueta \u0027foo\u0027. Por lo tanto, la etiqueta \u0027bar\u0027 escribe en \u0027foo\u0027 sin estar autorizada, e incluso sin ser conocida en C. Si a alguien le importa: exactamente lo mismo sucede con DCCP. Este comportamiento se manifest\u00f3 por primera vez en la versi\u00f3n 2.6.29.4 (ver Correcciones a continuaci\u00f3n) y parece no ser intencional. Al menos, no se proporcion\u00f3 ninguna explicaci\u00f3n. Cambi\u00e9 la etiqueta de los paquetes devueltos por \"barra\" para que coincida con lo que afirma la documentaci\u00f3n de Smack."
          }
        ],
        "id": "CVE-2024-47659",
        "lastModified": "2026-08-04T11:20:36.587",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 9.1,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.2,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-47659",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-10T13:23:30.727932Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-10-09T14:15:07.660",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/0776bcf9cb6de46fdd94d10118de1cf9b05f83b9"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/0aea09e82eafa50a373fc8a4b84c1d4734751e2c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/2fe209d0ad2e2729f7e22b9b31a86cc3ff0db550"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/4be9fd15c3c88775bdf6fa37acabe6de85beebff"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/5b4b304f196c070342e32a4752e1fa2e22fc0671"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/a948ec993541db4ef392b555c37a1186f4d61670"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/d3703fa94116fed91f64c7d1c7d284fb4369070f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/d3f56c653c65f170b172d3c23120bc64ada645d8"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-05T03:21:13+00:00",
      "cve": "CVE-2024-47659",
      "id": "CVE-2024-47659",
      "initial_release_date": "2024-10-09T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: smack: tcp: ipv4, fix incorrect labeling",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-47659.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2025-11-03T22:20:23.105Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-47659",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-10-10T13:23:30.727932Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-10-10T13:23:34.501Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "security/smack/smack_lsm.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "d3f56c653c65f170b172d3c23120bc64ada645d8",
                  "status": "affected",
                  "version": "07feee8f812f7327a46186f7604df312c8c81962",
                  "versionType": "git"
                },
                {
                  "lessThan": "5b4b304f196c070342e32a4752e1fa2e22fc0671",
                  "status": "affected",
                  "version": "07feee8f812f7327a46186f7604df312c8c81962",
                  "versionType": "git"
                },
                {
                  "lessThan": "a948ec993541db4ef392b555c37a1186f4d61670",
                  "status": "affected",
                  "version": "07feee8f812f7327a46186f7604df312c8c81962",
                  "versionType": "git"
                },
                {
                  "lessThan": "0aea09e82eafa50a373fc8a4b84c1d4734751e2c",
                  "status": "affected",
                  "version": "07feee8f812f7327a46186f7604df312c8c81962",
                  "versionType": "git"
                },
                {
                  "lessThan": "0776bcf9cb6de46fdd94d10118de1cf9b05f83b9",
                  "status": "affected",
                  "version": "07feee8f812f7327a46186f7604df312c8c81962",
                  "versionType": "git"
                },
                {
                  "lessThan": "4be9fd15c3c88775bdf6fa37acabe6de85beebff",
                  "status": "affected",
                  "version": "07feee8f812f7327a46186f7604df312c8c81962",
                  "versionType": "git"
                },
                {
                  "lessThan": "d3703fa94116fed91f64c7d1c7d284fb4369070f",
                  "status": "affected",
                  "version": "07feee8f812f7327a46186f7604df312c8c81962",
                  "versionType": "git"
                },
                {
                  "lessThan": "2fe209d0ad2e2729f7e22b9b31a86cc3ff0db550",
                  "status": "affected",
                  "version": "07feee8f812f7327a46186f7604df312c8c81962",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "security/smack/smack_lsm.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "2.6.30"
                },
                {
                  "lessThan": "2.6.30",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "4.19.*",
                  "status": "unaffected",
                  "version": "4.19.322",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.4.*",
                  "status": "unaffected",
                  "version": "5.4.284",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.10.*",
                  "status": "unaffected",
                  "version": "5.10.226",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.15.*",
                  "status": "unaffected",
                  "version": "5.15.167",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.1.*",
                  "status": "unaffected",
                  "version": "6.1.109",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.6.*",
                  "status": "unaffected",
                  "version": "6.6.50",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.10.*",
                  "status": "unaffected",
                  "version": "6.10.9",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.11",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "4.19.322",
                      "versionStartIncluding": "2.6.30",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.4.284",
                      "versionStartIncluding": "2.6.30",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.10.226",
                      "versionStartIncluding": "2.6.30",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.15.167",
                      "versionStartIncluding": "2.6.30",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.1.109",
                      "versionStartIncluding": "2.6.30",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.6.50",
                      "versionStartIncluding": "2.6.30",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.10.9",
                      "versionStartIncluding": "2.6.30",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.11",
                      "versionStartIncluding": "2.6.30",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmack: tcp: ipv4, fix incorrect labeling\n\nCurrently, Smack mirrors the label of incoming tcp/ipv4 connections:\nwhen a label \u0027foo\u0027 connects to a label \u0027bar\u0027 with tcp/ipv4,\n\u0027foo\u0027 always gets \u0027foo\u0027 in returned ipv4 packets. So,\n1) returned packets are incorrectly labeled (\u0027foo\u0027 instead of \u0027bar\u0027)\n2) \u0027bar\u0027 can write to \u0027foo\u0027 without being authorized to write.\n\nHere is a scenario how to see this:\n\n* Take two machines, let\u0027s call them C and S,\n   with active Smack in the default state\n   (no settings, no rules, no labeled hosts, only builtin labels)\n\n* At S, add Smack rule \u0027foo bar w\u0027\n   (labels \u0027foo\u0027 and \u0027bar\u0027 are instantiated at S at this moment)\n\n* At S, at label \u0027bar\u0027, launch a program\n   that listens for incoming tcp/ipv4 connections\n\n* From C, at label \u0027foo\u0027, connect to the listener at S.\n   (label \u0027foo\u0027 is instantiated at C at this moment)\n   Connection succeedes and works.\n\n* Send some data in both directions.\n* Collect network traffic of this connection.\n\nAll packets in both directions are labeled with the CIPSO\nof the label \u0027foo\u0027. Hence, label \u0027bar\u0027 writes to \u0027foo\u0027 without\nbeing authorized, and even without ever being known at C.\n\nIf anybody cares: exactly the same happens with DCCP.\n\nThis behavior 1st manifested in release 2.6.29.4 (see Fixes below)\nand it looks unintentional. At least, no explanation was provided.\n\nI changed returned packes label into the \u0027bar\u0027,\nto bring it into line with the Smack documentation claims."
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-01-05T10:53:46.120Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/d3f56c653c65f170b172d3c23120bc64ada645d8"
            },
            {
              "url": "https://git.kernel.org/stable/c/5b4b304f196c070342e32a4752e1fa2e22fc0671"
            },
            {
              "url": "https://git.kernel.org/stable/c/a948ec993541db4ef392b555c37a1186f4d61670"
            },
            {
              "url": "https://git.kernel.org/stable/c/0aea09e82eafa50a373fc8a4b84c1d4734751e2c"
            },
            {
              "url": "https://git.kernel.org/stable/c/0776bcf9cb6de46fdd94d10118de1cf9b05f83b9"
            },
            {
              "url": "https://git.kernel.org/stable/c/4be9fd15c3c88775bdf6fa37acabe6de85beebff"
            },
            {
              "url": "https://git.kernel.org/stable/c/d3703fa94116fed91f64c7d1c7d284fb4369070f"
            },
            {
              "url": "https://git.kernel.org/stable/c/2fe209d0ad2e2729f7e22b9b31a86cc3ff0db550"
            }
          ],
          "title": "smack: tcp: ipv4, fix incorrect labeling",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2024-47659",
        "datePublished": "2024-10-09T14:02:54.070Z",
        "dateReserved": "2024-09-30T16:00:12.935Z",
        "dateUpdated": "2026-01-05T10:53:46.120Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.