GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-49568 (GCVE-0-2024-49568)

Vulnerability from cvelistv5 – Published: 2025-01-11 12:35 – Updated: 2026-08-05 11:40
VLAI
Title
net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg
Summary
In the Linux kernel, the following vulnerability has been resolved: net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg When receiving proposal msg in server, the fields v2_ext_offset/ eid_cnt/ism_gid_cnt in proposal msg are from the remote client and can not be fully trusted. Especially the field v2_ext_offset, once exceed the max value, there has the chance to access wrong address, and crash may happen. This patch checks the fields v2_ext_offset/eid_cnt/ism_gid_cnt before using them.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 8c3dca341aea885249e08856c4380300b75d2cf5 , < 295a92e3df32e72aff0f4bc25c310e349d07ffbf (git)
Affected: 8c3dca341aea885249e08856c4380300b75d2cf5 , < 42f6beb2d5779429417b5f8115a4e3fa695d2a6c (git)
Affected: 8c3dca341aea885249e08856c4380300b75d2cf5 , < 7863c9f3d24ba49dbead7e03dfbe40deb5888fdf (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.10
Unaffected: 0 , < 5.10 (semver)
Unaffected: 6.6.68 , ≤ 6.6.* (semver)
Unaffected: 6.12.7 , ≤ 6.12.* (semver)
Unaffected: 6.13 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/smc/af_smc.c",
            "net/smc/smc_clc.c",
            "net/smc/smc_clc.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "295a92e3df32e72aff0f4bc25c310e349d07ffbf",
              "status": "affected",
              "version": "8c3dca341aea885249e08856c4380300b75d2cf5",
              "versionType": "git"
            },
            {
              "lessThan": "42f6beb2d5779429417b5f8115a4e3fa695d2a6c",
              "status": "affected",
              "version": "8c3dca341aea885249e08856c4380300b75d2cf5",
              "versionType": "git"
            },
            {
              "lessThan": "7863c9f3d24ba49dbead7e03dfbe40deb5888fdf",
              "status": "affected",
              "version": "8c3dca341aea885249e08856c4380300b75d2cf5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/smc/af_smc.c",
            "net/smc/smc_clc.c",
            "net/smc/smc_clc.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.10"
            },
            {
              "lessThan": "5.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.68",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.68",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.7",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg\n\nWhen receiving proposal msg in server, the fields v2_ext_offset/\neid_cnt/ism_gid_cnt in proposal msg are from the remote client\nand can not be fully trusted. Especially the field v2_ext_offset,\nonce exceed the max value, there has the chance to access wrong\naddress, and crash may happen.\n\nThis patch checks the fields v2_ext_offset/eid_cnt/ism_gid_cnt\nbefore using them."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The malformed CLC proposal arrives as ordinary TCP payload from a remote peer on an SMC-enabled listening socket and is parsed by `smc_listen_work()`/`smc_clc_wait_msg()`. No local access or network adjacency is needed \u2014 any host that can reach the listener can trigger it.\nAC:L - The attacker controls every field involved (`version`, `typev1`, `typev2`, `iparea_offset`, `v2_ext_offset`) and an 8-byte payload deterministically produces the NULL dereference; the wild-pointer variant needs only a chosen 16-bit offset. No race, no memory-layout precondition, no state outside the attacker\u0027s control.\nPR:N - The CLC handshake runs immediately after the TCP three-way handshake, entirely before any application-level authentication, and `smc_clc_msg_prop_valid()` is the first validation performed on the peer\u0027s data. An unauthenticated remote attacker reaches it.\nUI:N - The kernel\u0027s listen worker parses the proposal automatically on connection accept; no local user or administrator action is required.\nS:U - The wild-pointer reads, writes and crash all occur within the kernel\u0027s own security authority; no VM, IOMMU or sandbox boundary is crossed.\nC:H - `v2_ext_offset` up to 65535 (vs. a legitimate max of 172) points the parser up to ~64 KB past a ~676-byte slab object, and the OOB-read `smcd_v2_ext_offset` extends that another 64 KB; `smc_clc_match_eid()` scans up to 8 KB of it and the OOB-read `max_conns`/`max_links` are negotiated and reflected back to the attacker. This is a wide, attacker-directed kernel memory read, not a bounded few-byte leak.\nI:H - Removing the `ism_gid_cnt` bound lets `smc_check_ism_v2_match()` write attacker-supplied 64-bit GIDs, `smcd_dev` pointers and CHIDs past the 9-element `ism_peer_gid`/`ism_dev`/`ism_chid` arrays in the kzalloc\u0027d `struct smc_init_info` on hosts with \u226510 SMC-D devices, and uncontrolled OOB-read bytes (`roce[]`, `system_eid`, GIDs) are installed as the link group\u0027s RDMA/ISM connection parameters.\nA:H - An 8-byte packet yields a guaranteed NULL-pointer oops in the `smc_hs_wq` worker while `lock_sock()` is held (full panic under `panic_on_oops`), and the wild-pointer faults occur while holding the global `smc_server_lgr_pending` mutex, permanently deadlocking every subsequent SMC server handshake. It is repeatable at will from an unauthenticated connection."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:40:00.300Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/295a92e3df32e72aff0f4bc25c310e349d07ffbf"
        },
        {
          "url": "https://git.kernel.org/stable/c/42f6beb2d5779429417b5f8115a4e3fa695d2a6c"
        },
        {
          "url": "https://git.kernel.org/stable/c/7863c9f3d24ba49dbead7e03dfbe40deb5888fdf"
        }
      ],
      "title": "net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-49568",
    "datePublished": "2025-01-11T12:35:36.190Z",
    "dateReserved": "2025-01-11T12:34:02.664Z",
    "dateUpdated": "2026-08-05T11:40:00.300Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-49568",
      "date": "2026-09-19",
      "epss": "0.00524",
      "percentile": "0.43412"
    },
    "microsoft_vex": {
      "current_release_date": "2026-03-31T14:41:20.000Z",
      "cve": "CVE-2024-49568",
      "id": "msrc_CVE-2024-49568",
      "initial_release_date": "2025-01-02T00:00:00.000Z",
      "product_status:known_affected": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2024-49568.json",
      "version": "3"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/smc/af_smc.c",
                  "net/smc/smc_clc.c",
                  "net/smc/smc_clc.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "295a92e3df32e72aff0f4bc25c310e349d07ffbf",
                    "status": "affected",
                    "version": "8c3dca341aea885249e08856c4380300b75d2cf5",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "42f6beb2d5779429417b5f8115a4e3fa695d2a6c",
                    "status": "affected",
                    "version": "8c3dca341aea885249e08856c4380300b75d2cf5",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7863c9f3d24ba49dbead7e03dfbe40deb5888fdf",
                    "status": "affected",
                    "version": "8c3dca341aea885249e08856c4380300b75d2cf5",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/smc/af_smc.c",
                  "net/smc/smc_clc.c",
                  "net/smc/smc_clc.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.10"
                  },
                  {
                    "lessThan": "5.10",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.68",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.7",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.13",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F34747F2-80C3-4A5F-B90C-8AA75BA74E17",
                    "versionEndExcluding": "6.6.68",
                    "versionStartIncluding": "5.10",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "811AC89A-14AC-49FA-9B54-E99526F1CA47",
                    "versionEndExcluding": "6.12.7",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "62567B3C-6CEE-46D0-BC2E-B3717FBF7D13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "5A073481-106D-4B15-B4C7-FB0213B8E1D4",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "DE491969-75AE-4A6B-9A58-8FC5AF98798F",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg\n\nWhen receiving proposal msg in server, the fields v2_ext_offset/\neid_cnt/ism_gid_cnt in proposal msg are from the remote client\nand can not be fully trusted. Especially the field v2_ext_offset,\nonce exceed the max value, there has the chance to access wrong\naddress, and crash may happen.\n\nThis patch checks the fields v2_ext_offset/eid_cnt/ism_gid_cnt\nbefore using them."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net/smc: comprobar v2_ext_offset/eid_cnt/ism_gid_cnt al recibir un mensaje de propuesta Al recibir un mensaje de propuesta en el servidor, los campos v2_ext_offset/eid_cnt/ism_gid_cnt en el mensaje de propuesta son del cliente remoto y no se puede confiar plenamente en ellos. Especialmente el campo v2_ext_offset, una vez que se excede el valor m\u00e1ximo, existe la posibilidad de acceder a una direcci\u00f3n incorrecta y puede producirse un bloqueo. Este parche comprueba los campos v2_ext_offset/eid_cnt/ism_gid_cnt antes de usarlos."
          }
        ],
        "id": "CVE-2024-49568",
        "lastModified": "2026-08-04T11:20:49.263",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2025-01-11T13:15:23.637",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/295a92e3df32e72aff0f4bc25c310e349d07ffbf"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/42f6beb2d5779429417b5f8115a4e3fa695d2a6c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/7863c9f3d24ba49dbead7e03dfbe40deb5888fdf"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T17:57:01+00:00",
      "cve": "CVE-2024-49568",
      "id": "CVE-2024-49568",
      "initial_release_date": "2024-01-01T00:00:00+00:00",
      "product_status:known_affected": "156",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-49568.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.