CVE-2024-50028 (GCVE-0-2024-50028)
Vulnerability from cvelistv5 – Published: 2024-10-21 19:39 – Updated: 2026-08-05 11:41
VLAI
EPSS
VEX
Title
thermal: core: Reference count the zone in thermal_zone_get_by_id()
Summary
In the Linux kernel, the following vulnerability has been resolved:
thermal: core: Reference count the zone in thermal_zone_get_by_id()
There are places in the thermal netlink code where nothing prevents
the thermal zone object from going away while being accessed after it
has been returned by thermal_zone_get_by_id().
To address this, make thermal_zone_get_by_id() get a reference on the
thermal zone device object to be returned with the help of get_device(),
under thermal_list_lock, and adjust all of its callers to this change
with the help of the cleanup.h infrastructure.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-22 13:26 UTC
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
1ce50e7d408ef2bdc8ca021363fd46d1b8bfad00 , < c95538b286efc6109c987e97a051bc7844ede802
(git)
Affected: 1ce50e7d408ef2bdc8ca021363fd46d1b8bfad00 , < a42a5839f400e929c489bb1b58f54596c4535167 (git) |
guessed | |
| Linux | Linux |
Affected:
5.9
Unaffected: 0 , < 5.9 (semver) Unaffected: 6.11.4 , ≤ 6.11.* (semver) Unaffected: 6.12 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-50028",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-22T13:26:28.280587Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-22T13:28:46.203Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/thermal/thermal_core.c",
"drivers/thermal/thermal_core.h",
"drivers/thermal/thermal_netlink.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c95538b286efc6109c987e97a051bc7844ede802",
"status": "affected",
"version": "1ce50e7d408ef2bdc8ca021363fd46d1b8bfad00",
"versionType": "git"
},
{
"lessThan": "a42a5839f400e929c489bb1b58f54596c4535167",
"status": "affected",
"version": "1ce50e7d408ef2bdc8ca021363fd46d1b8bfad00",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/thermal/thermal_core.c",
"drivers/thermal/thermal_core.h",
"drivers/thermal/thermal_netlink.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.9"
},
{
"lessThan": "5.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.12",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.11.4",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12",
"versionStartIncluding": "5.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nthermal: core: Reference count the zone in thermal_zone_get_by_id()\n\nThere are places in the thermal netlink code where nothing prevents\nthe thermal zone object from going away while being accessed after it\nhas been returned by thermal_zone_get_by_id().\n\nTo address this, make thermal_zone_get_by_id() get a reference on the\nthermal zone device object to be returned with the help of get_device(),\nunder thermal_list_lock, and adjust all of its callers to this change\nwith the help of the cleanup.h infrastructure."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable handlers are reached through the thermal generic-netlink family via a local AF_NETLINK socket, not from any remote peer. Per kernel scoring guidance, netlink-reachable code is Local.\nAC:L - The attacker fully controls and can continuously repeat the read side (unlimited TZ_GET_TEMP/TRIP/GOV requests from many threads), and the free side leaves a very wide window (list_del under thermal_list_lock, then cancel_delayed_work_sync, device_del and wait_for_completion before kfree), so a zone teardown from any routine event (driver/module removal, device hot-unplug, power-supply/charger removal, CPU hotplug or suspend/resume) is reliably won; the stale pointer can also be held across preemption.\nPR:L - The thermal genl ops carry no GENL_ADMIN_PERM or GENL_UNS_ADMIN_PERM flag, so genl_family_rcv_msg() applies no capability check \u2014 any unprivileged local user can open NETLINK_GENERIC and issue these commands with an arbitrary zone id.\nUI:N - Exploitation is entirely driven by the attacker\u0027s own netlink requests plus a concurrent zone teardown; no victim action is needed at any point.\nS:U - The use-after-free corrupts kernel heap memory within the same kernel security authority, with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - Contents of the freed thermal_zone_device are copied directly back to the attacker in the netlink reply \u2014 trip temperatures/types, the governor name via a stale tz-\u003egovernor pointer dereference, and a trip loop bounded by num_trips read from freed memory, giving an effectively unbounded heap read primitive after reclaim.\nI:H - The handlers write into the freed object (mutex_lock on tz-\u003elock) and, in the GET_TEMP path, make an indirect call through tz-\u003eops.get_temp read out of freed slab memory, which after a heap spray yields attacker-controlled control-flow hijack and arbitrary kernel modification.\nA:H - Even unweaponized, dereferencing and locking the freed thermal zone (and calling a stale ops pointer) causes memory corruption and kernel oops/panic, repeatable at will by an unprivileged process."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T11:41:04.376Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c95538b286efc6109c987e97a051bc7844ede802"
},
{
"url": "https://git.kernel.org/stable/c/a42a5839f400e929c489bb1b58f54596c4535167"
}
],
"title": "thermal: core: Reference count the zone in thermal_zone_get_by_id()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-50028",
"datePublished": "2024-10-21T19:39:31.809Z",
"dateReserved": "2024-10-21T12:17:06.066Z",
"dateUpdated": "2026-08-05T11:41:04.376Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2024-50028",
"date": "2026-10-31",
"epss": "0.00217",
"percentile": "0.12187"
},
"microsoft_vex": {
"current_release_date": "2026-09-24T01:53:02.000Z",
"cve": "CVE-2024-50028",
"id": "msrc_CVE-2024-50028",
"initial_release_date": "2025-09-03T22:48:40.000Z",
"product_status:under_investigation": "26",
"source": "Microsoft CSAF VEX",
"status": "final",
"title": "thermal: core: Reference count the zone in thermal_zone_get_by_id()",
"url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2024-50028.json",
"version": "19"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/thermal/thermal_core.c",
"drivers/thermal/thermal_core.h",
"drivers/thermal/thermal_netlink.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c95538b286efc6109c987e97a051bc7844ede802",
"status": "affected",
"version": "1ce50e7d408ef2bdc8ca021363fd46d1b8bfad00",
"versionType": "git"
},
{
"lessThan": "a42a5839f400e929c489bb1b58f54596c4535167",
"status": "affected",
"version": "1ce50e7d408ef2bdc8ca021363fd46d1b8bfad00",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/thermal/thermal_core.c",
"drivers/thermal/thermal_core.h",
"drivers/thermal/thermal_netlink.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.9"
},
{
"lessThan": "5.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.12",
"versionType": "original_commit_for_fix"
}
]
}
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E7C7402D-CBDE-4B07-833D-4B8DC6E5C230",
"versionEndExcluding": "6.11.4",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*",
"matchCriteriaId": "7F361E1D-580F-4A2D-A509-7615F73167A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*",
"matchCriteriaId": "925478D0-3E3D-4E6F-ACD5-09F28D5DF82C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nthermal: core: Reference count the zone in thermal_zone_get_by_id()\n\nThere are places in the thermal netlink code where nothing prevents\nthe thermal zone object from going away while being accessed after it\nhas been returned by thermal_zone_get_by_id().\n\nTo address this, make thermal_zone_get_by_id() get a reference on the\nthermal zone device object to be returned with the help of get_device(),\nunder thermal_list_lock, and adjust all of its callers to this change\nwith the help of the cleanup.h infrastructure."
},
{
"lang": "es",
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: thermal: core: recuento de referencia de la zona en thermal_zone_get_by_id() Hay lugares en el c\u00f3digo de netlink t\u00e9rmico donde nada impide que el objeto de zona t\u00e9rmica desaparezca mientras se accede a \u00e9l despu\u00e9s de que thermal_zone_get_by_id() lo haya devuelto. Para solucionar esto, haga que thermal_zone_get_by_id() obtenga una referencia en el objeto de dispositivo de zona t\u00e9rmica que se devolver\u00e1 con la ayuda de get_device(), bajo thermal_list_lock, y ajuste todos sus llamadores a este cambio con la ayuda de la infraestructura cleanup.h."
}
],
"id": "CVE-2024-50028",
"lastModified": "2026-08-04T11:21:08.930",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2024-50028",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-22T13:26:28.280587Z",
"version": "2.0.3"
}
}
]
},
"published": "2024-10-21T20:15:16.163",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/a42a5839f400e929c489bb1b58f54596c4535167"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/c95538b286efc6109c987e97a051bc7844ede802"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
},
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-10-29T06:45:14+00:00",
"cve": "CVE-2024-50028",
"id": "CVE-2024-50028",
"initial_release_date": "2024-10-21T00:00:00+00:00",
"product_status:fixed": "305",
"product_status:known_affected": "48",
"product_status:known_not_affected": "42",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: thermal: core: Reference count the zone in thermal_zone_get_by_id()",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-50028.json",
"version": "3"
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-50028",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-22T13:26:28.280587Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-22T13:26:31.893Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/thermal/thermal_core.c",
"drivers/thermal/thermal_core.h",
"drivers/thermal/thermal_netlink.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c95538b286efc6109c987e97a051bc7844ede802",
"status": "affected",
"version": "1ce50e7d408ef2bdc8ca021363fd46d1b8bfad00",
"versionType": "git"
},
{
"lessThan": "a42a5839f400e929c489bb1b58f54596c4535167",
"status": "affected",
"version": "1ce50e7d408ef2bdc8ca021363fd46d1b8bfad00",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/thermal/thermal_core.c",
"drivers/thermal/thermal_core.h",
"drivers/thermal/thermal_netlink.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.9"
},
{
"lessThan": "5.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.*",
"status": "unaffected",
"version": "6.11.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.12",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.11.4",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12",
"versionStartIncluding": "5.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nthermal: core: Reference count the zone in thermal_zone_get_by_id()\n\nThere are places in the thermal netlink code where nothing prevents\nthe thermal zone object from going away while being accessed after it\nhas been returned by thermal_zone_get_by_id().\n\nTo address this, make thermal_zone_get_by_id() get a reference on the\nthermal zone device object to be returned with the help of get_device(),\nunder thermal_list_lock, and adjust all of its callers to this change\nwith the help of the cleanup.h infrastructure."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable handlers are reached through the thermal generic-netlink family via a local AF_NETLINK socket, not from any remote peer. Per kernel scoring guidance, netlink-reachable code is Local.\nAC:L - The attacker fully controls and can continuously repeat the read side (unlimited TZ_GET_TEMP/TRIP/GOV requests from many threads), and the free side leaves a very wide window (list_del under thermal_list_lock, then cancel_delayed_work_sync, device_del and wait_for_completion before kfree), so a zone teardown from any routine event (driver/module removal, device hot-unplug, power-supply/charger removal, CPU hotplug or suspend/resume) is reliably won; the stale pointer can also be held across preemption.\nPR:L - The thermal genl ops carry no GENL_ADMIN_PERM or GENL_UNS_ADMIN_PERM flag, so genl_family_rcv_msg() applies no capability check \u2014 any unprivileged local user can open NETLINK_GENERIC and issue these commands with an arbitrary zone id.\nUI:N - Exploitation is entirely driven by the attacker\u0027s own netlink requests plus a concurrent zone teardown; no victim action is needed at any point.\nS:U - The use-after-free corrupts kernel heap memory within the same kernel security authority, with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - Contents of the freed thermal_zone_device are copied directly back to the attacker in the netlink reply \u2014 trip temperatures/types, the governor name via a stale tz-\u003egovernor pointer dereference, and a trip loop bounded by num_trips read from freed memory, giving an effectively unbounded heap read primitive after reclaim.\nI:H - The handlers write into the freed object (mutex_lock on tz-\u003elock) and, in the GET_TEMP path, make an indirect call through tz-\u003eops.get_temp read out of freed slab memory, which after a heap spray yields attacker-controlled control-flow hijack and arbitrary kernel modification.\nA:H - Even unweaponized, dereferencing and locking the freed thermal zone (and calling a stale ops pointer) causes memory corruption and kernel oops/panic, repeatable at will by an unprivileged process."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T11:41:04.376Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c95538b286efc6109c987e97a051bc7844ede802"
},
{
"url": "https://git.kernel.org/stable/c/a42a5839f400e929c489bb1b58f54596c4535167"
}
],
"title": "thermal: core: Reference count the zone in thermal_zone_get_by_id()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-50028",
"datePublished": "2024-10-21T19:39:31.809Z",
"dateReserved": "2024-10-21T12:17:06.066Z",
"dateUpdated": "2026-08-05T11:41:04.376Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.