CVE-2024-57902 (GCVE-0-2024-57902)

Vulnerability from cvelistv5 – Published: 2025-01-15 13:05 – Updated: 2026-08-05 11:46
VLAI
Title
af_packet: fix vlan_get_tci() vs MSG_PEEK
Summary
In the Linux kernel, the following vulnerability has been resolved: af_packet: fix vlan_get_tci() vs MSG_PEEK Blamed commit forgot MSG_PEEK case, allowing a crash [1] as found by syzbot. Rework vlan_get_tci() to not touch skb at all, so that it can be used from many cpus on the same skb. Add a const qualifier to skb argument. [1] skbuff: skb_under_panic: text:ffffffff8a8da482 len:32 put:14 head:ffff88807a1d5800 data:ffff88807a1d5810 tail:0x14 end:0x140 dev:<NULL> ------------[ cut here ]------------ kernel BUG at net/core/skbuff.c:206 ! Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 0 UID: 0 PID: 5880 Comm: syz-executor172 Not tainted 6.13.0-rc3-syzkaller-00762-g9268abe611b0 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 RIP: 0010:skb_panic net/core/skbuff.c:206 [inline] RIP: 0010:skb_under_panic+0x14b/0x150 net/core/skbuff.c:216 Code: 0b 8d 48 c7 c6 9e 6c 26 8e 48 8b 54 24 08 8b 0c 24 44 8b 44 24 04 4d 89 e9 50 41 54 41 57 41 56 e8 3a 5a 79 f7 48 83 c4 20 90 <0f> 0b 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 RSP: 0018:ffffc90003baf5b8 EFLAGS: 00010286 RAX: 0000000000000087 RBX: dffffc0000000000 RCX: 8565c1eec37aa000 RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 RBP: ffff88802616fb50 R08: ffffffff817f0a4c R09: 1ffff92000775e50 R10: dffffc0000000000 R11: fffff52000775e51 R12: 0000000000000140 R13: ffff88807a1d5800 R14: ffff88807a1d5810 R15: 0000000000000014 FS: 00007fa03261f6c0(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffd65753000 CR3: 0000000031720000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> skb_push+0xe5/0x100 net/core/skbuff.c:2636 vlan_get_tci+0x272/0x550 net/packet/af_packet.c:565 packet_recvmsg+0x13c9/0x1ef0 net/packet/af_packet.c:3616 sock_recvmsg_nosec net/socket.c:1044 [inline] sock_recvmsg+0x22f/0x280 net/socket.c:1066 ____sys_recvmsg+0x1c6/0x480 net/socket.c:2814 ___sys_recvmsg net/socket.c:2856 [inline] do_recvmmsg+0x426/0xab0 net/socket.c:2951 __sys_recvmmsg net/socket.c:3025 [inline] __do_sys_recvmmsg net/socket.c:3048 [inline] __se_sys_recvmmsg net/socket.c:3041 [inline] __x64_sys_recvmmsg+0x199/0x250 net/socket.c:3041 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
Severity
7.3 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-01 19:54 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: c77064e76c768fb101ea5ff92dc771142fc9d8fd , < 66ffb0cf2125dcf9e902eede4a43653a24fd9cb2 (git)
Affected: 83e2dfadcb6258fe3111c8a8ec9cf34465e55e64 , < fa57f07ba0622c8692f40e1300adca59277b0044 (git)
Affected: d0a1f9aa70f0d8a05b6320e8a3f3b83adab8dac3 , < 65c67049e9ed481f6b52264b39618b8c6dfb1d3e (git)
Affected: 5839f59ff1dd4e35b9e767927931a039484839e1 , < d91b4a9baa018a001d5c884e236c0cfd31f9f4a1 (git)
Affected: 5a041d25b67042cbe06a0fb292ee22fd1147e65c , < 7aa78d0d8546d8ce5a764add3f55d72e707c18f1 (git)
Affected: 79eecf631c14e7f4057186570ac20e2cfac3802e , < b65292a548d847099a4fe0fff53122a06e798e25 (git)
Affected: 79eecf631c14e7f4057186570ac20e2cfac3802e , < 77ee7a6d16b6ec07b5c3ae2b6b60a24c1afbed09 (git)
Affected: 3dfd84aa72fa7329ed4a257c8f40e0c9aff4dc8f (git)
Affected: 66f23a7b5174b5d3e7111fd2d0d5a4f3faaa12e5 (git)
Affected: 5.4.282 , < 5.4.289 (semver)
Affected: 5.10.224 , < 5.10.233 (semver)
Affected: 5.15.165 , < 5.15.176 (semver)
Affected: 6.1.103 , < 6.1.124 (semver)
Affected: 6.6.44 , < 6.6.70 (semver)
Affected: 4.19.320 , < 4.20 (semver)
Affected: 6.10.3 , < 6.11 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.11
Unaffected: 0 , < 6.11 (semver)
Unaffected: 5.4.289 , ≤ 5.4.* (semver)
Unaffected: 5.10.233 , ≤ 5.10.* (semver)
Unaffected: 5.15.176 , ≤ 5.15.* (semver)
Unaffected: 6.1.124 , ≤ 6.1.* (semver)
Unaffected: 6.6.70 , ≤ 6.6.* (semver)
Unaffected: 6.12.9 , ≤ 6.12.* (semver)
Unaffected: 6.13 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem Affected: 0 , < * (custom)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-57902",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T19:54:33.375217Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T19:57:18.984Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:55:22.811Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T12:01:35.434Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/packet/af_packet.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "66ffb0cf2125dcf9e902eede4a43653a24fd9cb2",
              "status": "affected",
              "version": "c77064e76c768fb101ea5ff92dc771142fc9d8fd",
              "versionType": "git"
            },
            {
              "lessThan": "fa57f07ba0622c8692f40e1300adca59277b0044",
              "status": "affected",
              "version": "83e2dfadcb6258fe3111c8a8ec9cf34465e55e64",
              "versionType": "git"
            },
            {
              "lessThan": "65c67049e9ed481f6b52264b39618b8c6dfb1d3e",
              "status": "affected",
              "version": "d0a1f9aa70f0d8a05b6320e8a3f3b83adab8dac3",
              "versionType": "git"
            },
            {
              "lessThan": "d91b4a9baa018a001d5c884e236c0cfd31f9f4a1",
              "status": "affected",
              "version": "5839f59ff1dd4e35b9e767927931a039484839e1",
              "versionType": "git"
            },
            {
              "lessThan": "7aa78d0d8546d8ce5a764add3f55d72e707c18f1",
              "status": "affected",
              "version": "5a041d25b67042cbe06a0fb292ee22fd1147e65c",
              "versionType": "git"
            },
            {
              "lessThan": "b65292a548d847099a4fe0fff53122a06e798e25",
              "status": "affected",
              "version": "79eecf631c14e7f4057186570ac20e2cfac3802e",
              "versionType": "git"
            },
            {
              "lessThan": "77ee7a6d16b6ec07b5c3ae2b6b60a24c1afbed09",
              "status": "affected",
              "version": "79eecf631c14e7f4057186570ac20e2cfac3802e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3dfd84aa72fa7329ed4a257c8f40e0c9aff4dc8f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "66f23a7b5174b5d3e7111fd2d0d5a4f3faaa12e5",
              "versionType": "git"
            },
            {
              "lessThan": "5.4.289",
              "status": "affected",
              "version": "5.4.282",
              "versionType": "semver"
            },
            {
              "lessThan": "5.10.233",
              "status": "affected",
              "version": "5.10.224",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.176",
              "status": "affected",
              "version": "5.15.165",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.124",
              "status": "affected",
              "version": "6.1.103",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.70",
              "status": "affected",
              "version": "6.6.44",
              "versionType": "semver"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.320",
              "versionType": "semver"
            },
            {
              "lessThan": "6.11",
              "status": "affected",
              "version": "6.10.3",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/packet/af_packet.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.289",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.233",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.124",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.70",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.289",
                  "versionStartIncluding": "5.4.282",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.233",
                  "versionStartIncluding": "5.10.224",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.176",
                  "versionStartIncluding": "5.15.165",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.124",
                  "versionStartIncluding": "6.1.103",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.70",
                  "versionStartIncluding": "6.6.44",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.9",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.320",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.10.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\naf_packet: fix vlan_get_tci() vs MSG_PEEK\n\nBlamed commit forgot MSG_PEEK case, allowing a crash [1] as found\nby syzbot.\n\nRework vlan_get_tci() to not touch skb at all,\nso that it can be used from many cpus on the same skb.\n\nAdd a const qualifier to skb argument.\n\n[1]\nskbuff: skb_under_panic: text:ffffffff8a8da482 len:32 put:14 head:ffff88807a1d5800 data:ffff88807a1d5810 tail:0x14 end:0x140 dev:\u003cNULL\u003e\n------------[ cut here ]------------\n kernel BUG at net/core/skbuff.c:206 !\nOops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI\nCPU: 0 UID: 0 PID: 5880 Comm: syz-executor172 Not tainted 6.13.0-rc3-syzkaller-00762-g9268abe611b0 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024\n RIP: 0010:skb_panic net/core/skbuff.c:206 [inline]\n RIP: 0010:skb_under_panic+0x14b/0x150 net/core/skbuff.c:216\nCode: 0b 8d 48 c7 c6 9e 6c 26 8e 48 8b 54 24 08 8b 0c 24 44 8b 44 24 04 4d 89 e9 50 41 54 41 57 41 56 e8 3a 5a 79 f7 48 83 c4 20 90 \u003c0f\u003e 0b 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3\nRSP: 0018:ffffc90003baf5b8 EFLAGS: 00010286\nRAX: 0000000000000087 RBX: dffffc0000000000 RCX: 8565c1eec37aa000\nRDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000\nRBP: ffff88802616fb50 R08: ffffffff817f0a4c R09: 1ffff92000775e50\nR10: dffffc0000000000 R11: fffff52000775e51 R12: 0000000000000140\nR13: ffff88807a1d5800 R14: ffff88807a1d5810 R15: 0000000000000014\nFS:  00007fa03261f6c0(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007ffd65753000 CR3: 0000000031720000 CR4: 00000000003526f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u003cTASK\u003e\n  skb_push+0xe5/0x100 net/core/skbuff.c:2636\n  vlan_get_tci+0x272/0x550 net/packet/af_packet.c:565\n  packet_recvmsg+0x13c9/0x1ef0 net/packet/af_packet.c:3616\n  sock_recvmsg_nosec net/socket.c:1044 [inline]\n  sock_recvmsg+0x22f/0x280 net/socket.c:1066\n  ____sys_recvmsg+0x1c6/0x480 net/socket.c:2814\n  ___sys_recvmsg net/socket.c:2856 [inline]\n  do_recvmmsg+0x426/0xab0 net/socket.c:2951\n  __sys_recvmmsg net/socket.c:3025 [inline]\n  __do_sys_recvmmsg net/socket.c:3048 [inline]\n  __se_sys_recvmmsg net/socket.c:3041 [inline]\n  __x64_sys_recvmmsg+0x199/0x250 net/socket.c:3041\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Triggering requires local syscalls \u2014 creating an AF_PACKET SOCK_DGRAM socket and issuing concurrent recvmsg/recvmmsg with MSG_PEEK on it. A remote peer can supply the VLAN-tagged frame but cannot drive the MSG_PEEK race, so the attack vector is local.\nAC:L - The attacker controls both sides of the race entirely: same socket, own threads, own packet, own netdev, and can loop indefinitely with no dependence on external state (syzbot produced a reproducer). No unusual kernel config is needed \u2014 CONFIG_PACKET is universally enabled.\nPR:L - packet_create() requires only ns_capable(net-\u003euser_ns, CAP_NET_RAW), which any unprivileged user obtains via unshare -Urn; the whole setup (veth/dummy device, VLAN-tagged transmit, PACKET_AUXDATA, peeking threads) runs inside that user+net namespace.\nUI:N - The attacking process performs every step itself \u2014 socket creation, packet injection, and the concurrent MSG_PEEK receives. No victim action or privileged helper is involved.\nS:U - The corruption and its impact stay within the kernel\u0027s own security authority; there is no hypervisor, IOMMU, or other trust-boundary crossing (a container-to-host panic is still scored Unchanged by convention).\nC:H - The window between the restore of skb-\u003edata and skb-\u003elen lets a racing thread read an inflated skb_headlen(), copying bytes past the valid data region directly to userspace via __skb_datagram_iter(); accumulated pushes extend the overread past skb_end_pointer() into skb_shared_info, leaking kernel pointers and stale slab contents, repeatably.\nI:L - The race corrupts sk_buff metadata (skb-\u003edata and skb-\u003elen) of a queued kernel object with stale values that persist for subsequent peeks, but it yields no out-of-bounds write or control-flow primitive.\nA:H - Driving skb-\u003edata below skb-\u003ehead reaches skb_under_panic() \u2192 BUG(), an unconditional kernel oops/panic, hit inside an RCU read-side critical section so the dying task leaves rcu_read_lock held (RCU stalls/hang), and a full panic with panic_on_oops set."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:46:53.346Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/66ffb0cf2125dcf9e902eede4a43653a24fd9cb2"
        },
        {
          "url": "https://git.kernel.org/stable/c/fa57f07ba0622c8692f40e1300adca59277b0044"
        },
        {
          "url": "https://git.kernel.org/stable/c/65c67049e9ed481f6b52264b39618b8c6dfb1d3e"
        },
        {
          "url": "https://git.kernel.org/stable/c/d91b4a9baa018a001d5c884e236c0cfd31f9f4a1"
        },
        {
          "url": "https://git.kernel.org/stable/c/7aa78d0d8546d8ce5a764add3f55d72e707c18f1"
        },
        {
          "url": "https://git.kernel.org/stable/c/b65292a548d847099a4fe0fff53122a06e798e25"
        },
        {
          "url": "https://git.kernel.org/stable/c/77ee7a6d16b6ec07b5c3ae2b6b60a24c1afbed09"
        }
      ],
      "title": "af_packet: fix vlan_get_tci() vs MSG_PEEK",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-57902",
    "datePublished": "2025-01-15T13:05:58.296Z",
    "dateReserved": "2025-01-11T14:45:42.031Z",
    "dateUpdated": "2026-08-05T11:46:53.346Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-57902",
      "date": "2026-09-20",
      "epss": "0.00273",
      "percentile": "0.19875"
    },
    "microsoft_vex": {
      "current_release_date": "2025-03-13T00:00:00.000Z",
      "cve": "CVE-2024-57902",
      "id": "msrc_CVE-2024-57902",
      "initial_release_date": "2025-01-02T00:00:00.000Z",
      "product_status:fixed": "4",
      "product_status:known_affected": "4",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "af_packet: fix vlan_get_tci() vs MSG_PEEK",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2024-57902.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/packet/af_packet.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "66ffb0cf2125dcf9e902eede4a43653a24fd9cb2",
                    "status": "affected",
                    "version": "c77064e76c768fb101ea5ff92dc771142fc9d8fd",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "fa57f07ba0622c8692f40e1300adca59277b0044",
                    "status": "affected",
                    "version": "83e2dfadcb6258fe3111c8a8ec9cf34465e55e64",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "65c67049e9ed481f6b52264b39618b8c6dfb1d3e",
                    "status": "affected",
                    "version": "d0a1f9aa70f0d8a05b6320e8a3f3b83adab8dac3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d91b4a9baa018a001d5c884e236c0cfd31f9f4a1",
                    "status": "affected",
                    "version": "5839f59ff1dd4e35b9e767927931a039484839e1",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7aa78d0d8546d8ce5a764add3f55d72e707c18f1",
                    "status": "affected",
                    "version": "5a041d25b67042cbe06a0fb292ee22fd1147e65c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b65292a548d847099a4fe0fff53122a06e798e25",
                    "status": "affected",
                    "version": "79eecf631c14e7f4057186570ac20e2cfac3802e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "77ee7a6d16b6ec07b5c3ae2b6b60a24c1afbed09",
                    "status": "affected",
                    "version": "79eecf631c14e7f4057186570ac20e2cfac3802e",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "3dfd84aa72fa7329ed4a257c8f40e0c9aff4dc8f",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "66f23a7b5174b5d3e7111fd2d0d5a4f3faaa12e5",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5.4.289",
                    "status": "affected",
                    "version": "5.4.282",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "5.10.233",
                    "status": "affected",
                    "version": "5.10.224",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "5.15.176",
                    "status": "affected",
                    "version": "5.15.165",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.1.124",
                    "status": "affected",
                    "version": "6.1.103",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.6.70",
                    "status": "affected",
                    "version": "6.6.44",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "4.20",
                    "status": "affected",
                    "version": "4.19.320",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.11",
                    "status": "affected",
                    "version": "6.10.3",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/packet/af_packet.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.11"
                  },
                  {
                    "lessThan": "6.11",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.4.*",
                    "status": "unaffected",
                    "version": "5.4.289",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.233",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.176",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.124",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.70",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.9",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.13",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          },
          {
            "affectedData": [
              {
                "defaultStatus": "unknown",
                "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "*",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E9C1FD3D-3B79-4FC6-83B1-93C7ADA040CD",
                    "versionEndExcluding": "4.20",
                    "versionStartIncluding": "4.19.320",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "3B481C7C-F128-4688-9DF9-F22D7F920282",
                    "versionEndExcluding": "5.4.289",
                    "versionStartIncluding": "5.4.282",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "1FB0FF4E-4A54-43D5-A68A-8A1E85625392",
                    "versionEndExcluding": "5.10.233",
                    "versionStartIncluding": "5.10.224",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "28A7AED6-B8E9-4F4F-ACF4-34045BAC4C4A",
                    "versionEndExcluding": "5.15.176",
                    "versionStartIncluding": "5.15.165",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "00A989FE-8858-40DA-A6A2-DB2E536D3B52",
                    "versionEndExcluding": "6.1.124",
                    "versionStartIncluding": "6.1.103",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "294B27E4-4DE4-43C9-AD0C-94F32EE21F1A",
                    "versionEndExcluding": "6.6.70",
                    "versionStartIncluding": "6.6.44",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "26D3877E-5512-48A1-A054-7C93A646D1E9",
                    "versionEndExcluding": "6.12.9",
                    "versionStartIncluding": "6.10.3",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "62567B3C-6CEE-46D0-BC2E-B3717FBF7D13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "5A073481-106D-4B15-B4C7-FB0213B8E1D4",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "DE491969-75AE-4A6B-9A58-8FC5AF98798F",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.13:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "93C0660D-7FB8-4FBA-892A-B064BA71E49E",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.13:rc5:*:*:*:*:*:*",
                    "matchCriteriaId": "034C36A6-C481-41F3-AE9A-D116E5BE6895",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\naf_packet: fix vlan_get_tci() vs MSG_PEEK\n\nBlamed commit forgot MSG_PEEK case, allowing a crash [1] as found\nby syzbot.\n\nRework vlan_get_tci() to not touch skb at all,\nso that it can be used from many cpus on the same skb.\n\nAdd a const qualifier to skb argument.\n\n[1]\nskbuff: skb_under_panic: text:ffffffff8a8da482 len:32 put:14 head:ffff88807a1d5800 data:ffff88807a1d5810 tail:0x14 end:0x140 dev:\u003cNULL\u003e\n------------[ cut here ]------------\n kernel BUG at net/core/skbuff.c:206 !\nOops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI\nCPU: 0 UID: 0 PID: 5880 Comm: syz-executor172 Not tainted 6.13.0-rc3-syzkaller-00762-g9268abe611b0 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024\n RIP: 0010:skb_panic net/core/skbuff.c:206 [inline]\n RIP: 0010:skb_under_panic+0x14b/0x150 net/core/skbuff.c:216\nCode: 0b 8d 48 c7 c6 9e 6c 26 8e 48 8b 54 24 08 8b 0c 24 44 8b 44 24 04 4d 89 e9 50 41 54 41 57 41 56 e8 3a 5a 79 f7 48 83 c4 20 90 \u003c0f\u003e 0b 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3\nRSP: 0018:ffffc90003baf5b8 EFLAGS: 00010286\nRAX: 0000000000000087 RBX: dffffc0000000000 RCX: 8565c1eec37aa000\nRDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000\nRBP: ffff88802616fb50 R08: ffffffff817f0a4c R09: 1ffff92000775e50\nR10: dffffc0000000000 R11: fffff52000775e51 R12: 0000000000000140\nR13: ffff88807a1d5800 R14: ffff88807a1d5810 R15: 0000000000000014\nFS:  00007fa03261f6c0(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007ffd65753000 CR3: 0000000031720000 CR4: 00000000003526f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u003cTASK\u003e\n  skb_push+0xe5/0x100 net/core/skbuff.c:2636\n  vlan_get_tci+0x272/0x550 net/packet/af_packet.c:565\n  packet_recvmsg+0x13c9/0x1ef0 net/packet/af_packet.c:3616\n  sock_recvmsg_nosec net/socket.c:1044 [inline]\n  sock_recvmsg+0x22f/0x280 net/socket.c:1066\n  ____sys_recvmsg+0x1c6/0x480 net/socket.c:2814\n  ___sys_recvmsg net/socket.c:2856 [inline]\n  do_recvmmsg+0x426/0xab0 net/socket.c:2951\n  __sys_recvmmsg net/socket.c:3025 [inline]\n  __do_sys_recvmmsg net/socket.c:3048 [inline]\n  __se_sys_recvmmsg net/socket.c:3041 [inline]\n  __x64_sys_recvmmsg+0x199/0x250 net/socket.c:3041\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83"
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: af_packet: arreglo vlan_get_tci() vs MSG_PEEK La confirmaci\u00f3n culpada olvid\u00f3 el caso MSG_PEEK, lo que permiti\u00f3 un bloqueo [1] como lo encontr\u00f3 syzbot. Reelabore vlan_get_tci() para que no toque skb en absoluto, de modo que pueda usarse desde muchas CPU en el mismo skb. Agregue un calificador const al argumento skb. [1] skbuff: skb_under_panic: text:ffffffff8a8da482 len:32 put:14 head:ffff88807a1d5800 data:ffff88807a1d5810 tail:0x14 end:0x140 dev: ------------[ corte aqu\u00ed ]------------ \u00a1ERROR del kernel en net/core/skbuff.c:206! Oops: c\u00f3digo de operaci\u00f3n no v\u00e1lido: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 0 UID: 0 PID: 5880 Comm: syz-executor172 No contaminado 6.13.0-rc3-syzkaller-00762-g9268abe611b0 #0 Nombre del hardware: Google Google Compute Engine/Google Compute Engine, BIOS Google 13/09/2024 RIP: 0010:skb_panic net/core/skbuff.c:206 [en l\u00ednea] RIP: 0010:skb_under_panic+0x14b/0x150 net/core/skbuff.c:216 C\u00f3digo: 0b 8d 48 c7 c6 9e 6c 26 8e 48 8b 54 24 08 8b 0c 24 44 8b 44 24 04 4d 89 e9 50 41 54 41 57 41 56 e8 3a 5a 79 f7 48 83 c4 20 90 \u0026lt;0f\u0026gt; 0b 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 RSP: 0018:ffffc90003baf5b8 EFLAGS: 00010286 RAX: 000000000000087 RBX: dffffc0000000000 RCX: 8565c1eec37aa000 RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 RBP: ffff88802616fb50 R08: ffffffff817f0a4c R09: 1ffff92000775e50 R10: dffffc0000000000 R11: fffff52000775e51 R12: 0000000000000140 R13: ffff88807a1d5800 R14: ffff88807a1d5810 R15: 0000000000000014 FS: 00007fa03261f6c0(0000) GS:ffff8880b8600000(0000) knlGS:00000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffd65753000 CR3: 0000000031720000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Seguimiento de llamadas:  skb_push+0xe5/0x100 net/core/skbuff.c:2636 vlan_get_tci+0x272/0x550 net/packet/af_packet.c:565 packet_recvmsg+0x13c9/0x1ef0 net/packet/af_packet.c:3616 sock_recvmsg_nosec net/socket.c:1044 [en l\u00ednea] sock_recvmsg+0x22f/0x280 net/socket.c:1066 ____sys_recvmsg+0x1c6/0x480 net/socket.c:2814 ___sys_recvmsg net/socket.c:2856 [en l\u00ednea] do_recvmmsg+0x426/0xab0 net/socket.c:2951 __sys_recvmmsg net/socket.c:3025 [en l\u00ednea] __do_sys_recvmmsg net/socket.c:3048 [en l\u00ednea] __se_sys_recvmmsg net/socket.c:3041 [en l\u00ednea] __x64_sys_recvmmsg+0x199/0x250 net/socket.c:3041 do_syscall_x64 arch/x86/entry/common.c:52 [en l\u00ednea] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83"
          }
        ],
        "id": "CVE-2024-57902",
        "lastModified": "2026-08-04T11:22:31.290",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.3,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.5,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-57902",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T19:54:33.375217Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-01-15T13:15:14.867",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/65c67049e9ed481f6b52264b39618b8c6dfb1d3e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/66ffb0cf2125dcf9e902eede4a43653a24fd9cb2"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/77ee7a6d16b6ec07b5c3ae2b6b60a24c1afbed09"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/7aa78d0d8546d8ce5a764add3f55d72e707c18f1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/b65292a548d847099a4fe0fff53122a06e798e25"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/d91b4a9baa018a001d5c884e236c0cfd31f9f4a1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/fa57f07ba0622c8692f40e1300adca59277b0044"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
          },
          {
            "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T14:07:57+00:00",
      "cve": "CVE-2024-57902",
      "id": "CVE-2024-57902",
      "initial_release_date": "2024-01-01T00:00:00+00:00",
      "product_status:fixed": "309",
      "product_status:known_affected": "42",
      "product_status:known_not_affected": "156",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: af_packet: fix vlan_get_tci() vs MSG_PEEK",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-57902.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2025-11-03T20:55:22.811Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
              },
              {
                "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "affected": [
              {
                "defaultStatus": "unknown",
                "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "*",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-05-12T12:01:35.434Z",
              "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
              "shortName": "siemens-SADP"
            },
            "references": [
              {
                "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
              }
            ],
            "x_adpType": "supplier"
          },
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "LOCAL",
                  "availabilityImpact": "HIGH",
                  "baseScore": 5.5,
                  "baseSeverity": "MEDIUM",
                  "confidentialityImpact": "NONE",
                  "integrityImpact": "NONE",
                  "privilegesRequired": "LOW",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-57902",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-10-01T19:54:33.375217Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "description": "CWE-noinfo Not enough information",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-10-01T15:55:01.080Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "net/packet/af_packet.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "66ffb0cf2125dcf9e902eede4a43653a24fd9cb2",
                  "status": "affected",
                  "version": "c77064e76c768fb101ea5ff92dc771142fc9d8fd",
                  "versionType": "git"
                },
                {
                  "lessThan": "fa57f07ba0622c8692f40e1300adca59277b0044",
                  "status": "affected",
                  "version": "83e2dfadcb6258fe3111c8a8ec9cf34465e55e64",
                  "versionType": "git"
                },
                {
                  "lessThan": "65c67049e9ed481f6b52264b39618b8c6dfb1d3e",
                  "status": "affected",
                  "version": "d0a1f9aa70f0d8a05b6320e8a3f3b83adab8dac3",
                  "versionType": "git"
                },
                {
                  "lessThan": "d91b4a9baa018a001d5c884e236c0cfd31f9f4a1",
                  "status": "affected",
                  "version": "5839f59ff1dd4e35b9e767927931a039484839e1",
                  "versionType": "git"
                },
                {
                  "lessThan": "7aa78d0d8546d8ce5a764add3f55d72e707c18f1",
                  "status": "affected",
                  "version": "5a041d25b67042cbe06a0fb292ee22fd1147e65c",
                  "versionType": "git"
                },
                {
                  "lessThan": "b65292a548d847099a4fe0fff53122a06e798e25",
                  "status": "affected",
                  "version": "79eecf631c14e7f4057186570ac20e2cfac3802e",
                  "versionType": "git"
                },
                {
                  "lessThan": "77ee7a6d16b6ec07b5c3ae2b6b60a24c1afbed09",
                  "status": "affected",
                  "version": "79eecf631c14e7f4057186570ac20e2cfac3802e",
                  "versionType": "git"
                },
                {
                  "status": "affected",
                  "version": "3dfd84aa72fa7329ed4a257c8f40e0c9aff4dc8f",
                  "versionType": "git"
                },
                {
                  "status": "affected",
                  "version": "66f23a7b5174b5d3e7111fd2d0d5a4f3faaa12e5",
                  "versionType": "git"
                },
                {
                  "lessThan": "5.4.289",
                  "status": "affected",
                  "version": "5.4.282",
                  "versionType": "semver"
                },
                {
                  "lessThan": "5.10.233",
                  "status": "affected",
                  "version": "5.10.224",
                  "versionType": "semver"
                },
                {
                  "lessThan": "5.15.176",
                  "status": "affected",
                  "version": "5.15.165",
                  "versionType": "semver"
                },
                {
                  "lessThan": "6.1.124",
                  "status": "affected",
                  "version": "6.1.103",
                  "versionType": "semver"
                },
                {
                  "lessThan": "6.6.70",
                  "status": "affected",
                  "version": "6.6.44",
                  "versionType": "semver"
                },
                {
                  "lessThan": "4.20",
                  "status": "affected",
                  "version": "4.19.320",
                  "versionType": "semver"
                },
                {
                  "lessThan": "6.11",
                  "status": "affected",
                  "version": "6.10.3",
                  "versionType": "semver"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "net/packet/af_packet.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "6.11"
                },
                {
                  "lessThan": "6.11",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.4.*",
                  "status": "unaffected",
                  "version": "5.4.289",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.10.*",
                  "status": "unaffected",
                  "version": "5.10.233",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.15.*",
                  "status": "unaffected",
                  "version": "5.15.176",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.1.*",
                  "status": "unaffected",
                  "version": "6.1.124",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.6.*",
                  "status": "unaffected",
                  "version": "6.6.70",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.12.*",
                  "status": "unaffected",
                  "version": "6.12.9",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.13",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.4.289",
                      "versionStartIncluding": "5.4.282",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.10.233",
                      "versionStartIncluding": "5.10.224",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.15.176",
                      "versionStartIncluding": "5.15.165",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.1.124",
                      "versionStartIncluding": "6.1.103",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.6.70",
                      "versionStartIncluding": "6.6.44",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.12.9",
                      "versionStartIncluding": "6.11",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.13",
                      "versionStartIncluding": "6.11",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionStartIncluding": "4.19.320",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionStartIncluding": "6.10.3",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\naf_packet: fix vlan_get_tci() vs MSG_PEEK\n\nBlamed commit forgot MSG_PEEK case, allowing a crash [1] as found\nby syzbot.\n\nRework vlan_get_tci() to not touch skb at all,\nso that it can be used from many cpus on the same skb.\n\nAdd a const qualifier to skb argument.\n\n[1]\nskbuff: skb_under_panic: text:ffffffff8a8da482 len:32 put:14 head:ffff88807a1d5800 data:ffff88807a1d5810 tail:0x14 end:0x140 dev:\u003cNULL\u003e\n------------[ cut here ]------------\n kernel BUG at net/core/skbuff.c:206 !\nOops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI\nCPU: 0 UID: 0 PID: 5880 Comm: syz-executor172 Not tainted 6.13.0-rc3-syzkaller-00762-g9268abe611b0 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024\n RIP: 0010:skb_panic net/core/skbuff.c:206 [inline]\n RIP: 0010:skb_under_panic+0x14b/0x150 net/core/skbuff.c:216\nCode: 0b 8d 48 c7 c6 9e 6c 26 8e 48 8b 54 24 08 8b 0c 24 44 8b 44 24 04 4d 89 e9 50 41 54 41 57 41 56 e8 3a 5a 79 f7 48 83 c4 20 90 \u003c0f\u003e 0b 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3\nRSP: 0018:ffffc90003baf5b8 EFLAGS: 00010286\nRAX: 0000000000000087 RBX: dffffc0000000000 RCX: 8565c1eec37aa000\nRDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000\nRBP: ffff88802616fb50 R08: ffffffff817f0a4c R09: 1ffff92000775e50\nR10: dffffc0000000000 R11: fffff52000775e51 R12: 0000000000000140\nR13: ffff88807a1d5800 R14: ffff88807a1d5810 R15: 0000000000000014\nFS:  00007fa03261f6c0(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007ffd65753000 CR3: 0000000031720000 CR4: 00000000003526f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u003cTASK\u003e\n  skb_push+0xe5/0x100 net/core/skbuff.c:2636\n  vlan_get_tci+0x272/0x550 net/packet/af_packet.c:565\n  packet_recvmsg+0x13c9/0x1ef0 net/packet/af_packet.c:3616\n  sock_recvmsg_nosec net/socket.c:1044 [inline]\n  sock_recvmsg+0x22f/0x280 net/socket.c:1066\n  ____sys_recvmsg+0x1c6/0x480 net/socket.c:2814\n  ___sys_recvmsg net/socket.c:2856 [inline]\n  do_recvmmsg+0x426/0xab0 net/socket.c:2951\n  __sys_recvmmsg net/socket.c:3025 [inline]\n  __do_sys_recvmmsg net/socket.c:3048 [inline]\n  __se_sys_recvmmsg net/socket.c:3041 [inline]\n  __x64_sys_recvmmsg+0x199/0x250 net/socket.c:3041\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.3,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:L - Triggering requires local syscalls \u2014 creating an AF_PACKET SOCK_DGRAM socket and issuing concurrent recvmsg/recvmmsg with MSG_PEEK on it. A remote peer can supply the VLAN-tagged frame but cannot drive the MSG_PEEK race, so the attack vector is local.\nAC:L - The attacker controls both sides of the race entirely: same socket, own threads, own packet, own netdev, and can loop indefinitely with no dependence on external state (syzbot produced a reproducer). No unusual kernel config is needed \u2014 CONFIG_PACKET is universally enabled.\nPR:L - packet_create() requires only ns_capable(net-\u003euser_ns, CAP_NET_RAW), which any unprivileged user obtains via unshare -Urn; the whole setup (veth/dummy device, VLAN-tagged transmit, PACKET_AUXDATA, peeking threads) runs inside that user+net namespace.\nUI:N - The attacking process performs every step itself \u2014 socket creation, packet injection, and the concurrent MSG_PEEK receives. No victim action or privileged helper is involved.\nS:U - The corruption and its impact stay within the kernel\u0027s own security authority; there is no hypervisor, IOMMU, or other trust-boundary crossing (a container-to-host panic is still scored Unchanged by convention).\nC:H - The window between the restore of skb-\u003edata and skb-\u003elen lets a racing thread read an inflated skb_headlen(), copying bytes past the valid data region directly to userspace via __skb_datagram_iter(); accumulated pushes extend the overread past skb_end_pointer() into skb_shared_info, leaking kernel pointers and stale slab contents, repeatably.\nI:L - The race corrupts sk_buff metadata (skb-\u003edata and skb-\u003elen) of a queued kernel object with stale values that persist for subsequent peeks, but it yields no out-of-bounds write or control-flow primitive.\nA:H - Driving skb-\u003edata below skb-\u003ehead reaches skb_under_panic() \u2192 BUG(), an unconditional kernel oops/panic, hit inside an RCU read-side critical section so the dying task leaves rcu_read_lock held (RCU stalls/hang), and a full panic with panic_on_oops set."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T11:46:53.346Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/66ffb0cf2125dcf9e902eede4a43653a24fd9cb2"
            },
            {
              "url": "https://git.kernel.org/stable/c/fa57f07ba0622c8692f40e1300adca59277b0044"
            },
            {
              "url": "https://git.kernel.org/stable/c/65c67049e9ed481f6b52264b39618b8c6dfb1d3e"
            },
            {
              "url": "https://git.kernel.org/stable/c/d91b4a9baa018a001d5c884e236c0cfd31f9f4a1"
            },
            {
              "url": "https://git.kernel.org/stable/c/7aa78d0d8546d8ce5a764add3f55d72e707c18f1"
            },
            {
              "url": "https://git.kernel.org/stable/c/b65292a548d847099a4fe0fff53122a06e798e25"
            },
            {
              "url": "https://git.kernel.org/stable/c/77ee7a6d16b6ec07b5c3ae2b6b60a24c1afbed09"
            }
          ],
          "title": "af_packet: fix vlan_get_tci() vs MSG_PEEK",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2024-57902",
        "datePublished": "2025-01-15T13:05:58.296Z",
        "dateReserved": "2025-01-11T14:45:42.031Z",
        "dateUpdated": "2026-08-05T11:46:53.346Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.