CVE-2024-58053 (GCVE-0-2024-58053)

Vulnerability from cvelistv5 – Published: 2025-03-06 15:53 – Updated: 2026-08-05 11:47
VLAI
Title
rxrpc: Fix handling of received connection abort
Summary
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix handling of received connection abort Fix the handling of a connection abort that we've received. Though the abort is at the connection level, it needs propagating to the calls on that connection. Whilst the propagation bit is performed, the calls aren't then woken up to go and process their termination, and as no further input is forthcoming, they just hang. Also add some tracing for the logging of connection aborts.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 248f219cb8bcbfbd7f132752d44afa2df7c241d1 , < 9c6702260557c0183d8417c79a37777a3d3e58e8 (git)
Affected: 248f219cb8bcbfbd7f132752d44afa2df7c241d1 , < 5842ce7b120c65624052a8da04460d35b26caac0 (git)
Affected: 248f219cb8bcbfbd7f132752d44afa2df7c241d1 , < 96d1d927c4d03ee9dcee7640bca70b74e63504fc (git)
Affected: 248f219cb8bcbfbd7f132752d44afa2df7c241d1 , < 0e56ebde245e4799ce74d38419426f2a80d39950 (git)
Create a notification for this product.
Linux Linux Affected: 4.9
Unaffected: 0 , < 4.9 (semver)
Unaffected: 6.6.76 , ≤ 6.6.* (semver)
Unaffected: 6.12.13 , ≤ 6.12.* (semver)
Unaffected: 6.13.2 , ≤ 6.13.* (semver)
Unaffected: 6.14 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/trace/events/rxrpc.h",
            "net/rxrpc/conn_event.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9c6702260557c0183d8417c79a37777a3d3e58e8",
              "status": "affected",
              "version": "248f219cb8bcbfbd7f132752d44afa2df7c241d1",
              "versionType": "git"
            },
            {
              "lessThan": "5842ce7b120c65624052a8da04460d35b26caac0",
              "status": "affected",
              "version": "248f219cb8bcbfbd7f132752d44afa2df7c241d1",
              "versionType": "git"
            },
            {
              "lessThan": "96d1d927c4d03ee9dcee7640bca70b74e63504fc",
              "status": "affected",
              "version": "248f219cb8bcbfbd7f132752d44afa2df7c241d1",
              "versionType": "git"
            },
            {
              "lessThan": "0e56ebde245e4799ce74d38419426f2a80d39950",
              "status": "affected",
              "version": "248f219cb8bcbfbd7f132752d44afa2df7c241d1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/trace/events/rxrpc.h",
            "net/rxrpc/conn_event.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.9"
            },
            {
              "lessThan": "4.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.76",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.76",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.13",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.2",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix handling of received connection abort\n\nFix the handling of a connection abort that we\u0027ve received.  Though the\nabort is at the connection level, it needs propagating to the calls on that\nconnection.  Whilst the propagation bit is performed, the calls aren\u0027t then\nwoken up to go and process their termination, and as no further input is\nforthcoming, they just hang.\n\nAlso add some tracing for the logging of connection aborts."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The trigger is an unauthenticated rxrpc ABORT packet delivered over UDP to an AF_RXRPC endpoint (kafs binds its callback-manager service to [::]:7001, and client connections accept aborts from the peer), handled entirely in net/rxrpc/io_thread.c \u2192 conn_event.c.\nAC:L - The attacker fully controls both steps \u2014 send a DATA packet to instantiate a service call on a channel, then send a connection-level ABORT \u2014 with no race, no memory-layout dependence, and no reliance on victim state.\nPR:N - The service call is created and attached to conn-\u003echannels[] before the rxrpc security challenge/response completes (state SERVICE_UNSECURED/CHALLENGING), and ABORT packets are never authenticated or encrypted, so no credentials of any kind are required.\nUI:N - Exploitation is entirely packet-driven against a listening rxrpc service or an in-flight connection; no action by any local user is needed.\nS:U - The leaked calls, hung RPCs and wedged cleanup path all remain within the kernel\u0027s own security authority; no VM, IOMMU or sandbox boundary is crossed.\nC:N - The defect is a missing rxrpc_poke_call() wake-up; no out-of-bounds read, freed-object read, or pointer disclosure occurs.\nI:N - No memory is corrupted and no attacker-controlled data is written anywhere \u2014 the only effect is that termination processing never runs.\nA:H - In-flight calls hang indefinitely, each aborted connection permanently leaks up to four rxrpc_call objects (plus conn/peer/local refs and queued skbs) that can be accumulated remotely at packet rate until OOM, and rxrpc_destroy_all_calls()\u0027s wait_var_event() then blocks cleanup_net forever, permanently preventing all network-namespace teardown on the host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:47:29.857Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9c6702260557c0183d8417c79a37777a3d3e58e8"
        },
        {
          "url": "https://git.kernel.org/stable/c/5842ce7b120c65624052a8da04460d35b26caac0"
        },
        {
          "url": "https://git.kernel.org/stable/c/96d1d927c4d03ee9dcee7640bca70b74e63504fc"
        },
        {
          "url": "https://git.kernel.org/stable/c/0e56ebde245e4799ce74d38419426f2a80d39950"
        }
      ],
      "title": "rxrpc: Fix handling of received connection abort",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-58053",
    "datePublished": "2025-03-06T15:53:57.558Z",
    "dateReserved": "2025-03-06T15:52:09.178Z",
    "dateUpdated": "2026-08-05T11:47:29.857Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-58053",
      "date": "2026-08-05",
      "epss": "0.00443",
      "percentile": "0.36374"
    },
    "microsoft_vex": {
      "current_release_date": "2026-03-31T14:49:27.000Z",
      "cve": "CVE-2024-58053",
      "id": "msrc_CVE-2024-58053",
      "initial_release_date": "2025-03-02T00:00:00.000Z",
      "product_status:known_affected": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "rxrpc: Fix handling of received connection abort",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2024-58053.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-58053\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-03-06T16:15:51.490\",\"lastModified\":\"2026-06-17T08:14:31.220\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nrxrpc: Fix handling of received connection abort\\n\\nFix the handling of a connection abort that we\u0027ve received.  Though the\\nabort is at the connection level, it needs propagating to the calls on that\\nconnection.  Whilst the propagation bit is performed, the calls aren\u0027t then\\nwoken up to go and process their termination, and as no further input is\\nforthcoming, they just hang.\\n\\nAlso add some tracing for the logging of connection aborts.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: rxrpc: Se ha corregido la gesti\u00f3n de la interrupci\u00f3n de la conexi\u00f3n recibida Se ha corregido la gesti\u00f3n de una interrupci\u00f3n de la conexi\u00f3n que hemos recibido. Aunque la interrupci\u00f3n se produce a nivel de conexi\u00f3n, es necesario propagarla a las llamadas de esa conexi\u00f3n. Mientras se realiza el bit de propagaci\u00f3n, las llamadas no se activan para procesar su finalizaci\u00f3n y, como no se recibe ninguna otra entrada, simplemente se cuelgan. Tambi\u00e9n se ha a\u00f1adido alg\u00fan seguimiento para el registro de las interrupciones de la conexi\u00f3n.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"include/trace/events/rxrpc.h\",\"net/rxrpc/conn_event.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"248f219cb8bcbfbd7f132752d44afa2df7c241d1\",\"lessThan\":\"9c6702260557c0183d8417c79a37777a3d3e58e8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"248f219cb8bcbfbd7f132752d44afa2df7c241d1\",\"lessThan\":\"5842ce7b120c65624052a8da04460d35b26caac0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"248f219cb8bcbfbd7f132752d44afa2df7c241d1\",\"lessThan\":\"96d1d927c4d03ee9dcee7640bca70b74e63504fc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"248f219cb8bcbfbd7f132752d44afa2df7c241d1\",\"lessThan\":\"0e56ebde245e4799ce74d38419426f2a80d39950\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"include/trace/events/rxrpc.h\",\"net/rxrpc/conn_event.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.9\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.9\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.76\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.13\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13.2\",\"lessThanOrEqual\":\"6.13.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.14\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.9\",\"versionEndExcluding\":\"6.6.76\",\"matchCriteriaId\":\"D4861BDC-5E69-4657-B49D-0B12D497DA9B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.13\",\"matchCriteriaId\":\"2897389C-A8C3-4D69-90F2-E701B3D66373\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.13.2\",\"matchCriteriaId\":\"6D4116B1-1BFD-4F23-BA84-169CC05FC5A3\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0e56ebde245e4799ce74d38419426f2a80d39950\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5842ce7b120c65624052a8da04460d35b26caac0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/96d1d927c4d03ee9dcee7640bca70b74e63504fc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9c6702260557c0183d8417c79a37777a3d3e58e8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-05T03:46:35+00:00",
      "cve": "CVE-2024-58053",
      "id": "CVE-2024-58053",
      "initial_release_date": "2024-01-01T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: rxrpc: Fix handling of received connection abort",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-58053.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.