CVE-2024-46855 (GCVE-0-2024-46855)
Vulnerability from cvelistv5
Published
2024-09-27 12:42
Modified
2026-08-05 11:39
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_socket: fix sk refcount leaks We must put 'sk' reference before returning.
References
Impacted products
Vendor Product Version
Linux Linux Version: 039b1f4f24ecc8493b6bb9d70b4b78750d1b35c2
Version: 039b1f4f24ecc8493b6bb9d70b4b78750d1b35c2
Version: 039b1f4f24ecc8493b6bb9d70b4b78750d1b35c2
Version: 039b1f4f24ecc8493b6bb9d70b4b78750d1b35c2
Version: 039b1f4f24ecc8493b6bb9d70b4b78750d1b35c2
Version: 039b1f4f24ecc8493b6bb9d70b4b78750d1b35c2
Version: 039b1f4f24ecc8493b6bb9d70b4b78750d1b35c2
Version: 6934809432d23e9e0081f82d882b8fc765deeb4a
Version: f63432cd1bb224f61216e4a4726ff29ddffbed98
Version: 4.19.76   ≤
Version: 5.2.18   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-46855",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-29T13:58:06.943532Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-29T13:58:11.133Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:19:41.790Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nft_socket.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "076d281e90aaf4192799ecb9a1ed82321e133ecd",
              "status": "affected",
              "version": "039b1f4f24ecc8493b6bb9d70b4b78750d1b35c2",
              "versionType": "git"
            },
            {
              "lessThan": "6572440f78b724c46070841a68254ebc534cde24",
              "status": "affected",
              "version": "039b1f4f24ecc8493b6bb9d70b4b78750d1b35c2",
              "versionType": "git"
            },
            {
              "lessThan": "ddc7c423c4a5386bf865474c694b48178efd311a",
              "status": "affected",
              "version": "039b1f4f24ecc8493b6bb9d70b4b78750d1b35c2",
              "versionType": "git"
            },
            {
              "lessThan": "33c2258bf8cb17fba9e58b111d4c4f4cf43a4896",
              "status": "affected",
              "version": "039b1f4f24ecc8493b6bb9d70b4b78750d1b35c2",
              "versionType": "git"
            },
            {
              "lessThan": "83e6fb59040e8964888afcaa5612cc1243736715",
              "status": "affected",
              "version": "039b1f4f24ecc8493b6bb9d70b4b78750d1b35c2",
              "versionType": "git"
            },
            {
              "lessThan": "1f68e097e20d3c695281a9c6433acc37be47fe11",
              "status": "affected",
              "version": "039b1f4f24ecc8493b6bb9d70b4b78750d1b35c2",
              "versionType": "git"
            },
            {
              "lessThan": "8b26ff7af8c32cb4148b3e147c52f9e4c695209c",
              "status": "affected",
              "version": "039b1f4f24ecc8493b6bb9d70b4b78750d1b35c2",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "6934809432d23e9e0081f82d882b8fc765deeb4a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f63432cd1bb224f61216e4a4726ff29ddffbed98",
              "versionType": "git"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.76",
              "versionType": "semver"
            },
            {
              "lessThan": "5.3",
              "status": "affected",
              "version": "5.2.18",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nft_socket.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.3"
            },
            {
              "lessThan": "5.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.295",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.239",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.168",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.295",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.239",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.168",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.111",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.52",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.11",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.76",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.2.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_socket: fix sk refcount leaks\n\nWe must put \u0027sk\u0027 reference before returning."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The leak occurs in `nft_socket_eval()`, the per-packet evaluation path invoked from the PREROUTING/INPUT netfilter hooks, and is driven entirely by attacker-supplied packet headers \u2014 `NF_INET_PRE_ROUTING` runs before early demux, so every received packet performs the refcounted socket lookup that is then leaked. A remote, off-host attacker sending TCP/UDP traffic at a firewall or router whose ruleset uses the `socket mark`/`wildcard`/`cgroupv2` expression reaches the defect with no local access.\nAC:L - The attacker creates every precondition themselves: opening and closing a TCP connection leaves a TIME_WAIT sock, and a bare SYN leaves a NEW_SYN_RECV request sock, both of which fail `sk_fullsock()` so each subsequent packet matching that tuple deterministically leaks a reference. There is no race, no memory-layout dependency, and no reliance on victim state \u2014 the leak is reproducible on every packet.\nPR:N - No credential, account, or capability on the target is needed; an unauthenticated remote host only has to emit packets that traverse the affected chain. The rule that reaches the expression is installed by the administrator, not the attacker, so nothing about the attacker\u0027s own privilege level gates the code path.\nUI:N - Rule evaluation happens automatically for every packet traversing the hook; no administrator or victim must open a file, mount anything, or take any action for the attacker\u0027s traffic to leak references.\nS:U - The leaked `struct sock`/`request_sock` objects and the resulting memory exhaustion are entirely within the kernel\u0027s own security authority in the nf_tables engine; no VM, IOMMU, or sandbox boundary is crossed.\nC:N - The missed `sock_gen_put()` neither reads out of bounds nor copies kernel memory anywhere the attacker can observe; the only kernel-address disclosure is the `refcount_warn_saturate()` splat in the target\u0027s dmesg, which the remote attacker cannot read. No data is exposed to the attacker.\nI:N - All three leaking paths set `NFT_BREAK` exactly as the fixed code does, so packet classification and the enforced ruleset are identical before and after the fix. Nothing is written out of bounds and `refcount_t` saturates rather than wrapping, so no use-after-free or write primitive arises.\nA:H - Every matching packet permanently leaks a socket object \u2014 leaked `reqsk`s also pin their listener and leaked full sockets pin their entire net namespace \u2014 giving an unauthenticated remote attacker an unbounded, self-paced kernel memory exhaustion primitive that ends in OOM and total loss of service. Sustained traffic against a single long-lived socket additionally drives `sk_refcnt` to `refcount_t` saturation, producing a WARN that panics the kernel outright on the `panic_on_warn=1` configurations standard in hardened, cloud, and CI fleets."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:39:02.124Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/076d281e90aaf4192799ecb9a1ed82321e133ecd"
        },
        {
          "url": "https://git.kernel.org/stable/c/6572440f78b724c46070841a68254ebc534cde24"
        },
        {
          "url": "https://git.kernel.org/stable/c/ddc7c423c4a5386bf865474c694b48178efd311a"
        },
        {
          "url": "https://git.kernel.org/stable/c/33c2258bf8cb17fba9e58b111d4c4f4cf43a4896"
        },
        {
          "url": "https://git.kernel.org/stable/c/83e6fb59040e8964888afcaa5612cc1243736715"
        },
        {
          "url": "https://git.kernel.org/stable/c/1f68e097e20d3c695281a9c6433acc37be47fe11"
        },
        {
          "url": "https://git.kernel.org/stable/c/8b26ff7af8c32cb4148b3e147c52f9e4c695209c"
        }
      ],
      "title": "netfilter: nft_socket: fix sk refcount leaks",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-46855",
    "datePublished": "2024-09-27T12:42:47.281Z",
    "dateReserved": "2024-09-11T15:12:18.291Z",
    "dateUpdated": "2026-08-05T11:39:02.124Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T22:19:41.790Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-46855\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-29T13:58:06.943532Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-29T13:58:08.014Z\"}}], \"cna\": {\"title\": \"netfilter: nft_socket: fix sk refcount leaks\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"039b1f4f24ecc8493b6bb9d70b4b78750d1b35c2\", \"lessThan\": \"076d281e90aaf4192799ecb9a1ed82321e133ecd\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"039b1f4f24ecc8493b6bb9d70b4b78750d1b35c2\", \"lessThan\": \"6572440f78b724c46070841a68254ebc534cde24\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"039b1f4f24ecc8493b6bb9d70b4b78750d1b35c2\", \"lessThan\": \"ddc7c423c4a5386bf865474c694b48178efd311a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"039b1f4f24ecc8493b6bb9d70b4b78750d1b35c2\", \"lessThan\": \"33c2258bf8cb17fba9e58b111d4c4f4cf43a4896\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"039b1f4f24ecc8493b6bb9d70b4b78750d1b35c2\", \"lessThan\": \"83e6fb59040e8964888afcaa5612cc1243736715\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"039b1f4f24ecc8493b6bb9d70b4b78750d1b35c2\", \"lessThan\": \"1f68e097e20d3c695281a9c6433acc37be47fe11\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"039b1f4f24ecc8493b6bb9d70b4b78750d1b35c2\", \"lessThan\": \"8b26ff7af8c32cb4148b3e147c52f9e4c695209c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6934809432d23e9e0081f82d882b8fc765deeb4a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f63432cd1bb224f61216e4a4726ff29ddffbed98\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4.19.76\", \"lessThan\": \"4.20\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.2.18\", \"lessThan\": \"5.3\", \"versionType\": \"semver\"}], \"programFiles\": [\"net/netfilter/nft_socket.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.3\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.3\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.4.295\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.239\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.168\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.111\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.52\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.11\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/netfilter/nft_socket.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/076d281e90aaf4192799ecb9a1ed82321e133ecd\"}, {\"url\": \"https://git.kernel.org/stable/c/6572440f78b724c46070841a68254ebc534cde24\"}, {\"url\": \"https://git.kernel.org/stable/c/ddc7c423c4a5386bf865474c694b48178efd311a\"}, {\"url\": \"https://git.kernel.org/stable/c/33c2258bf8cb17fba9e58b111d4c4f4cf43a4896\"}, {\"url\": \"https://git.kernel.org/stable/c/83e6fb59040e8964888afcaa5612cc1243736715\"}, {\"url\": \"https://git.kernel.org/stable/c/1f68e097e20d3c695281a9c6433acc37be47fe11\"}, {\"url\": \"https://git.kernel.org/stable/c/8b26ff7af8c32cb4148b3e147c52f9e4c695209c\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnetfilter: nft_socket: fix sk refcount leaks\\n\\nWe must put \u0027sk\u0027 reference before returning.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.295\", \"versionStartIncluding\": \"5.3\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.239\", \"versionStartIncluding\": \"5.3\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.168\", \"versionStartIncluding\": \"5.3\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.111\", \"versionStartIncluding\": \"5.3\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.52\", \"versionStartIncluding\": \"5.3\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.11\", \"versionStartIncluding\": \"5.3\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11\", \"versionStartIncluding\": \"5.3\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"4.19.76\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"5.2.18\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-23T15:53:38.005Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-46855\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-23T15:53:38.005Z\", \"dateReserved\": \"2024-09-11T15:12:18.291Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-09-27T12:42:47.281Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.