CVE-2024-49952
Medium · 5.5CVSS
5.5
EPSS
0.3%
Published
Oct 21, 2024
CISA due date
—
Cloudanix analysis
A flaw in Linux network handling can let local users trigger crashes by racing certain packet duplication operations.
- Exploitation
- Local Privilege
- Attacker needs
- Low Privilege
- Complexity
- Low
- Impact
- Denial Of Service
- Component
- OS kernel
- Class
- Race Condition
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Unsafe concurrent write to per-CPU variable nf_skb_duplicated in nf_dup_ipv4/nf_dup_ipv6 without disabling soft interrupts, allowing corruption under race conditions in netfilter nftables processing.
Why it matters to the business
Kernel-level instability or crashes during network packet duplication on Linux systems, disrupting network services and requiring urgent patching across prevalent Linux deployments.
How an attack unfolds
An attacker with local access crafts nftables rules or sends traffic that triggers nf_dup_ipv4 or nf_dup_ipv6 evaluation paths, exploiting the preemptible context to corrupt the per-CPU variable via __this_cpu_write during concurrent soft interrupt handling.
How to fix it
Apply kernel patches that disable soft interrupts around the per-CPU write in nf_dup functions; upgrade affected packages to actionview (RubyGems) 6.1.7.3 where applicable.
How to confirm the fix worked
Confirm kernel build includes the nf_dup softirq disable fix; test nft_dup evaluation under load with preemption enabled; verify no splat in dmesg for __this_cpu_write in preemptible context.
Typical attack path
- Obtain local user access on affected Linux system
- Load or manipulate nftables rules invoking dup_ipv4/ipv6 expressions
- Trigger concurrent UDP or IP send operations that reach nf_hook and duplication logic
- Exploit timing window to cause unsafe per-CPU write without softirq disabled
- Induce corruption leading to denial of service
How to detect it
Inspect kernel logs for BUG splats referencing nf_dup_ipv4, check_preemption_disabled, or __this_cpu_write in netfilter paths; correlate with nft_do_chain and udp_sendmsg activity.
- nf_dup_ipv4+0x651
- BUG: using __this_cpu_write() in preemptible
- nft_dup_ipv4_eval
- nf_skb_duplicated
What your security team should do
- Prioritize patching Linux kernels exposing nf_tables dup functionality
- Monitor for local privilege or DoS attempts via nftables
- Restrict unprivileged nftables rule creation until fixed
- Review EPSS trend stability and absence from KEV for deployment scheduling
The record
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: prevent nf_skb_duplicated corruption syzbot found that nf_dup_ipv4() or nf_dup_ipv6() could write per-cpu variable nf_skb_duplicated in an unsafe way [1]. Disabling preemption as hinted by the splat is not enough, we have to disable soft interrupts as well. [1] BUG: using __this_cpu_write() in preemptible [00000000] code: syz.4.282/6316 caller is nf_dup_ipv4+0x651/0x8f0 net/ipv4/netfilter/nf_dup_ipv4.c:87 CPU: 0 UID: 0 PID: 6316 Comm: syz.4.282 Not tainted 6.11.0-rc7-syzkaller-00104-g7052622fccb1 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:93 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119 check_preemption_disabled+0x10e/0x120 lib/smp_processor_id.c:49 nf_dup_ipv4+0x651/0x8f0 net/ipv4/netfilter/nf_dup_ipv4.c:87 nft_dup_ipv4_eval+0x1db/0x300 net/ipv4/netfilter/nft_dup_ipv4.c:30 expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline] nft_do_chain+0x4ad/0x1da0 net/netfilter/nf_tables_core.c:288 nft_do_chain_ipv4+0x202/0x320 net/netfilter/nft_chain_filter.c:23 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xc3/0x220 net/netfilter/core.c:626 nf_hook+0x2c4/0x450 include/linux/netfilter.h:269 NF_HOOK_COND include/linux/netfilter.h:302 [inline] ip_output+0x185/0x230 net/ipv4/ip_output.c:433 ip_local_out net/ipv4/ip_output.c:129 [inline] ip_send_skb+0x74/0x100 net/ipv4/ip_output.c:1495 udp_send_skb+0xacf/0x1650 net/ipv4/udp.c:981 udp_sendmsg+0x1c21/0x2a60 net/ipv4/udp.c:1269 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x1a6/0x270 net/socket.c:745 ____sys_sendmsg+0x525/0x7d0 net/socket.c:2597 ___sys_sendmsg net/socket.c:2651 [inline] __sys_sendmmsg+0x3b2/0x740 net/socket.c:2737 __do_sys_sendmmsg net/socket.c:2766 [inline] __se_sys_sendmmsg net/socket.c:2763 [inline] __x64_sys_sendmmsg+0xa0/0xb0 net/socket.c:2763 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f4ce4f7def9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f4ce5d4a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 RAX: ffffffffffffffda RBX: 00007f4ce5135f80 RCX: 00007f4ce4f7def9 RDX: 0000000000000001 RSI: 0000000020005d40 RDI: 0000000000000006 RBP: 00007f4ce4ff0b76 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f4ce5135f80 R15: 00007ffd4cbc6d68 </TASK>
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | linux | 0 | No fix |
| Debian:11 | linux | 0 | 5.10.234-1 |
| Debian:11 | linux-6.1 | 0 | 6.1.119-1~deb11u1 |
| Debian:12 | linux | 0 | No fix |
| Debian:13 | linux | 0 | No fix |
| Debian:13 | linux | 0 | 6.11.4-1 |
| Linux | Kernel | 4.3.0 | 4.19.323 |
| Mageia:9 | kernel | 0 | 6.6.58-2.mga9 |
| Mageia:9 | kernel-firmware | 0 | 20240909-1.mga9 |
| Mageia:9 | kernel-firmware-nonfree | 0 | 20240909-1.mga9.nonfree |
| Mageia:9 | kernel-linus | 0 | 6.6.58-2.mga9 |
| Mageia:9 | kmod-virtualbox | 0 | 7.0.20-57.mga9 |
| Mageia:9 | kmod-xtables-addons | 0 | 3.24-65.mga9 |
| Mageia:9 | radeon-firmware | 0 | 20240909-1.mga9.nonfree |
| SUSE:Linux Enterprise High Availability Extension 12 SP5 | kernel-default | 0 | 4.12.14-122.237.1 |
| SUSE:Linux Enterprise High Availability Extension 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.30.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | kernel-64kb | 0 | 5.14.21-150500.55.91.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | kernel-default | 0 | 5.14.21-150500.55.91.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | kernel-default-base | 0 | 5.14.21-150500.55.91.1.150500.6.41.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | kernel-docs | 0 | 5.14.21-150500.55.91.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | kernel-obs-build | 0 | 5.14.21-150500.55.91.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | kernel-source | 0 | 5.14.21-150500.55.91.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | kernel-syms | 0 | 5.14.21-150500.55.91.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | kernel-64kb | 0 | 5.14.21-150500.55.91.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | kernel-default | 0 | 5.14.21-150500.55.91.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | kernel-default-base | 0 | 5.14.21-150500.55.91.1.150500.6.41.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | kernel-docs | 0 | 5.14.21-150500.55.91.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | kernel-obs-build | 0 | 5.14.21-150500.55.91.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | kernel-source | 0 | 5.14.21-150500.55.91.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | kernel-syms | 0 | 5.14.21-150500.55.91.1 |
| SUSE:Linux Enterprise Live Patching 12 SP5 | kernel-default | 0 | 4.12.14-122.237.1 |
| SUSE:Linux Enterprise Live Patching 12 SP5 | kgraft-patch-SLE12-SP5_Update_63 | 0 | 1-8.3.1 |
| SUSE:Linux Enterprise Live Patching 15 SP5 | kernel-default | 0 | 5.14.21-150500.55.91.1 |
| SUSE:Linux Enterprise Live Patching 15 SP5 | kernel-livepatch-SLE15-SP5_Update_22 | 0 | 1-150500.11.3.1 |
| SUSE:Linux Enterprise Live Patching 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.30.1 |
| SUSE:Linux Enterprise Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6-RT_Update_6 | 0 | 1-150600.1.3.1 |
| SUSE:Linux Enterprise Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6_Update_6 | 0 | 1-150600.13.3.5 |
| SUSE:Linux Enterprise Micro 5.5 | kernel-default | 0 | 5.14.21-150500.55.91.1 |
| SUSE:Linux Enterprise Micro 5.5 | kernel-default-base | 0 | 5.14.21-150500.55.91.1.150500.6.41.1 |
| SUSE:Linux Enterprise Micro 5.5 | kernel-rt | 0 | 5.14.21-150500.13.82.1 |
| SUSE:Linux Enterprise Micro 5.5 | kernel-source-rt | 0 | 5.14.21-150500.13.82.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-64kb | 0 | 6.4.0-150600.23.30.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.30.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-default-base | 0 | 6.4.0-150600.23.30.1.150600.12.12.6 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-source | 0 | 6.4.0-150600.23.30.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | kernel-zfcpdump | 0 | 6.4.0-150600.23.30.1 |
| SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 | kernel-coco | 0 | 6.4.0-15061.12.coco15sp6.1 |
| SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 | kernel-coco_debug | 0 | 6.4.0-15061.12.coco15sp6.1 |
| SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 | kernel-source-coco | 0 | 6.4.0-15061.12.coco15sp6.1 |
| SUSE:Linux Enterprise Module for Confidential Computing Technical Preview 15 SP6 | kernel-syms-coco | 0 | 6.4.0-15061.12.coco15sp6.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-docs | 0 | 6.4.0-150600.23.30.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-obs-build | 0 | 6.4.0-150600.23.30.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-source | 0 | 6.4.0-150600.23.30.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | kernel-syms | 0 | 6.4.0-150600.23.30.1 |
| SUSE:Linux Enterprise Module for Legacy 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.30.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | kernel-azure | 0 | 6.4.0-150600.8.20.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | kernel-source-azure | 0 | 6.4.0-150600.8.20.1 |
| SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | kernel-syms-azure | 0 | 6.4.0-150600.8.20.1 |
| SUSE:Linux Enterprise Server 12 SP5-LTSS | kernel-default | 0 | 4.12.14-122.237.1 |
| SUSE:Linux Enterprise Server 12 SP5-LTSS | kernel-source | 0 | 4.12.14-122.237.1 |
| SUSE:Linux Enterprise Server 12 SP5-LTSS | kernel-syms | 0 | 4.12.14-122.237.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | kernel-64kb | 0 | 5.14.21-150500.55.91.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | kernel-default | 0 | 5.14.21-150500.55.91.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | kernel-default-base | 0 | 5.14.21-150500.55.91.1.150500.6.41.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | kernel-docs | 0 | 5.14.21-150500.55.91.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | kernel-obs-build | 0 | 5.14.21-150500.55.91.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | kernel-source | 0 | 5.14.21-150500.55.91.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | kernel-syms | 0 | 5.14.21-150500.55.91.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | kernel-zfcpdump | 0 | 5.14.21-150500.55.91.1 |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | kernel-default | 0 | 4.12.14-122.237.1 |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | kernel-source | 0 | 4.12.14-122.237.1 |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | kernel-syms | 0 | 4.12.14-122.237.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | kernel-default | 0 | 5.14.21-150500.55.91.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | kernel-default-base | 0 | 5.14.21-150500.55.91.1.150500.6.41.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | kernel-docs | 0 | 5.14.21-150500.55.91.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | kernel-obs-build | 0 | 5.14.21-150500.55.91.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | kernel-source | 0 | 5.14.21-150500.55.91.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | kernel-syms | 0 | 5.14.21-150500.55.91.1 |
| SUSE:Linux Enterprise Workstation Extension 15 SP6 | kernel-default | 0 | 6.4.0-150600.23.30.1 |
| SUSE:Real Time Module 15 SP6 | kernel-rt | 0 | 6.4.0-150600.10.20.1 |
| SUSE:Real Time Module 15 SP6 | kernel-rt_debug | 0 | 6.4.0-150600.10.20.1 |
| SUSE:Real Time Module 15 SP6 | kernel-source-rt | 0 | 6.4.0-150600.10.20.1 |
| SUSE:Real Time Module 15 SP6 | kernel-syms-rt | 0 | 6.4.0-150600.10.20.1 |
| Ubuntu:20.04:LTS | linux-aws-5.15 | 0 | 5.15.0-1073.79~20.04.1 |
| Ubuntu:20.04:LTS | linux-azure-5.15 | 0 | 5.15.0-1078.87~20.04.1 |
| Ubuntu:20.04:LTS | linux-gcp-5.15 | 0 | 5.15.0-1072.80~20.04.1 |
| Ubuntu:20.04:LTS | linux-hwe-5.15 | 0 | 5.15.0-127.137~20.04.1 |
| Ubuntu:20.04:LTS | linux-ibm-5.15 | 0 | 5.15.0-1066.69~20.04.1 |
| Ubuntu:20.04:LTS | linux-intel-iotg-5.15 | 0 | 5.15.0-1071.77~20.04.1 |
| Ubuntu:20.04:LTS | linux-lowlatency-hwe-5.15 | 0 | 5.15.0-127.137~20.04.1 |
| Ubuntu:20.04:LTS | linux-oracle-5.15 | 0 | 5.15.0-1071.77~20.04.1 |
| Ubuntu:22.04:LTS | linux | 0 | 5.15.0-127.137 |
| Ubuntu:22.04:LTS | linux-aws | 0 | 5.15.0-1073.79 |
| Ubuntu:22.04:LTS | linux-azure | 0 | 5.15.0-1078.87 |
| Ubuntu:22.04:LTS | linux-gcp | 0 | 5.15.0-1072.80 |
| Ubuntu:22.04:LTS | linux-gke | 0 | 5.15.0-1070.76 |
| Ubuntu:22.04:LTS | linux-gkeop | 0 | 5.15.0-1056.63 |
| Ubuntu:22.04:LTS | linux-ibm | 0 | 5.15.0-1066.69 |
| Ubuntu:22.04:LTS | linux-intel-iotg | 0 | 5.15.0-1071.77 |
| Ubuntu:22.04:LTS | linux-kvm | 0 | 5.15.0-1070.75 |
| Ubuntu:22.04:LTS | linux-lowlatency | 0 | 5.15.0-127.137 |
| Ubuntu:22.04:LTS | linux-nvidia | 0 | 5.15.0-1068.69 |
| Ubuntu:22.04:LTS | linux-oracle | 0 | 5.15.0-1071.77 |
| Ubuntu:22.04:LTS | linux-raspi | 0 | 5.15.0-1066.69 |
| Ubuntu:22.04:LTS | linux-xilinx-zynqmp | 0 | 5.15.0-1039.43 |
| Ubuntu:24.10 | linux | 0 | 6.11.0-18.18 |
| Ubuntu:24.10 | linux-aws | 0 | 6.11.0-1009.10 |
| Ubuntu:24.10 | linux-azure | 0 | 6.11.0-1009.9 |
| Ubuntu:24.10 | linux-gcp | 0 | 6.11.0-1009.9 |
| Ubuntu:24.10 | linux-lowlatency | 0 | 6.11.0-1010.11 |
| Ubuntu:24.10 | linux-oracle | 0 | 6.11.0-1011.12 |
| Ubuntu:24.10 | linux-raspi | 0 | 6.11.0-1008.8 |
| Ubuntu:24.10 | linux-realtime | 0 | 6.11.0-1005.5 |
| openSUSE:Leap 15.6 | dtb-aarch64 | 0 | 6.4.0-150600.23.30.1 |
| openSUSE:Leap 15.6 | kernel-64kb | 0 | 6.4.0-150600.23.30.1 |
| openSUSE:Leap 15.6 | kernel-azure | 0 | 6.4.0-150600.8.20.1 |
| openSUSE:Leap 15.6 | kernel-debug | 0 | 6.4.0-150600.23.30.1 |
| openSUSE:Leap 15.6 | kernel-default | 0 | 6.4.0-150600.23.30.1 |
| openSUSE:Leap 15.6 | kernel-default-base | 0 | 6.4.0-150600.23.30.1.150600.12.12.6 |
| openSUSE:Leap 15.6 | kernel-docs | 0 | 6.4.0-150600.23.30.1 |
| openSUSE:Leap 15.6 | kernel-kvmsmall | 0 | 6.4.0-150600.23.30.1 |
| openSUSE:Leap 15.6 | kernel-obs-build | 0 | 6.4.0-150600.23.30.1 |
| openSUSE:Leap 15.6 | kernel-obs-qa | 0 | 6.4.0-150600.23.30.1 |
| openSUSE:Leap 15.6 | kernel-rt | 0 | 6.4.0-150600.10.20.1 |
| openSUSE:Leap 15.6 | kernel-rt_debug | 0 | 6.4.0-150600.10.20.1 |
| openSUSE:Leap 15.6 | kernel-source | 0 | 6.4.0-150600.23.30.1 |
| openSUSE:Leap 15.6 | kernel-source-azure | 0 | 6.4.0-150600.8.20.1 |
| openSUSE:Leap 15.6 | kernel-source-rt | 0 | 6.4.0-150600.10.20.1 |
| openSUSE:Leap 15.6 | kernel-syms | 0 | 6.4.0-150600.23.30.1 |
| openSUSE:Leap 15.6 | kernel-syms-azure | 0 | 6.4.0-150600.8.20.1 |
| openSUSE:Leap 15.6 | kernel-syms-rt | 0 | 6.4.0-150600.10.20.1 |
| openSUSE:Leap 15.6 | kernel-zfcpdump | 0 | 6.4.0-150600.23.30.1 |
| openSUSE:Tumbleweed | kernel-source | 0 | 6.11.8-1.1 |
| openSUSE:Tumbleweed | kernel-source-longterm | 0 | 6.12.11-1.1 |
Related vulnerabilities
- CVE-2025-39885 In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix recursive… Also affects linux
- CVE-2025-39883 In the Linux kernel, the following vulnerability has been resolved: mm/memory-failure… Also affects linux
- CVE-2025-39876 In the Linux kernel, the following vulnerability has been resolved: net: fec: Fix… Also affects linux
- CVE-2025-39869 In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: edma… Also affects linux
- CVE-2025-39873 In the Linux kernel, the following vulnerability has been resolved: can: xilinx_can… Also affects linux
- CVE-2025-39863 In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix… Also affects linux
- CVE-2025-39865 In the Linux kernel, the following vulnerability has been resolved: tee: fix NULL pointer… Also affects linux
- CVE-2025-39866 In the Linux kernel, the following vulnerability has been resolved: fs: writeback: fix… Also affects linux