CVE-2024-40957— seg6: fix parameter passing when calling NF_HOOK() in End.DX4 and End.DX6 behaviors
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel 存在安全漏洞，该漏洞源于 seg6 组件在调用 NF_HOOK 函数时存在参数传递问题。
Possible ATT&CK Techniques 1 AI
T1055 · Process InjectionAffected Version Matrix 12
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 7a3f5b0de3647c854e34269c3332d7a1e902901a< af90e3d73dc45778767b2fb6e7edd57ebe34380d |
affected |
7a3f5b0de3647c854e34269c3332d7a1e902901a< ec4d970b597ee5e17b0d8d73b7875197ce9a04d4 |
affected | ||
7a3f5b0de3647c854e34269c3332d7a1e902901a< d62df86c172033679d744f07d89e93e367dd11f6 |
affected | ||
7a3f5b0de3647c854e34269c3332d7a1e902901a< 561475d53aa7e4511ee7cdba8728ded81cf1db1c |
affected | ||
7a3f5b0de3647c854e34269c3332d7a1e902901a< 9a3bc8d16e0aacd65c31aaf23a2bced3288a7779 |
affected | ||
5.15 |
affected | ||
< 5.15 |
unaffected | ||
5.15.162≤ 5.15.* |
unaffected | ||
| … +4 more rows | |||
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-40957
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
seg6: fix parameter passing when calling NF_HOOK() in End.DX4 and End.DX6 behaviors
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
seg6: fix parameter passing when calling NF_HOOK() in End.DX4 and End.DX6 behaviors
input_action_end_dx4() and input_action_end_dx6() are called NF_HOOK() for
PREROUTING hook, in PREROUTING hook, we should passing a valid indev,
and a NULL outdev to NF_HOOK(), otherwise may trigger a NULL pointer
dereference, as below:
[74830.647293] BUG: kernel NULL pointer dereference, address: 0000000000000090
[74830.655633] #PF: supervisor read access in kernel mode
[74830.657888] #PF: error_code(0x0000) - not-present page
[74830.659500] PGD 0 P4D 0
[74830.660450] Oops: 0000 [#1] PREEMPT SMP PTI
...
[74830.664953] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
[74830.666569] RIP: 0010:rpfilter_mt+0x44/0x15e [ipt_rpfilter]
...
[74830.689725] Call Trace:
[74830.690402] <IRQ>
[74830.690953] ? show_trace_log_lvl+0x1c4/0x2df
[74830.692020] ? show_trace_log_lvl+0x1c4/0x2df
[74830.693095] ? ipt_do_table+0x286/0x710 [ip_tables]
[74830.694275] ? __die_body.cold+0x8/0xd
[74830.695205] ? page_fault_oops+0xac/0x140
[74830.696244] ? exc_page_fault+0x62/0x150
[74830.697225] ? asm_exc_page_fault+0x22/0x30
[74830.698344] ? rpfilter_mt+0x44/0x15e [ipt_rpfilter]
[74830.699540] ipt_do_table+0x286/0x710 [ip_tables]
[74830.700758] ? ip6_route_input+0x19d/0x240
[74830.701752] nf_hook_slow+0x3f/0xb0
[74830.702678] input_action_end_dx4+0x19b/0x1e0
[74830.703735] ? input_action_end_t+0xe0/0xe0
[74830.704734] seg6_local_input_core+0x2d/0x60
[74830.705782] lwtunnel_input+0x5b/0xb0
[74830.706690] __netif_receive_skb_one_core+0x63/0xa0
[74830.707825] process_backlog+0x99/0x140
[74830.709538] __napi_poll+0x2c/0x160
[74830.710673] net_rx_action+0x296/0x350
[74830.711860] __do_softirq+0xcb/0x2ac
[74830.713049] do_softirq+0x63/0x90
input_action_end_dx4() passing a NULL indev to NF_HOOK(), and finally
trigger a NULL dereference in rpfilter_mt()->rpfilter_is_loopback():
static bool
rpfilter_is_loopback(const struct sk_buff *skb,
const struct net_device *in)
{
// in is NULL
return skb->pkt_type == PACKET_LOOPBACK ||
in->flags & IFF_LOOPBACK;
}
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel 存在安全漏洞，该漏洞源于 seg6 组件在调用 NF_HOOK 函数时存在参数传递问题。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2024-40957
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-40957
请登录查看更多情报信息。
Other References for CVE-2024-40957 (5)
Same Patch Batch · Linux · 2024-07-12 · 122 CVEs total
| CVE-2024-40937 | 9.8 CRITICAL | gve: Clear napi->skb before dev_kfree_skb_any() |
| CVE-2024-40907 | 9.8 CRITICAL | ionic: fix kernel panic in XDP_TX action |
| CVE-2024-40999 | 9.8 CRITICAL | net: ena: Add validation for completion descriptors consistency |
| CVE-2024-40923 | 9.8 CRITICAL | vmxnet3: disable rx data ring on dma allocation failure |
| CVE-2024-40983 | 9.8 CRITICAL | tipc: force a dst refcount before doing decryption |
| CVE-2024-40910 | 8.8 HIGH | ax25: Fix refcount imbalance on inbound connections |
| CVE-2024-40911 | 8.8 HIGH | wifi: cfg80211: Lock wiphy in cfg80211_get_station |
| CVE-2024-40941 | 8.1 HIGH | wifi: iwlwifi: mvm: don't read past the mfuart notifcation |
| CVE-2024-40953 | 7.9 HIGH | KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin() |
| CVE-2024-40947 | 7.8 HIGH | ima: Avoid blocking in RCU read-side critical section |
| CVE-2024-39495 | 7.8 HIGH | greybus: Fix use-after-free bug in gb_interface_release due to race condition. |
| CVE-2024-40909 | 7.8 HIGH | bpf: Fix a potential use-after-free in bpf_link_free() |
| CVE-2024-40949 | 7.8 HIGH | mm: shmem: fix getting incorrect lruvec when replacing a shmem folio |
| CVE-2024-40991 | 7.8 HIGH | dmaengine: ti: k3-udma-glue: Fix of_k3_udma_glue_parse_chn_by_id() |
| CVE-2024-40990 | 7.8 HIGH | RDMA/mlx5: Add check for srq max_sge attribute |
| CVE-2024-40989 | 7.8 HIGH | KVM: arm64: Disassociate vcpus from redistributor region on teardown |
| CVE-2024-40925 | 7.8 HIGH | block: fix request.queuelist usage in flush |
| CVE-2024-40984 | 7.8 HIGH | ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." |
| CVE-2024-40924 | 7.8 HIGH | drm/i915/dpt: Make DPT object unshrinkable |
| CVE-2024-40970 | 7.8 HIGH | Avoid hw_desc array overrun in dw-axi-dmac |
Showing top 20 of 122 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-98868
dm-pcache: reject a kset that overruns its segment -
CVE-2026-98867
dm-pcache: bound the logical key offset from persistent memo -
CVE-2026-98866
sched/cache: Introduce task_struct->sched_cache_grp to fix U -
CVE-2026-98865
sched_ext: Don't run ops.dequeue() with a DSQ lock held -
CVE-2026-98864
sched_ext: Wait for SCX_OPSS_DISPATCHING before reenqueueing
Same vendor: Linux
-
CVE-2026-98868
dm-pcache: reject a kset that overruns its segment -
CVE-2026-98867
dm-pcache: bound the logical key offset from persistent memo -
CVE-2026-98866
sched/cache: Introduce task_struct->sched_cache_grp to fix U -
CVE-2026-98865
sched_ext: Don't run ops.dequeue() with a DSQ lock held -
CVE-2026-98864
sched_ext: Wait for SCX_OPSS_DISPATCHING before reenqueueing
V. Comments for CVE-2024-40957
No comments yet