CVE-2024-47685— netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put()
Affected Version Matrix 20
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | c8d7b98bec43faaa6583c3135030be5eb4693acb< 872eca64c3267dbc5836b715716fc6c03a18eda7 | affected |
c8d7b98bec43faaa6583c3135030be5eb4693acb< 7bcbc4cda777d26c88500d973fad0d497fc8a82e | affected | ||
c8d7b98bec43faaa6583c3135030be5eb4693acb< dcf48ab3ca2c55b09c8f9c8de0df01c1943bc4e5 | affected | ||
c8d7b98bec43faaa6583c3135030be5eb4693acb< fbff87d682e57ddbbe82abf6d0a1a4a36a98afcd | affected | ||
c8d7b98bec43faaa6583c3135030be5eb4693acb< 7ea2bcfd9bf4c3dbbf22546162226fd1c14d8ad2 | affected | ||
c8d7b98bec43faaa6583c3135030be5eb4693acb< af4b8a704f26f38310655bad67fd8096293275a2 | affected | ||
c8d7b98bec43faaa6583c3135030be5eb4693acb< 7a7b5a27c53b55e91eecf646d1b204e73fa4af93 | affected | ||
c8d7b98bec43faaa6583c3135030be5eb4693acb< 10210658f827ad45061581cbfc05924b723e8922 | affected | ||
| … +12 more rows | |||
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2024-47685
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() syzbot reported that nf_reject_ip6_tcphdr_put() was possibly sending garbage on the four reserved tcp bits (th->res1) Use skb_put_zero() to clear the whole TCP header, as done in nf_reject_ip_tcphdr_put() BUG: KMSAN: uninit-value in nf_reject_ip6_tcphdr_put+0x688/0x6c0 net/ipv6/netfilter/nf_reject_ipv6.c:255 nf_reject_ip6_tcphdr_put+0x688/0x6c0 net/ipv6/netfilter/nf_reject_ipv6.c:255 nf_send_reset6+0xd84/0x15b0 net/ipv6/netfilter/nf_reject_ipv6.c:344 nft_reject_inet_eval+0x3c1/0x880 net/netfilter/nft_reject_inet.c:48 expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline] nft_do_chain+0x438/0x22a0 net/netfilter/nf_tables_core.c:288 nft_do_chain_inet+0x41a/0x4f0 net/netfilter/nft_chain_filter.c:161 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xf4/0x400 net/netfilter/core.c:626 nf_hook include/linux/netfilter.h:269 [inline] NF_HOOK include/linux/netfilter.h:312 [inline] ipv6_rcv+0x29b/0x390 net/ipv6/ip6_input.c:310 __netif_receive_skb_one_core net/core/dev.c:5661 [inline] __netif_receive_skb+0x1da/0xa00 net/core/dev.c:5775 process_backlog+0x4ad/0xa50 net/core/dev.c:6108 __napi_poll+0xe7/0x980 net/core/dev.c:6772 napi_poll net/core/dev.c:6841 [inline] net_rx_action+0xa5a/0x19b0 net/core/dev.c:6963 handle_softirqs+0x1ce/0x800 kernel/softirq.c:554 __do_softirq+0x14/0x1a kernel/softirq.c:588 do_softirq+0x9a/0x100 kernel/softirq.c:455 __local_bh_enable_ip+0x9f/0xb0 kernel/softirq.c:382 local_bh_enable include/linux/bottom_half.h:33 [inline] rcu_read_unlock_bh include/linux/rcupdate.h:908 [inline] __dev_queue_xmit+0x2692/0x5610 net/core/dev.c:4450 dev_queue_xmit include/linux/netdevice.h:3105 [inline] neigh_resolve_output+0x9ca/0xae0 net/core/neighbour.c:1565 neigh_output include/net/neighbour.h:542 [inline] ip6_finish_output2+0x2347/0x2ba0 net/ipv6/ip6_output.c:141 __ip6_finish_output net/ipv6/ip6_output.c:215 [inline] ip6_finish_output+0xbb8/0x14b0 net/ipv6/ip6_output.c:226 NF_HOOK_COND include/linux/netfilter.h:303 [inline] ip6_output+0x356/0x620 net/ipv6/ip6_output.c:247 dst_output include/net/dst.h:450 [inline] NF_HOOK include/linux/netfilter.h:314 [inline] ip6_xmit+0x1ba6/0x25d0 net/ipv6/ip6_output.c:366 inet6_csk_xmit+0x442/0x530 net/ipv6/inet6_connection_sock.c:135 __tcp_transmit_skb+0x3b07/0x4880 net/ipv4/tcp_output.c:1466 tcp_transmit_skb net/ipv4/tcp_output.c:1484 [inline] tcp_connect+0x35b6/0x7130 net/ipv4/tcp_output.c:4143 tcp_v6_connect+0x1bcc/0x1e40 net/ipv6/tcp_ipv6.c:333 __inet_stream_connect+0x2ef/0x1730 net/ipv4/af_inet.c:679 inet_stream_connect+0x6a/0xd0 net/ipv4/af_inet.c:750 __sys_connect_file net/socket.c:2061 [inline] __sys_connect+0x606/0x690 net/socket.c:2078 __do_sys_connect net/socket.c:2088 [inline] __se_sys_connect net/socket.c:2085 [inline] __x64_sys_connect+0x91/0xe0 net/socket.c:2085 x64_sys_call+0x27a5/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:43 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was stored to memory at: nf_reject_ip6_tcphdr_put+0x60c/0x6c0 net/ipv6/netfilter/nf_reject_ipv6.c:249 nf_send_reset6+0xd84/0x15b0 net/ipv6/netfilter/nf_reject_ipv6.c:344 nft_reject_inet_eval+0x3c1/0x880 net/netfilter/nft_reject_inet.c:48 expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline] nft_do_chain+0x438/0x22a0 net/netfilter/nf_tables_core.c:288 nft_do_chain_inet+0x41a/0x4f0 net/netfilter/nft_chain_filter.c:161 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xf4/0x400 net/netfilter/core.c:626 nf_hook include/linux/netfilter.h:269 [inline] NF_HOOK include/linux/netfilter.h:312 [inline] ipv6_rcv+0x29b/0x390 net/ipv6/ip6_input.c:310 __netif_receive_skb_one_core ---truncated---
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于netfilter nf_reject_ipv6模块nf_reject_ip6_tcphdr_put函数中的初始化值问题。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2024-47685
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-47685
请登录查看更多情报信息。
Patches & Fixes for CVE-2024-47685 (7)
Same Patch Batch · Linux · 2024-10-21 · 372 CVEs total
| CVE-2024-50043 | 9.8 CRITICAL | nfsd: fix possible badness in FREE_STATEID |
| CVE-2022-48985 | 9.8 CRITICAL | net: mana: Fix race on per-CQ variable napi work_done |
| CVE-2024-47695 | 9.8 CRITICAL | RDMA/rtrs-clt: Reset cid to con_num - 1 to stay in bounds |
| CVE-2024-50033 | 9.8 CRITICAL | slip: make slhc_remember() more robust against malicious packets |
| CVE-2024-49855 | 9.8 CRITICAL | nbd: fix race between timeout and normal completion |
| CVE-2024-50047 | 9.8 CRITICAL | smb: client: fix UAF in async decryption |
| CVE-2022-49003 | 9.8 CRITICAL | nvme: fix SRCU protection of nvme_ns_head list |
| CVE-2024-50046 | 9.8 CRITICAL | NFSv4: Prevent NULL-pointer dereference in nfs42_complete_copies() |
| CVE-2024-49996 | 9.4 CRITICAL | cifs: Fix buffer overflow when parsing NFS reparse points |
| CVE-2024-47678 | 9.4 CRITICAL | icmp: change the order of rate limits |
| CVE-2022-49017 | 8.8 HIGH | tipc: re-fetch skb cb after tipc_msg_validate |
| CVE-2024-50029 | 8.8 HIGH | Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync |
| CVE-2024-50041 | 8.8 HIGH | i40e: Fix macvlan leak by synchronizing access to mac_filter_hash |
| CVE-2024-49939 | 8.8 HIGH | wifi: rtw89: avoid to add interface to list twice when SER |
| CVE-2022-48960 | 8.8 HIGH | net: hisilicon: Fix potential use-after-free in hix5hd2_rx() |
| CVE-2022-48962 | 8.8 HIGH | net: hisilicon: Fix potential use-after-free in hisi_femac_rx() |
| CVE-2022-48964 | 8.8 HIGH | ravb: Fix potential use-after-free in ravb_rx_gbeth() |
| CVE-2022-49015 | 8.8 HIGH | net: hsr: Fix potential use-after-free |
| CVE-2022-48967 | 8.8 HIGH | NFC: nci: Bounds check struct nfc_target arrays |
| CVE-2024-49930 | 8.8 HIGH | wifi: ath11k: fix array out-of-bound access in SoC stats |
Showing top 20 of 372 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
- CVE-2026-74579
netfilter: nft_payload: fix mask build for partial field off - CVE-2026-74578
crypto: algif_skcipher - force synchronous processing on tre - CVE-2026-74577
net: mpls: initialize rtm_tos in mpls_getroute() - CVE-2026-74576
mm/slab: prevent unbounded recursion in free path with new k - CVE-2026-74574
dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev
Same vendor: Linux
- CVE-2026-74579
netfilter: nft_payload: fix mask build for partial field off - CVE-2026-74578
crypto: algif_skcipher - force synchronous processing on tre - CVE-2026-74577
net: mpls: initialize rtm_tos in mpls_getroute() - CVE-2026-74576
mm/slab: prevent unbounded recursion in free path with new k - CVE-2026-74574
dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev
V. Comments for CVE-2024-47685
No comments yet