VYPR
← All advisories
Medium severity5.5NVD Advisory· Published Oct 21, 2024· Updated May 12, 2026

CVE-2024-49952

CVE-2024-49952

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: prevent nf_skb_duplicated corruption

syzbot found that nf_dup_ipv4() or nf_dup_ipv6() could write per-cpu variable nf_skb_duplicated in an unsafe way [1].

Disabling preemption as hinted by the splat is not enough, we have to disable soft interrupts as well.

[1] BUG: using __this_cpu_write() in preemptible [00000000] code: syz.4.282/6316 caller is nf_dup_ipv4+0x651/0x8f0 net/ipv4/netfilter/nf_dup_ipv4.c:87 CPU: 0 UID: 0 PID: 6316 Comm: syz.4.282 Not tainted 6.11.0-rc7-syzkaller-00104-g7052622fccb1 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 Call Trace:

__dump_stack lib/dump_stack.c:93 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119 check_preemption_disabled+0x10e/0x120 lib/smp_processor_id.c:49 nf_dup_ipv4+0x651/0x8f0 net/ipv4/netfilter/nf_dup_ipv4.c:87 nft_dup_ipv4_eval+0x1db/0x300 net/ipv4/netfilter/nft_dup_ipv4.c:30 expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline] nft_do_chain+0x4ad/0x1da0 net/netfilter/nf_tables_core.c:288 nft_do_chain_ipv4+0x202/0x320 net/netfilter/nft_chain_filter.c:23 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xc3/0x220 net/netfilter/core.c:626 nf_hook+0x2c4/0x450 include/linux/netfilter.h:269 NF_HOOK_COND include/linux/netfilter.h:302 [inline] ip_output+0x185/0x230 net/ipv4/ip_output.c:433 ip_local_out net/ipv4/ip_output.c:129 [inline] ip_send_skb+0x74/0x100 net/ipv4/ip_output.c:1495 udp_send_skb+0xacf/0x1650 net/ipv4/udp.c:981 udp_sendmsg+0x1c21/0x2a60 net/ipv4/udp.c:1269 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x1a6/0x270 net/socket.c:745 ____sys_sendmsg+0x525/0x7d0 net/socket.c:2597 ___sys_sendmsg net/socket.c:2651 [inline] __sys_sendmmsg+0x3b2/0x740 net/socket.c:2737 __do_sys_sendmmsg net/socket.c:2766 [inline] __se_sys_sendmmsg net/socket.c:2763 [inline] __x64_sys_sendmmsg+0xa0/0xb0 net/socket.c:2763 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f4ce4f7def9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f4ce5d4a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 RAX: ffffffffffffffda RBX: 00007f4ce5135f80 RCX: 00007f4ce4f7def9 RDX: 0000000000000001 RSI: 0000000020005d40 RDI: 0000000000000006 RBP: 00007f4ce4ff0b76 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f4ce5135f80 R15: 00007ffd4cbc6d68

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

The Linux kernel's netfilter subsystem had an unsafe per-CPU variable write in nf_dup_ipv4/6, requiring softirq-disabled context to prevent corruption.

Vulnerability

Description

The vulnerability resides in the Linux kernel's netfilter subsystem, specifically in the nf_dup_ipv4() and nf_dup_ipv6() functions. These functions write to a per-CPU variable nf_skb_duplicated using __this_cpu_write(), which is unsafe in a preemptible context. The kernel's concurrency checks flagged this as a bug, as preemption must be disabled when using per-CPU operations; however, the report further indicated that disabling only preemption is insufficient, and soft interrupts must also be disabled to prevent race conditions[1][4].

Attack

Vector

The issue can be triggered by sending crafted network packets that traverse a netfilter rule using the nft_dup expression. An attacker with network access to the system can trigger the vulnerable code path by causing the kernel to evaluate a duplicate rule in the context of a user-space socket operation. This occurs, for example, during the udp_sendmsg path, which eventually invokes nf_dup_ipv4 or nf_dup_ipv6 within an nftables rule evaluation[1][4]. No special privileges beyond the ability to send network traffic that matches the rule are required, though the specific conditions depend on the presence of such a rule.

Impact

An attacker exploiting this vulnerability could cause corruption of the per-CPU variable nf_skb_duplicated, leading to a denial of service (system crash or kernel panic) or potentially unpredictable behavior in packet handling. The CVSS score of 5.5 (Medium) reflects the need for some preconditions (a netfilter rule that uses duplicate) and the local nature of the exploitation, but it can be triggered remotely by sending packets to a system with such a rule[1][4].

Mitigation

The vulnerability is fixed in the Linux kernel by the commit that ensures soft interrupts are disabled before writing to the per-CPU variable. Users should apply the kernel update containing this fix. This CVE is also listed in Siemens product security advisories SSA-265688[1], SSA-398330[2], and SSA-355557[3] as affecting the SIMATIC S7-1500 TM MFP - GNU/Linux subsystem, among other products, and customers are directed to the vendor for remediation.

## References - [1] Siemens SSA-265688 – lists CVE-2024-49952 as affecting SIMATIC S7-1500 TM MFP GNU/Linux subsystem - [2] Siemens SSA-398330 – additional context on affected products - [3] Siemens SSA-355557 – product-specific impact documentation - [4] Linux kernel commit fixing the issue

References
  1. SSA-265688
  2. SSA-398330
  3. SSA-355557
  4. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

114

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

14

News mentions

0

No linked articles in our index yet.