CVE-2024-35890 (GCVE-0-2024-35890)

Vulnerability from cvelistv5 – Published: 2024-05-19 08:34 – Updated: 2026-08-05 11:30
VLAI
Title
gro: fix ownership transfer
Summary
In the Linux kernel, the following vulnerability has been resolved: gro: fix ownership transfer If packets are GROed with fraglist they might be segmented later on and continue their journey in the stack. In skb_segment_list those skbs can be reused as-is. This is an issue as their destructor was removed in skb_gro_receive_list but not the reference to their socket, and then they can't be orphaned. Fix this by also removing the reference to the socket. For example this could be observed, kernel BUG at include/linux/skbuff.h:3131! (skb_orphan) RIP: 0010:ip6_rcv_core+0x11bc/0x19a0 Call Trace: ipv6_list_rcv+0x250/0x3f0 __netif_receive_skb_list_core+0x49d/0x8f0 netif_receive_skb_list_internal+0x634/0xd40 napi_complete_done+0x1d2/0x7d0 gro_cell_poll+0x118/0x1f0 A similar construction is found in skb_gro_receive, apply the same change there.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 5e10da5385d20c4bae587bc2921e5fdd9655d5fc , < d225b0ac96dc40d7e8ae2bc227eb2c56e130975f (git)
Affected: 5e10da5385d20c4bae587bc2921e5fdd9655d5fc , < 2eeab8c47c3c0276e0746bc382f405c9a236a5ad (git)
Affected: 5e10da5385d20c4bae587bc2921e5fdd9655d5fc , < fc126c1d51e9552eacd2d717b9ffe9262a8a4cd6 (git)
Affected: 5e10da5385d20c4bae587bc2921e5fdd9655d5fc , < 5b3b67f731296027cceb3efad881ae281213f86f (git)
Affected: 5e10da5385d20c4bae587bc2921e5fdd9655d5fc , < ed4cccef64c1d0d5b91e69f7a8a6697c3a865486 (git)
Create a notification for this product.
Linux Linux Affected: 5.15
Unaffected: 0 , < 5.15 (semver)
Unaffected: 5.15.154 , ≤ 5.15.* (semver)
Unaffected: 6.1.85 , ≤ 6.1.* (semver)
Unaffected: 6.6.26 , ≤ 6.6.* (semver)
Unaffected: 6.8.5 , ≤ 6.8.* (semver)
Unaffected: 6.9 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-35890",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-23T17:20:18.616682Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:33:50.532Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-05-09T20:03:34.797Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d225b0ac96dc40d7e8ae2bc227eb2c56e130975f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/2eeab8c47c3c0276e0746bc382f405c9a236a5ad"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/fc126c1d51e9552eacd2d717b9ffe9262a8a4cd6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/5b3b67f731296027cceb3efad881ae281213f86f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ed4cccef64c1d0d5b91e69f7a8a6697c3a865486"
          },
          {
            "url": "https://security.netapp.com/advisory/ntap-20250509-0008/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/gro.c",
            "net/ipv4/udp_offload.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d225b0ac96dc40d7e8ae2bc227eb2c56e130975f",
              "status": "affected",
              "version": "5e10da5385d20c4bae587bc2921e5fdd9655d5fc",
              "versionType": "git"
            },
            {
              "lessThan": "2eeab8c47c3c0276e0746bc382f405c9a236a5ad",
              "status": "affected",
              "version": "5e10da5385d20c4bae587bc2921e5fdd9655d5fc",
              "versionType": "git"
            },
            {
              "lessThan": "fc126c1d51e9552eacd2d717b9ffe9262a8a4cd6",
              "status": "affected",
              "version": "5e10da5385d20c4bae587bc2921e5fdd9655d5fc",
              "versionType": "git"
            },
            {
              "lessThan": "5b3b67f731296027cceb3efad881ae281213f86f",
              "status": "affected",
              "version": "5e10da5385d20c4bae587bc2921e5fdd9655d5fc",
              "versionType": "git"
            },
            {
              "lessThan": "ed4cccef64c1d0d5b91e69f7a8a6697c3a865486",
              "status": "affected",
              "version": "5e10da5385d20c4bae587bc2921e5fdd9655d5fc",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/gro.c",
            "net/ipv4/udp_offload.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.154",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.85",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.26",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.154",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.85",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.26",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.5",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngro: fix ownership transfer\n\nIf packets are GROed with fraglist they might be segmented later on and\ncontinue their journey in the stack. In skb_segment_list those skbs can\nbe reused as-is. This is an issue as their destructor was removed in\nskb_gro_receive_list but not the reference to their socket, and then\nthey can\u0027t be orphaned. Fix this by also removing the reference to the\nsocket.\n\nFor example this could be observed,\n\n  kernel BUG at include/linux/skbuff.h:3131!  (skb_orphan)\n  RIP: 0010:ip6_rcv_core+0x11bc/0x19a0\n  Call Trace:\n   ipv6_list_rcv+0x250/0x3f0\n   __netif_receive_skb_list_core+0x49d/0x8f0\n   netif_receive_skb_list_internal+0x634/0xd40\n   napi_complete_done+0x1d2/0x7d0\n   gro_cell_poll+0x118/0x1f0\n\nA similar construction is found in skb_gro_receive, apply the same\nchange there."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The skbs that carry a socket reference into GRO are locally generated (`destructor == sock_wfree`), since remotely received packets are already orphaned in `ip_rcv_core()`/`ip6_rcv_core()`; the attacker must therefore send UDP traffic from a local socket over a veth pair. No remote peer can supply the sk-owning skbs directly.\nAC:L - The attacker controls every precondition \u2014 creating the veth pair, enabling GRO/rx-gro-list in their own netns, and sending a UDP burst that GRO deterministically aggregates and the stack then re-segments. No race or unknowable memory state is required for the crash, and the socket free timing for the UAF is also attacker-controlled (send, then close).\nPR:L - An unprivileged user can obtain CAP_NET_ADMIN in a private netns via `unshare -Urn`, which is sufficient to create the veth pair and to run `ethtool -K` (gated only by `ns_capable(net-\u003euser_ns, CAP_NET_ADMIN)`); the triggering traffic is then an ordinary UDP send. The resulting panic/UAF affects the whole host, not just the namespace.\nUI:N - The entire sequence is driven by the attacker\u0027s own process \u2014 interface configuration and packet transmission \u2014 with no action from any other user or administrator.\nS:U - The corruption and the crash occur within the kernel\u0027s own security authority; no hypervisor, IOMMU, or other authority boundary is crossed even though the trigger originates inside a container/netns.\nC:H - The detached segments retain an unreferenced `struct sock *`, so after `sock_wfree()` releases the last `sk_wmem_alloc` charge the pointer dangles; subsequent reads of `skb-\u003esk` (e.g. `sk_fullsock()`, `sk_validate_xmit_skb()`) read freed, sprayable slab memory, giving a use-after-free disclosure primitive.\nI:H - The same dangling `sk` is used for an indirect call (`sk-\u003esk_validate_xmit_skb(sk, dev, skb)`) and for accounting updates on a reallocated object, so a heap-sprayed sock allocation yields control-flow hijack / write-into-freed-object primitives typical of a use-after-free.\nA:H - The documented and easily reproduced result is `BUG_ON(skb-\u003esk)` in `skb_orphan()` reached from `ip6_rcv_core()` under NAPI/softirq context, which oopses in interrupt context and panics the machine; it can be re-triggered at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:30:44.493Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d225b0ac96dc40d7e8ae2bc227eb2c56e130975f"
        },
        {
          "url": "https://git.kernel.org/stable/c/2eeab8c47c3c0276e0746bc382f405c9a236a5ad"
        },
        {
          "url": "https://git.kernel.org/stable/c/fc126c1d51e9552eacd2d717b9ffe9262a8a4cd6"
        },
        {
          "url": "https://git.kernel.org/stable/c/5b3b67f731296027cceb3efad881ae281213f86f"
        },
        {
          "url": "https://git.kernel.org/stable/c/ed4cccef64c1d0d5b91e69f7a8a6697c3a865486"
        }
      ],
      "title": "gro: fix ownership transfer",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-35890",
    "datePublished": "2024-05-19T08:34:46.085Z",
    "dateReserved": "2024-05-17T13:50:33.113Z",
    "dateUpdated": "2026-08-05T11:30:44.493Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-35890",
      "date": "2026-08-11",
      "epss": "0.00241",
      "percentile": "0.15386"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ngro: fix ownership transfer\\n\\nIf packets are GROed with fraglist they might be segmented later on and\\ncontinue their journey in the stack. In skb_segment_list those skbs can\\nbe reused as-is. This is an issue as their destructor was removed in\\nskb_gro_receive_list but not the reference to their socket, and then\\nthey can\u0027t be orphaned. Fix this by also removing the reference to the\\nsocket.\\n\\nFor example this could be observed,\\n\\n  kernel BUG at include/linux/skbuff.h:3131!  (skb_orphan)\\n  RIP: 0010:ip6_rcv_core+0x11bc/0x19a0\\n  Call Trace:\\n   ipv6_list_rcv+0x250/0x3f0\\n   __netif_receive_skb_list_core+0x49d/0x8f0\\n   netif_receive_skb_list_internal+0x634/0xd40\\n   napi_complete_done+0x1d2/0x7d0\\n   gro_cell_poll+0x118/0x1f0\\n\\nA similar construction is found in skb_gro_receive, apply the same\\nchange there.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: gro: corrige la transferencia de propiedad. Si los paquetes se agrupan con fraglist, es posible que se segmenten m\\u00e1s adelante y contin\\u00faen su viaje en la pila. En skb_segment_list esos skbs se pueden reutilizar tal cual. Esto es un problema ya que su destructor se elimin\\u00f3 en skb_gro_receive_list pero no la referencia a su socket, y luego no pueden quedar hu\\u00e9rfanos. Solucione este problema eliminando tambi\\u00e9n la referencia al socket. Por ejemplo, esto se podr\\u00eda observar, \\u00a1BUG del kernel en include/linux/skbuff.h:3131! (skb_orphan) RIP: 0010:ip6_rcv_core+0x11bc/0x19a0 Seguimiento de llamadas: ipv6_list_rcv+0x250/0x3f0 __netif_receive_skb_list_core+0x49d/0x8f0 netif_receive_skb_list_internal+0x634/0xd40 napi_complete_done+0x1 d2/0x7d0 gro_cell_poll+0x118/0x1f0 Se encuentra una construcci\\u00f3n similar en skb_gro_receive, aplique el mismo cambio all\\u00ed. \"}]",
      "id": "CVE-2024-35890",
      "lastModified": "2024-11-21T09:21:08.290",
      "published": "2024-05-19T09:15:10.077",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/2eeab8c47c3c0276e0746bc382f405c9a236a5ad\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/5b3b67f731296027cceb3efad881ae281213f86f\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/d225b0ac96dc40d7e8ae2bc227eb2c56e130975f\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/ed4cccef64c1d0d5b91e69f7a8a6697c3a865486\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/fc126c1d51e9552eacd2d717b9ffe9262a8a4cd6\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/2eeab8c47c3c0276e0746bc382f405c9a236a5ad\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/5b3b67f731296027cceb3efad881ae281213f86f\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/d225b0ac96dc40d7e8ae2bc227eb2c56e130975f\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/ed4cccef64c1d0d5b91e69f7a8a6697c3a865486\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/fc126c1d51e9552eacd2d717b9ffe9262a8a4cd6\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-35890\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-19T09:15:10.077\",\"lastModified\":\"2026-08-04T11:18:06.953\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ngro: fix ownership transfer\\n\\nIf packets are GROed with fraglist they might be segmented later on and\\ncontinue their journey in the stack. In skb_segment_list those skbs can\\nbe reused as-is. This is an issue as their destructor was removed in\\nskb_gro_receive_list but not the reference to their socket, and then\\nthey can\u0027t be orphaned. Fix this by also removing the reference to the\\nsocket.\\n\\nFor example this could be observed,\\n\\n  kernel BUG at include/linux/skbuff.h:3131!  (skb_orphan)\\n  RIP: 0010:ip6_rcv_core+0x11bc/0x19a0\\n  Call Trace:\\n   ipv6_list_rcv+0x250/0x3f0\\n   __netif_receive_skb_list_core+0x49d/0x8f0\\n   netif_receive_skb_list_internal+0x634/0xd40\\n   napi_complete_done+0x1d2/0x7d0\\n   gro_cell_poll+0x118/0x1f0\\n\\nA similar construction is found in skb_gro_receive, apply the same\\nchange there.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: gro: corrige la transferencia de propiedad. Si los paquetes se agrupan con fraglist, es posible que se segmenten m\u00e1s adelante y contin\u00faen su viaje en la pila. En skb_segment_list esos skbs se pueden reutilizar tal cual. Esto es un problema ya que su destructor se elimin\u00f3 en skb_gro_receive_list pero no la referencia a su socket, y luego no pueden quedar hu\u00e9rfanos. Solucione este problema eliminando tambi\u00e9n la referencia al socket. Por ejemplo, esto se podr\u00eda observar, \u00a1BUG del kernel en include/linux/skbuff.h:3131! (skb_orphan) RIP: 0010:ip6_rcv_core+0x11bc/0x19a0 Seguimiento de llamadas: ipv6_list_rcv+0x250/0x3f0 __netif_receive_skb_list_core+0x49d/0x8f0 netif_receive_skb_list_internal+0x634/0xd40 napi_complete_done+0x1 d2/0x7d0 gro_cell_poll+0x118/0x1f0 Se encuentra una construcci\u00f3n similar en skb_gro_receive, aplique el mismo cambio all\u00ed. \"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/core/gro.c\",\"net/ipv4/udp_offload.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5e10da5385d20c4bae587bc2921e5fdd9655d5fc\",\"lessThan\":\"d225b0ac96dc40d7e8ae2bc227eb2c56e130975f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5e10da5385d20c4bae587bc2921e5fdd9655d5fc\",\"lessThan\":\"2eeab8c47c3c0276e0746bc382f405c9a236a5ad\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5e10da5385d20c4bae587bc2921e5fdd9655d5fc\",\"lessThan\":\"fc126c1d51e9552eacd2d717b9ffe9262a8a4cd6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5e10da5385d20c4bae587bc2921e5fdd9655d5fc\",\"lessThan\":\"5b3b67f731296027cceb3efad881ae281213f86f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5e10da5385d20c4bae587bc2921e5fdd9655d5fc\",\"lessThan\":\"ed4cccef64c1d0d5b91e69f7a8a6697c3a865486\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/core/gro.c\",\"net/ipv4/udp_offload.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.154\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.85\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.26\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8.5\",\"lessThanOrEqual\":\"6.8.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-05-23T17:20:18.616682Z\",\"id\":\"CVE-2024-35890\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.15\",\"versionEndExcluding\":\"5.15.154\",\"matchCriteriaId\":\"8ABF1808-B7F7-4D05-A34E-CCC58D4944E8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.85\",\"matchCriteriaId\":\"325665BF-2409-49D9-B391-39AD4566FDBD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.26\",\"matchCriteriaId\":\"C520696A-A594-4FFC-A32D-12DA535CE911\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.8.5\",\"matchCriteriaId\":\"DBD6C99E-4250-4DFE-8447-FF2075939D10\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"22BEDD49-2C6D-402D-9DBF-6646F6ECD10B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"DF73CB2A-DFFD-46FB-9BFE-AA394F27EA37\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2eeab8c47c3c0276e0746bc382f405c9a236a5ad\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5b3b67f731296027cceb3efad881ae281213f86f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d225b0ac96dc40d7e8ae2bc227eb2c56e130975f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ed4cccef64c1d0d5b91e69f7a8a6697c3a865486\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fc126c1d51e9552eacd2d717b9ffe9262a8a4cd6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2eeab8c47c3c0276e0746bc382f405c9a236a5ad\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5b3b67f731296027cceb3efad881ae281213f86f\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d225b0ac96dc40d7e8ae2bc227eb2c56e130975f\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ed4cccef64c1d0d5b91e69f7a8a6697c3a865486\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fc126c1d51e9552eacd2d717b9ffe9262a8a4cd6\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20250509-0008/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:03:02+00:00",
      "cve": "CVE-2024-35890",
      "id": "CVE-2024-35890",
      "initial_release_date": "2024-05-19T00:00:00+00:00",
      "product_status:fixed": "1030",
      "product_status:known_affected": "64",
      "product_status:known_not_affected": "8",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: gro: fix ownership transfer",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-35890.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-05T00:58:41Z",
      "cve": "CVE-2024-35890",
      "id": "CVE-2024-35890",
      "initial_release_date": "2024-05-21T01:59:28Z",
      "product_status:known_affected": "330",
      "product_status:known_not_affected": "242",
      "product_status:recommended": "705",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-35890",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-35890.json",
      "version": "83"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/d225b0ac96dc40d7e8ae2bc227eb2c56e130975f\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/2eeab8c47c3c0276e0746bc382f405c9a236a5ad\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/fc126c1d51e9552eacd2d717b9ffe9262a8a4cd6\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/5b3b67f731296027cceb3efad881ae281213f86f\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/ed4cccef64c1d0d5b91e69f7a8a6697c3a865486\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://security.netapp.com/advisory/ntap-20250509-0008/\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-05-09T20:03:34.797Z\"}}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-35890\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-23T17:20:18.616682Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T19:01:25.743Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"gro: fix ownership transfer\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The skbs that carry a socket reference into GRO are locally generated (`destructor == sock_wfree`), since remotely received packets are already orphaned in `ip_rcv_core()`/`ip6_rcv_core()`; the attacker must therefore send UDP traffic from a local socket over a veth pair. No remote peer can supply the sk-owning skbs directly.\\nAC:L - The attacker controls every precondition \\u2014 creating the veth pair, enabling GRO/rx-gro-list in their own netns, and sending a UDP burst that GRO deterministically aggregates and the stack then re-segments. No race or unknowable memory state is required for the crash, and the socket free timing for the UAF is also attacker-controlled (send, then close).\\nPR:L - An unprivileged user can obtain CAP_NET_ADMIN in a private netns via `unshare -Urn`, which is sufficient to create the veth pair and to run `ethtool -K` (gated only by `ns_capable(net-\u003euser_ns, CAP_NET_ADMIN)`); the triggering traffic is then an ordinary UDP send. The resulting panic/UAF affects the whole host, not just the namespace.\\nUI:N - The entire sequence is driven by the attacker\u0027s own process \\u2014 interface configuration and packet transmission \\u2014 with no action from any other user or administrator.\\nS:U - The corruption and the crash occur within the kernel\u0027s own security authority; no hypervisor, IOMMU, or other authority boundary is crossed even though the trigger originates inside a container/netns.\\nC:H - The detached segments retain an unreferenced `struct sock *`, so after `sock_wfree()` releases the last `sk_wmem_alloc` charge the pointer dangles; subsequent reads of `skb-\u003esk` (e.g. `sk_fullsock()`, `sk_validate_xmit_skb()`) read freed, sprayable slab memory, giving a use-after-free disclosure primitive.\\nI:H - The same dangling `sk` is used for an indirect call (`sk-\u003esk_validate_xmit_skb(sk, dev, skb)`) and for accounting updates on a reallocated object, so a heap-sprayed sock allocation yields control-flow hijack / write-into-freed-object primitives typical of a use-after-free.\\nA:H - The documented and easily reproduced result is `BUG_ON(skb-\u003esk)` in `skb_orphan()` reached from `ip6_rcv_core()` under NAPI/softirq context, which oopses in interrupt context and panics the machine; it can be re-triggered at will.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5e10da5385d20c4bae587bc2921e5fdd9655d5fc\", \"lessThan\": \"d225b0ac96dc40d7e8ae2bc227eb2c56e130975f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5e10da5385d20c4bae587bc2921e5fdd9655d5fc\", \"lessThan\": \"2eeab8c47c3c0276e0746bc382f405c9a236a5ad\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5e10da5385d20c4bae587bc2921e5fdd9655d5fc\", \"lessThan\": \"fc126c1d51e9552eacd2d717b9ffe9262a8a4cd6\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5e10da5385d20c4bae587bc2921e5fdd9655d5fc\", \"lessThan\": \"5b3b67f731296027cceb3efad881ae281213f86f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5e10da5385d20c4bae587bc2921e5fdd9655d5fc\", \"lessThan\": \"ed4cccef64c1d0d5b91e69f7a8a6697c3a865486\", \"versionType\": \"git\"}], \"programFiles\": [\"net/core/gro.c\", \"net/ipv4/udp_offload.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.15\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.15\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.154\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.85\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.26\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.5\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/core/gro.c\", \"net/ipv4/udp_offload.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/d225b0ac96dc40d7e8ae2bc227eb2c56e130975f\"}, {\"url\": \"https://git.kernel.org/stable/c/2eeab8c47c3c0276e0746bc382f405c9a236a5ad\"}, {\"url\": \"https://git.kernel.org/stable/c/fc126c1d51e9552eacd2d717b9ffe9262a8a4cd6\"}, {\"url\": \"https://git.kernel.org/stable/c/5b3b67f731296027cceb3efad881ae281213f86f\"}, {\"url\": \"https://git.kernel.org/stable/c/ed4cccef64c1d0d5b91e69f7a8a6697c3a865486\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ngro: fix ownership transfer\\n\\nIf packets are GROed with fraglist they might be segmented later on and\\ncontinue their journey in the stack. In skb_segment_list those skbs can\\nbe reused as-is. This is an issue as their destructor was removed in\\nskb_gro_receive_list but not the reference to their socket, and then\\nthey can\u0027t be orphaned. Fix this by also removing the reference to the\\nsocket.\\n\\nFor example this could be observed,\\n\\n  kernel BUG at include/linux/skbuff.h:3131!  (skb_orphan)\\n  RIP: 0010:ip6_rcv_core+0x11bc/0x19a0\\n  Call Trace:\\n   ipv6_list_rcv+0x250/0x3f0\\n   __netif_receive_skb_list_core+0x49d/0x8f0\\n   netif_receive_skb_list_internal+0x634/0xd40\\n   napi_complete_done+0x1d2/0x7d0\\n   gro_cell_poll+0x118/0x1f0\\n\\nA similar construction is found in skb_gro_receive, apply the same\\nchange there.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.154\", \"versionStartIncluding\": \"5.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.85\", \"versionStartIncluding\": \"5.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.26\", \"versionStartIncluding\": \"5.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.5\", \"versionStartIncluding\": \"5.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9\", \"versionStartIncluding\": \"5.15\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:30:44.493Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-35890\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:30:44.493Z\", \"dateReserved\": \"2024-05-17T13:50:33.113Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-19T08:34:46.085Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.