CVE-2024-56703 (GCVE-0-2024-56703)

Vulnerability from cvelistv5 – Published: 2024-12-28 09:46 – Updated: 2026-08-04 09:39
VLAI
Title
ipv6: Fix soft lockups in fib6_select_path under high next hop churn
Summary
In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix soft lockups in fib6_select_path under high next hop churn Soft lockups have been observed on a cluster of Linux-based edge routers located in a highly dynamic environment. Using the `bird` service, these routers continuously update BGP-advertised routes due to frequently changing nexthop destinations, while also managing significant IPv6 traffic. The lockups occur during the traversal of the multipath circular linked-list in the `fib6_select_path` function, particularly while iterating through the siblings in the list. The issue typically arises when the nodes of the linked list are unexpectedly deleted concurrently on a different core—indicated by their 'next' and 'previous' elements pointing back to the node itself and their reference count dropping to zero. This results in an infinite loop, leading to a soft lockup that triggers a system panic via the watchdog timer. Apply RCU primitives in the problematic code sections to resolve the issue. Where necessary, update the references to fib6_siblings to annotate or use the RCU APIs. Include a test script that reproduces the issue. The script periodically updates the routing table while generating a heavy load of outgoing IPv6 traffic through multiple iperf3 clients. It consistently induces infinite soft lockups within a couple of minutes. Kernel log: 0 [ffffbd13003e8d30] machine_kexec at ffffffff8ceaf3eb 1 [ffffbd13003e8d90] __crash_kexec at ffffffff8d0120e3 2 [ffffbd13003e8e58] panic at ffffffff8cef65d4 3 [ffffbd13003e8ed8] watchdog_timer_fn at ffffffff8d05cb03 4 [ffffbd13003e8f08] __hrtimer_run_queues at ffffffff8cfec62f 5 [ffffbd13003e8f70] hrtimer_interrupt at ffffffff8cfed756 6 [ffffbd13003e8fd0] __sysvec_apic_timer_interrupt at ffffffff8cea01af 7 [ffffbd13003e8ff0] sysvec_apic_timer_interrupt at ffffffff8df1b83d -- <IRQ stack> -- 8 [ffffbd13003d3708] asm_sysvec_apic_timer_interrupt at ffffffff8e000ecb [exception RIP: fib6_select_path+299] RIP: ffffffff8ddafe7b RSP: ffffbd13003d37b8 RFLAGS: 00000287 RAX: ffff975850b43600 RBX: ffff975850b40200 RCX: 0000000000000000 RDX: 000000003fffffff RSI: 0000000051d383e4 RDI: ffff975850b43618 RBP: ffffbd13003d3800 R8: 0000000000000000 R9: ffff975850b40200 R10: 0000000000000000 R11: 0000000000000000 R12: ffffbd13003d3830 R13: ffff975850b436a8 R14: ffff975850b43600 R15: 0000000000000007 ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 9 [ffffbd13003d3808] ip6_pol_route at ffffffff8ddb030c 10 [ffffbd13003d3888] ip6_pol_route_input at ffffffff8ddb068c 11 [ffffbd13003d3898] fib6_rule_lookup at ffffffff8ddf02b5 12 [ffffbd13003d3928] ip6_route_input at ffffffff8ddb0f47 13 [ffffbd13003d3a18] ip6_rcv_finish_core.constprop.0 at ffffffff8dd950d0 14 [ffffbd13003d3a30] ip6_list_rcv_finish.constprop.0 at ffffffff8dd96274 15 [ffffbd13003d3a98] ip6_sublist_rcv at ffffffff8dd96474 16 [ffffbd13003d3af8] ipv6_list_rcv at ffffffff8dd96615 17 [ffffbd13003d3b60] __netif_receive_skb_list_core at ffffffff8dc16fec 18 [ffffbd13003d3be0] netif_receive_skb_list_internal at ffffffff8dc176b3 19 [ffffbd13003d3c50] napi_gro_receive at ffffffff8dc565b9 20 [ffffbd13003d3c80] ice_receive_skb at ffffffffc087e4f5 [ice] 21 [ffffbd13003d3c90] ice_clean_rx_irq at ffffffffc0881b80 [ice] 22 [ffffbd13003d3d20] ice_napi_poll at ffffffffc088232f [ice] 23 [ffffbd13003d3d80] __napi_poll at ffffffff8dc18000 24 [ffffbd13003d3db8] net_rx_action at ffffffff8dc18581 25 [ffffbd13003d3e40] __do_softirq at ffffffff8df352e9 26 [ffffbd13003d3eb0] run_ksoftirqd at ffffffff8ceffe47 27 [ffffbd13003d3ec0] smpboot_thread_fn at ffffffff8cf36a30 28 [ffffbd13003d3ee8] kthread at ffffffff8cf2b39f 29 [ffffbd13003d3f28] ret_from_fork at ffffffff8ce5fa64 30 [ffffbd13003d3f50] ret_from_fork_asm at ffffffff8ce03cbb
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
  • CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 66f5d6ce53e665477d2a33e8f539d4fa4ca81c83 , < d0ec61c9f3583b76aebdbb271f5c0d3fcccd48b2 (git)
Affected: 66f5d6ce53e665477d2a33e8f539d4fa4ca81c83 , < 52da02521ede55fb86546c3fffd9377b3261b91f (git)
Affected: 66f5d6ce53e665477d2a33e8f539d4fa4ca81c83 , < 11edcd026012ac18acee0f1514db3ed1b160fc6f (git)
Affected: 66f5d6ce53e665477d2a33e8f539d4fa4ca81c83 , < 34a949e7a0869dfa31a40416d2a56973fae1807b (git)
Affected: 66f5d6ce53e665477d2a33e8f539d4fa4ca81c83 , < d9ccb18f83ea2bb654289b6ecf014fd267cc988b (git)
Create a notification for this product.
Linux Linux Affected: 4.15
Unaffected: 0 , < 4.15 (semver)
Unaffected: 6.1.128 , ≤ 6.1.* (semver)
Unaffected: 6.6.75 , ≤ 6.6.* (semver)
Unaffected: 6.11.11 , ≤ 6.11.* (semver)
Unaffected: 6.12.2 , ≤ 6.12.* (semver)
Unaffected: 6.13 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP Affected: V3.1.6 , < * (custom)
Create a notification for this product.
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP Affected: V3.1.6 , < * (custom)
Create a notification for this product.
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP Affected: V3.1.6 , < * (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-56703",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T19:58:51.187430Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-835",
                "description": "CWE-835 Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T20:07:07.422Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:52:52.353Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T12:38:39.047Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/ip6_fib.c",
            "net/ipv6/route.c",
            "tools/testing/selftests/net/Makefile",
            "tools/testing/selftests/net/ipv6_route_update_soft_lockup.sh"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d0ec61c9f3583b76aebdbb271f5c0d3fcccd48b2",
              "status": "affected",
              "version": "66f5d6ce53e665477d2a33e8f539d4fa4ca81c83",
              "versionType": "git"
            },
            {
              "lessThan": "52da02521ede55fb86546c3fffd9377b3261b91f",
              "status": "affected",
              "version": "66f5d6ce53e665477d2a33e8f539d4fa4ca81c83",
              "versionType": "git"
            },
            {
              "lessThan": "11edcd026012ac18acee0f1514db3ed1b160fc6f",
              "status": "affected",
              "version": "66f5d6ce53e665477d2a33e8f539d4fa4ca81c83",
              "versionType": "git"
            },
            {
              "lessThan": "34a949e7a0869dfa31a40416d2a56973fae1807b",
              "status": "affected",
              "version": "66f5d6ce53e665477d2a33e8f539d4fa4ca81c83",
              "versionType": "git"
            },
            {
              "lessThan": "d9ccb18f83ea2bb654289b6ecf014fd267cc988b",
              "status": "affected",
              "version": "66f5d6ce53e665477d2a33e8f539d4fa4ca81c83",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/ip6_fib.c",
            "net/ipv6/route.c",
            "tools/testing/selftests/net/Makefile",
            "tools/testing/selftests/net/ipv6_route_update_soft_lockup.sh"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.15"
            },
            {
              "lessThan": "4.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.128",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.128",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.75",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.11",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.2",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: Fix soft lockups in fib6_select_path under high next hop churn\n\nSoft lockups have been observed on a cluster of Linux-based edge routers\nlocated in a highly dynamic environment. Using the `bird` service, these\nrouters continuously update BGP-advertised routes due to frequently\nchanging nexthop destinations, while also managing significant IPv6\ntraffic. The lockups occur during the traversal of the multipath\ncircular linked-list in the `fib6_select_path` function, particularly\nwhile iterating through the siblings in the list. The issue typically\narises when the nodes of the linked list are unexpectedly deleted\nconcurrently on a different core\u2014indicated by their \u0027next\u0027 and\n\u0027previous\u0027 elements pointing back to the node itself and their reference\ncount dropping to zero. This results in an infinite loop, leading to a\nsoft lockup that triggers a system panic via the watchdog timer.\n\nApply RCU primitives in the problematic code sections to resolve the\nissue. Where necessary, update the references to fib6_siblings to\nannotate or use the RCU APIs.\n\nInclude a test script that reproduces the issue. The script\nperiodically updates the routing table while generating a heavy load\nof outgoing IPv6 traffic through multiple iperf3 clients. It\nconsistently induces infinite soft lockups within a couple of minutes.\n\nKernel log:\n\n 0 [ffffbd13003e8d30] machine_kexec at ffffffff8ceaf3eb\n 1 [ffffbd13003e8d90] __crash_kexec at ffffffff8d0120e3\n 2 [ffffbd13003e8e58] panic at ffffffff8cef65d4\n 3 [ffffbd13003e8ed8] watchdog_timer_fn at ffffffff8d05cb03\n 4 [ffffbd13003e8f08] __hrtimer_run_queues at ffffffff8cfec62f\n 5 [ffffbd13003e8f70] hrtimer_interrupt at ffffffff8cfed756\n 6 [ffffbd13003e8fd0] __sysvec_apic_timer_interrupt at ffffffff8cea01af\n 7 [ffffbd13003e8ff0] sysvec_apic_timer_interrupt at ffffffff8df1b83d\n-- \u003cIRQ stack\u003e --\n 8 [ffffbd13003d3708] asm_sysvec_apic_timer_interrupt at ffffffff8e000ecb\n    [exception RIP: fib6_select_path+299]\n    RIP: ffffffff8ddafe7b  RSP: ffffbd13003d37b8  RFLAGS: 00000287\n    RAX: ffff975850b43600  RBX: ffff975850b40200  RCX: 0000000000000000\n    RDX: 000000003fffffff  RSI: 0000000051d383e4  RDI: ffff975850b43618\n    RBP: ffffbd13003d3800   R8: 0000000000000000   R9: ffff975850b40200\n    R10: 0000000000000000  R11: 0000000000000000  R12: ffffbd13003d3830\n    R13: ffff975850b436a8  R14: ffff975850b43600  R15: 0000000000000007\n    ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018\n 9 [ffffbd13003d3808] ip6_pol_route at ffffffff8ddb030c\n10 [ffffbd13003d3888] ip6_pol_route_input at ffffffff8ddb068c\n11 [ffffbd13003d3898] fib6_rule_lookup at ffffffff8ddf02b5\n12 [ffffbd13003d3928] ip6_route_input at ffffffff8ddb0f47\n13 [ffffbd13003d3a18] ip6_rcv_finish_core.constprop.0 at ffffffff8dd950d0\n14 [ffffbd13003d3a30] ip6_list_rcv_finish.constprop.0 at ffffffff8dd96274\n15 [ffffbd13003d3a98] ip6_sublist_rcv at ffffffff8dd96474\n16 [ffffbd13003d3af8] ipv6_list_rcv at ffffffff8dd96615\n17 [ffffbd13003d3b60] __netif_receive_skb_list_core at ffffffff8dc16fec\n18 [ffffbd13003d3be0] netif_receive_skb_list_internal at ffffffff8dc176b3\n19 [ffffbd13003d3c50] napi_gro_receive at ffffffff8dc565b9\n20 [ffffbd13003d3c80] ice_receive_skb at ffffffffc087e4f5 [ice]\n21 [ffffbd13003d3c90] ice_clean_rx_irq at ffffffffc0881b80 [ice]\n22 [ffffbd13003d3d20] ice_napi_poll at ffffffffc088232f [ice]\n23 [ffffbd13003d3d80] __napi_poll at ffffffff8dc18000\n24 [ffffbd13003d3db8] net_rx_action at ffffffff8dc18581\n25 [ffffbd13003d3e40] __do_softirq at ffffffff8df352e9\n26 [ffffbd13003d3eb0] run_ksoftirqd at ffffffff8ceffe47\n27 [ffffbd13003d3ec0] smpboot_thread_fn at ffffffff8cf36a30\n28 [ffffbd13003d3ee8] kthread at ffffffff8cf2b39f\n29 [ffffbd13003d3f28] ret_from_fork at ffffffff8ce5fa64\n30 [ffffbd13003d3f50] ret_from_fork_asm at ffffffff8ce03cbb"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-04T09:39:41.440Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d0ec61c9f3583b76aebdbb271f5c0d3fcccd48b2"
        },
        {
          "url": "https://git.kernel.org/stable/c/52da02521ede55fb86546c3fffd9377b3261b91f"
        },
        {
          "url": "https://git.kernel.org/stable/c/11edcd026012ac18acee0f1514db3ed1b160fc6f"
        },
        {
          "url": "https://git.kernel.org/stable/c/34a949e7a0869dfa31a40416d2a56973fae1807b"
        },
        {
          "url": "https://git.kernel.org/stable/c/d9ccb18f83ea2bb654289b6ecf014fd267cc988b"
        }
      ],
      "title": "ipv6: Fix soft lockups in fib6_select_path under high next hop churn",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-56703",
    "datePublished": "2024-12-28T09:46:24.978Z",
    "dateReserved": "2024-12-27T15:00:39.856Z",
    "dateUpdated": "2026-08-04T09:39:41.440Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-56703",
      "date": "2026-08-04",
      "epss": "0.00207",
      "percentile": "0.10971"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nipv6: Fix soft lockups in fib6_select_path under high next hop churn\\n\\nSoft lockups have been observed on a cluster of Linux-based edge routers\\nlocated in a highly dynamic environment. Using the `bird` service, these\\nrouters continuously update BGP-advertised routes due to frequently\\nchanging nexthop destinations, while also managing significant IPv6\\ntraffic. The lockups occur during the traversal of the multipath\\ncircular linked-list in the `fib6_select_path` function, particularly\\nwhile iterating through the siblings in the list. The issue typically\\narises when the nodes of the linked list are unexpectedly deleted\\nconcurrently on a different core\\u2014indicated by their \u0027next\u0027 and\\n\u0027previous\u0027 elements pointing back to the node itself and their reference\\ncount dropping to zero. This results in an infinite loop, leading to a\\nsoft lockup that triggers a system panic via the watchdog timer.\\n\\nApply RCU primitives in the problematic code sections to resolve the\\nissue. Where necessary, update the references to fib6_siblings to\\nannotate or use the RCU APIs.\\n\\nInclude a test script that reproduces the issue. The script\\nperiodically updates the routing table while generating a heavy load\\nof outgoing IPv6 traffic through multiple iperf3 clients. It\\nconsistently induces infinite soft lockups within a couple of minutes.\\n\\nKernel log:\\n\\n 0 [ffffbd13003e8d30] machine_kexec at ffffffff8ceaf3eb\\n 1 [ffffbd13003e8d90] __crash_kexec at ffffffff8d0120e3\\n 2 [ffffbd13003e8e58] panic at ffffffff8cef65d4\\n 3 [ffffbd13003e8ed8] watchdog_timer_fn at ffffffff8d05cb03\\n 4 [ffffbd13003e8f08] __hrtimer_run_queues at ffffffff8cfec62f\\n 5 [ffffbd13003e8f70] hrtimer_interrupt at ffffffff8cfed756\\n 6 [ffffbd13003e8fd0] __sysvec_apic_timer_interrupt at ffffffff8cea01af\\n 7 [ffffbd13003e8ff0] sysvec_apic_timer_interrupt at ffffffff8df1b83d\\n-- \u003cIRQ stack\u003e --\\n 8 [ffffbd13003d3708] asm_sysvec_apic_timer_interrupt at ffffffff8e000ecb\\n    [exception RIP: fib6_select_path+299]\\n    RIP: ffffffff8ddafe7b  RSP: ffffbd13003d37b8  RFLAGS: 00000287\\n    RAX: ffff975850b43600  RBX: ffff975850b40200  RCX: 0000000000000000\\n    RDX: 000000003fffffff  RSI: 0000000051d383e4  RDI: ffff975850b43618\\n    RBP: ffffbd13003d3800   R8: 0000000000000000   R9: ffff975850b40200\\n    R10: 0000000000000000  R11: 0000000000000000  R12: ffffbd13003d3830\\n    R13: ffff975850b436a8  R14: ffff975850b43600  R15: 0000000000000007\\n    ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018\\n 9 [ffffbd13003d3808] ip6_pol_route at ffffffff8ddb030c\\n10 [ffffbd13003d3888] ip6_pol_route_input at ffffffff8ddb068c\\n11 [ffffbd13003d3898] fib6_rule_lookup at ffffffff8ddf02b5\\n12 [ffffbd13003d3928] ip6_route_input at ffffffff8ddb0f47\\n13 [ffffbd13003d3a18] ip6_rcv_finish_core.constprop.0 at ffffffff8dd950d0\\n14 [ffffbd13003d3a30] ip6_list_rcv_finish.constprop.0 at ffffffff8dd96274\\n15 [ffffbd13003d3a98] ip6_sublist_rcv at ffffffff8dd96474\\n16 [ffffbd13003d3af8] ipv6_list_rcv at ffffffff8dd96615\\n17 [ffffbd13003d3b60] __netif_receive_skb_list_core at ffffffff8dc16fec\\n18 [ffffbd13003d3be0] netif_receive_skb_list_internal at ffffffff8dc176b3\\n19 [ffffbd13003d3c50] napi_gro_receive at ffffffff8dc565b9\\n20 [ffffbd13003d3c80] ice_receive_skb at ffffffffc087e4f5 [ice]\\n21 [ffffbd13003d3c90] ice_clean_rx_irq at ffffffffc0881b80 [ice]\\n22 [ffffbd13003d3d20] ice_napi_poll at ffffffffc088232f [ice]\\n23 [ffffbd13003d3d80] __napi_poll at ffffffff8dc18000\\n24 [ffffbd13003d3db8] net_rx_action at ffffffff8dc18581\\n25 [ffffbd13003d3e40] __do_softirq at ffffffff8df352e9\\n26 [ffffbd13003d3eb0] run_ksoftirqd at ffffffff8ceffe47\\n27 [ffffbd13003d3ec0] smpboot_thread_fn at ffffffff8cf36a30\\n28 [ffffbd13003d3ee8] kthread at ffffffff8cf2b39f\\n29 [ffffbd13003d3f28] ret_from_fork at ffffffff8ce5fa64\\n30 [ffffbd13003d3f50] ret_from_fork_asm at ffffffff8ce03cbb\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ipv6: Se han observado bloqueos suaves en fib6_select_path bajo una alta rotaci\\u00f3n del siguiente salto. Se han observado bloqueos suaves en un cl\\u00faster del routeres de borde basados en Linux ubicados en un entorno altamente din\\u00e1mico. Al usar el servicio `bird`, estos routeres actualizan continuamente las rutas anunciadas por BGP debido a que cambian con frecuencia los destinos del siguiente salto, al mismo tiempo que administran un tr\\u00e1fico IPv6 significativo. Los bloqueos ocurren durante el recorrido de la lista enlazada circular de m\\u00faltiples rutas en la funci\\u00f3n `fib6_select_path`, particularmente mientras se itera a trav\\u00e9s de los hermanos en la lista. El problema generalmente surge cuando los nodos de la lista enlazada se eliminan inesperadamente de manera concurrente en un n\\u00facleo diferente, lo que se indica mediante sus elementos \u0027next\u0027 y \u0027previous\u0027 que apuntan al nodo mismo y su recuento de referencia cae a cero. Esto da como resultado un bucle infinito, lo que lleva a un bloqueo suave que desencadena un p\\u00e1nico del sistema a trav\\u00e9s del temporizador de vigilancia. Aplique primitivas RCU en las secciones de c\\u00f3digo problem\\u00e1ticas para resolver el problema. Cuando sea necesario, actualice las referencias a fib6_siblings para anotar o usar las API de RCU. Incluya un script de prueba que reproduzca el problema. El script actualiza peri\\u00f3dicamente la tabla de enrutamiento mientras genera una gran carga de tr\\u00e1fico IPv6 saliente a trav\\u00e9s de varios clientes iperf3. Induce constantemente bloqueos suaves infinitos en un par de minutos. Registro del n\\u00facleo: 0 [ffffbd13003e8d30] machine_kexec en ffffffff8ceaf3eb 1 [ffffbd13003e8d90] __crash_kexec en ffffffff8d0120e3 2 [ffffbd13003e8e58] p\\u00e1nico en ffffffff8cef65d4 3 [ffffbd13003e8ed8] watchdog_timer_fn en ffffffff8d05cb03 4 [ffffbd13003e8f08] __hrtimer_run_queues en ffffffff8cfec62f 5 [ffffbd13003e8f70] hrtimer_interrupt en ffffffff8cfed756 6 [ffffbd13003e8fd0] __sysvec_apic_timer_interrupt en ffffffff8cea01af 7 [ffffbd13003e8ff0] sysvec_apic_timer_interrupt en ffffffff8df1b83d --  -- 8 [ffffbd13003d3708] asm_sysvec_apic_timer_interrupt en ffffffff8e000ecb [excepci\\u00f3n RIP: fib6_select_path+299] RIP: ffffffff8ddafe7b RSP: ffffbd13003d37b8 RFLAGS: 00000287 RAX: ffff975850b43600 RBX: ffff975850b40200 RCX: 0000000000000000 RDX: 000000003fffffff RSI: 0000000051d383e4 RDI: ffff975850b43618 RBP: ffffbd13003d3800 R8: 000000000000000 R9: ffff975850b40200 R10: 000000000000000 R11: 000000000000000 R12: ffffbd13003d3830 R13: ffff975850b436a8 R14: ffff975850b43600 R15: 00000000000000007 ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 9 [ffffbd13003d3808] ruta_pol_ip6 en ffffffff8ddb030c 10 [ffffbd13003d3888] entrada_ruta_pol_ip6 en ffffffff8ddb068c 11 [ffffbd13003d3898] b\\u00fasqueda_regla_fib6 en ffffffff8ddf02b5 12 [ffffbd13003d3928] entrada_ruta_ip6 en ffffffff8ddb0f47 13 [ffffbd13003d3a18] ip6_rcv_finish_core.constprop.0 en ffffffff8dd950d0 14 [ffffbd13003d3a30] ip6_list_rcv_finish.constprop.0 en ffffffff8dd96274 15 [ffffbd13003d3a98] ip6_sublist_rcv en ffffffff8dd96474 16 [ffffbd13003d3af8] ipv6_list_rcv en ffffffff8dd96615 17 [ffffbd13003d3b60] __netif_receive_skb_list_core en ffffffff8dc16fec 18 [ffffbd13003d3be0] netif_receive_skb_list_internal en ffffffff8dc176b3 19 [ffffbd13003d3c50] napi_gro_receive en ffffffff8dc565b9 20 [ffffbd13003d3c80] ice_receive_skb en ffffffffc087e4f5 [hielo] 21 [ffffbd13003d3c90] ice_clean_rx_irq en ffffffffc0881b80 [hielo] 22 [ffffbd13003d3d20] ice_napi_poll en ffffffffc088232f [hielo] 23 [ffffbd13003d3d80] __napi_poll en ffffffff8dc18000 24 [ffffbd13003d3db8] net_rx_action en ffffffff8dc18581 25 [ffffbd13003d3e40] __do_softirq en ffffffff8df352e9 26 [ffffbd13003d3eb0] run_ksoftirqd en ffffffff8ceffe47 27 [ffffbd13003d3ec0] smpboot_thread_fn en ffffffff8cf36a30 28 [ffffbd13003d3ee8] kthread en ffffffff8cf2b39f 29 [ffffbd13003d3f28] ret_from_fork en ffffffff8ce5fa64 30 [ffffbd13003d3f50] ret_from_fork_asm en ffffffff8ce03cbb\"}]",
      "id": "CVE-2024-56703",
      "lastModified": "2024-12-28T10:15:18.433",
      "published": "2024-12-28T10:15:18.433",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/11edcd026012ac18acee0f1514db3ed1b160fc6f\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/34a949e7a0869dfa31a40416d2a56973fae1807b\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/d9ccb18f83ea2bb654289b6ecf014fd267cc988b\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-56703\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-12-28T10:15:18.433\",\"lastModified\":\"2026-08-04T11:22:22.247\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nipv6: Fix soft lockups in fib6_select_path under high next hop churn\\n\\nSoft lockups have been observed on a cluster of Linux-based edge routers\\nlocated in a highly dynamic environment. Using the `bird` service, these\\nrouters continuously update BGP-advertised routes due to frequently\\nchanging nexthop destinations, while also managing significant IPv6\\ntraffic. The lockups occur during the traversal of the multipath\\ncircular linked-list in the `fib6_select_path` function, particularly\\nwhile iterating through the siblings in the list. The issue typically\\narises when the nodes of the linked list are unexpectedly deleted\\nconcurrently on a different core\u2014indicated by their \u0027next\u0027 and\\n\u0027previous\u0027 elements pointing back to the node itself and their reference\\ncount dropping to zero. This results in an infinite loop, leading to a\\nsoft lockup that triggers a system panic via the watchdog timer.\\n\\nApply RCU primitives in the problematic code sections to resolve the\\nissue. Where necessary, update the references to fib6_siblings to\\nannotate or use the RCU APIs.\\n\\nInclude a test script that reproduces the issue. The script\\nperiodically updates the routing table while generating a heavy load\\nof outgoing IPv6 traffic through multiple iperf3 clients. It\\nconsistently induces infinite soft lockups within a couple of minutes.\\n\\nKernel log:\\n\\n 0 [ffffbd13003e8d30] machine_kexec at ffffffff8ceaf3eb\\n 1 [ffffbd13003e8d90] __crash_kexec at ffffffff8d0120e3\\n 2 [ffffbd13003e8e58] panic at ffffffff8cef65d4\\n 3 [ffffbd13003e8ed8] watchdog_timer_fn at ffffffff8d05cb03\\n 4 [ffffbd13003e8f08] __hrtimer_run_queues at ffffffff8cfec62f\\n 5 [ffffbd13003e8f70] hrtimer_interrupt at ffffffff8cfed756\\n 6 [ffffbd13003e8fd0] __sysvec_apic_timer_interrupt at ffffffff8cea01af\\n 7 [ffffbd13003e8ff0] sysvec_apic_timer_interrupt at ffffffff8df1b83d\\n-- \u003cIRQ stack\u003e --\\n 8 [ffffbd13003d3708] asm_sysvec_apic_timer_interrupt at ffffffff8e000ecb\\n    [exception RIP: fib6_select_path+299]\\n    RIP: ffffffff8ddafe7b  RSP: ffffbd13003d37b8  RFLAGS: 00000287\\n    RAX: ffff975850b43600  RBX: ffff975850b40200  RCX: 0000000000000000\\n    RDX: 000000003fffffff  RSI: 0000000051d383e4  RDI: ffff975850b43618\\n    RBP: ffffbd13003d3800   R8: 0000000000000000   R9: ffff975850b40200\\n    R10: 0000000000000000  R11: 0000000000000000  R12: ffffbd13003d3830\\n    R13: ffff975850b436a8  R14: ffff975850b43600  R15: 0000000000000007\\n    ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018\\n 9 [ffffbd13003d3808] ip6_pol_route at ffffffff8ddb030c\\n10 [ffffbd13003d3888] ip6_pol_route_input at ffffffff8ddb068c\\n11 [ffffbd13003d3898] fib6_rule_lookup at ffffffff8ddf02b5\\n12 [ffffbd13003d3928] ip6_route_input at ffffffff8ddb0f47\\n13 [ffffbd13003d3a18] ip6_rcv_finish_core.constprop.0 at ffffffff8dd950d0\\n14 [ffffbd13003d3a30] ip6_list_rcv_finish.constprop.0 at ffffffff8dd96274\\n15 [ffffbd13003d3a98] ip6_sublist_rcv at ffffffff8dd96474\\n16 [ffffbd13003d3af8] ipv6_list_rcv at ffffffff8dd96615\\n17 [ffffbd13003d3b60] __netif_receive_skb_list_core at ffffffff8dc16fec\\n18 [ffffbd13003d3be0] netif_receive_skb_list_internal at ffffffff8dc176b3\\n19 [ffffbd13003d3c50] napi_gro_receive at ffffffff8dc565b9\\n20 [ffffbd13003d3c80] ice_receive_skb at ffffffffc087e4f5 [ice]\\n21 [ffffbd13003d3c90] ice_clean_rx_irq at ffffffffc0881b80 [ice]\\n22 [ffffbd13003d3d20] ice_napi_poll at ffffffffc088232f [ice]\\n23 [ffffbd13003d3d80] __napi_poll at ffffffff8dc18000\\n24 [ffffbd13003d3db8] net_rx_action at ffffffff8dc18581\\n25 [ffffbd13003d3e40] __do_softirq at ffffffff8df352e9\\n26 [ffffbd13003d3eb0] run_ksoftirqd at ffffffff8ceffe47\\n27 [ffffbd13003d3ec0] smpboot_thread_fn at ffffffff8cf36a30\\n28 [ffffbd13003d3ee8] kthread at ffffffff8cf2b39f\\n29 [ffffbd13003d3f28] ret_from_fork at ffffffff8ce5fa64\\n30 [ffffbd13003d3f50] ret_from_fork_asm at ffffffff8ce03cbb\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ipv6: Se han observado bloqueos suaves en fib6_select_path bajo una alta rotaci\u00f3n del siguiente salto. Se han observado bloqueos suaves en un cl\u00faster del routeres de borde basados en Linux ubicados en un entorno altamente din\u00e1mico. Al usar el servicio `bird`, estos routeres actualizan continuamente las rutas anunciadas por BGP debido a que cambian con frecuencia los destinos del siguiente salto, al mismo tiempo que administran un tr\u00e1fico IPv6 significativo. Los bloqueos ocurren durante el recorrido de la lista enlazada circular de m\u00faltiples rutas en la funci\u00f3n `fib6_select_path`, particularmente mientras se itera a trav\u00e9s de los hermanos en la lista. El problema generalmente surge cuando los nodos de la lista enlazada se eliminan inesperadamente de manera concurrente en un n\u00facleo diferente, lo que se indica mediante sus elementos \u0027next\u0027 y \u0027previous\u0027 que apuntan al nodo mismo y su recuento de referencia cae a cero. Esto da como resultado un bucle infinito, lo que lleva a un bloqueo suave que desencadena un p\u00e1nico del sistema a trav\u00e9s del temporizador de vigilancia. Aplique primitivas RCU en las secciones de c\u00f3digo problem\u00e1ticas para resolver el problema. Cuando sea necesario, actualice las referencias a fib6_siblings para anotar o usar las API de RCU. Incluya un script de prueba que reproduzca el problema. El script actualiza peri\u00f3dicamente la tabla de enrutamiento mientras genera una gran carga de tr\u00e1fico IPv6 saliente a trav\u00e9s de varios clientes iperf3. Induce constantemente bloqueos suaves infinitos en un par de minutos. Registro del n\u00facleo: 0 [ffffbd13003e8d30] machine_kexec en ffffffff8ceaf3eb 1 [ffffbd13003e8d90] __crash_kexec en ffffffff8d0120e3 2 [ffffbd13003e8e58] p\u00e1nico en ffffffff8cef65d4 3 [ffffbd13003e8ed8] watchdog_timer_fn en ffffffff8d05cb03 4 [ffffbd13003e8f08] __hrtimer_run_queues en ffffffff8cfec62f 5 [ffffbd13003e8f70] hrtimer_interrupt en ffffffff8cfed756 6 [ffffbd13003e8fd0] __sysvec_apic_timer_interrupt en ffffffff8cea01af 7 [ffffbd13003e8ff0] sysvec_apic_timer_interrupt en ffffffff8df1b83d --  -- 8 [ffffbd13003d3708] asm_sysvec_apic_timer_interrupt en ffffffff8e000ecb [excepci\u00f3n RIP: fib6_select_path+299] RIP: ffffffff8ddafe7b RSP: ffffbd13003d37b8 RFLAGS: 00000287 RAX: ffff975850b43600 RBX: ffff975850b40200 RCX: 0000000000000000 RDX: 000000003fffffff RSI: 0000000051d383e4 RDI: ffff975850b43618 RBP: ffffbd13003d3800 R8: 000000000000000 R9: ffff975850b40200 R10: 000000000000000 R11: 000000000000000 R12: ffffbd13003d3830 R13: ffff975850b436a8 R14: ffff975850b43600 R15: 00000000000000007 ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 9 [ffffbd13003d3808] ruta_pol_ip6 en ffffffff8ddb030c 10 [ffffbd13003d3888] entrada_ruta_pol_ip6 en ffffffff8ddb068c 11 [ffffbd13003d3898] b\u00fasqueda_regla_fib6 en ffffffff8ddf02b5 12 [ffffbd13003d3928] entrada_ruta_ip6 en ffffffff8ddb0f47 13 [ffffbd13003d3a18] ip6_rcv_finish_core.constprop.0 en ffffffff8dd950d0 14 [ffffbd13003d3a30] ip6_list_rcv_finish.constprop.0 en ffffffff8dd96274 15 [ffffbd13003d3a98] ip6_sublist_rcv en ffffffff8dd96474 16 [ffffbd13003d3af8] ipv6_list_rcv en ffffffff8dd96615 17 [ffffbd13003d3b60] __netif_receive_skb_list_core en ffffffff8dc16fec 18 [ffffbd13003d3be0] netif_receive_skb_list_internal en ffffffff8dc176b3 19 [ffffbd13003d3c50] napi_gro_receive en ffffffff8dc565b9 20 [ffffbd13003d3c80] ice_receive_skb en ffffffffc087e4f5 [hielo] 21 [ffffbd13003d3c90] ice_clean_rx_irq en ffffffffc0881b80 [hielo] 22 [ffffbd13003d3d20] ice_napi_poll en ffffffffc088232f [hielo] 23 [ffffbd13003d3d80] __napi_poll en ffffffff8dc18000 24 [ffffbd13003d3db8] net_rx_action en ffffffff8dc18581 25 [ffffbd13003d3e40] __do_softirq en ffffffff8df352e9 26 [ffffbd13003d3eb0] run_ksoftirqd en ffffffff8ceffe47 27 [ffffbd13003d3ec0] smpboot_thread_fn en ffffffff8cf36a30 28 [ffffbd13003d3ee8] kthread en ffffffff8cf2b39f 29 [ffffbd13003d3f28] ret_from_fork en ffffffff8ce5fa64 30 [ffffbd13003d3f50] ret_from_fork_asm en ffffffff8ce03cbb\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/ipv6/ip6_fib.c\",\"net/ipv6/route.c\",\"tools/testing/selftests/net/Makefile\",\"tools/testing/selftests/net/ipv6_route_update_soft_lockup.sh\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"66f5d6ce53e665477d2a33e8f539d4fa4ca81c83\",\"lessThan\":\"d0ec61c9f3583b76aebdbb271f5c0d3fcccd48b2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"66f5d6ce53e665477d2a33e8f539d4fa4ca81c83\",\"lessThan\":\"52da02521ede55fb86546c3fffd9377b3261b91f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"66f5d6ce53e665477d2a33e8f539d4fa4ca81c83\",\"lessThan\":\"11edcd026012ac18acee0f1514db3ed1b160fc6f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"66f5d6ce53e665477d2a33e8f539d4fa4ca81c83\",\"lessThan\":\"34a949e7a0869dfa31a40416d2a56973fae1807b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"66f5d6ce53e665477d2a33e8f539d4fa4ca81c83\",\"lessThan\":\"d9ccb18f83ea2bb654289b6ecf014fd267cc988b\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/ipv6/ip6_fib.c\",\"net/ipv6/route.c\",\"tools/testing/selftests/net/Makefile\",\"tools/testing/selftests/net/ipv6_route_update_soft_lockup.sh\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.128\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.75\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11.11\",\"lessThanOrEqual\":\"6.11.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.2\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]},{\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\",\"affectedData\":[{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-10-01T19:58:51.187430Z\",\"id\":\"CVE-2024-56703\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-835\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-835\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.15\",\"versionEndExcluding\":\"6.1.128\",\"matchCriteriaId\":\"5EC1CA8D-18C2-4DD2-84A4-33C7DD6A4C17\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.75\",\"matchCriteriaId\":\"E8D39B53-7390-48BE-92FD-8846BE8E8430\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.11.11\",\"matchCriteriaId\":\"21434379-192D-472F-9B54-D45E3650E893\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.12\",\"versionEndExcluding\":\"6.12.2\",\"matchCriteriaId\":\"D8882B1B-2ABC-4838-AC1D-DBDBB5764776\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/11edcd026012ac18acee0f1514db3ed1b160fc6f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/34a949e7a0869dfa31a40416d2a56973fae1807b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/52da02521ede55fb86546c3fffd9377b3261b91f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d0ec61c9f3583b76aebdbb271f5c0d3fcccd48b2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d9ccb18f83ea2bb654289b6ecf014fd267cc988b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-019113.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2025-11-21T13:47:42+00:00",
      "cve": "CVE-2024-56703",
      "id": "CVE-2024-56703",
      "initial_release_date": "2024-12-28T00:00:00+00:00",
      "product_status:known_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ipv6: Fix soft lockups in fib6_select_path under high next hop churn",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-56703.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-25T01:16:38Z",
      "cve": "CVE-2024-56703",
      "id": "CVE-2024-56703",
      "initial_release_date": "2025-08-25T23:35:49Z",
      "product_status:known_affected": "652",
      "product_status:known_not_affected": "109",
      "product_status:recommended": "395",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-56703",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-56703.json",
      "version": "19"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T20:52:52.353Z\"}}, {\"affected\": [{\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.6\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.6\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.6\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.6\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.6\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"x_adpType\": \"supplier\", \"references\": [{\"url\": \"https://cert-portal.siemens.com/productcert/html/ssa-019113.html\"}], \"providerMetadata\": {\"orgId\": \"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\", \"shortName\": \"siemens-SADP\", \"dateUpdated\": \"2026-07-14T12:38:39.047Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-56703\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-01T19:58:51.187430Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-835\", \"description\": \"CWE-835 Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-01T15:47:20.274Z\"}}], \"cna\": {\"title\": \"ipv6: Fix soft lockups in fib6_select_path under high next hop churn\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"66f5d6ce53e665477d2a33e8f539d4fa4ca81c83\", \"lessThan\": \"d0ec61c9f3583b76aebdbb271f5c0d3fcccd48b2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"66f5d6ce53e665477d2a33e8f539d4fa4ca81c83\", \"lessThan\": \"52da02521ede55fb86546c3fffd9377b3261b91f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"66f5d6ce53e665477d2a33e8f539d4fa4ca81c83\", \"lessThan\": \"11edcd026012ac18acee0f1514db3ed1b160fc6f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"66f5d6ce53e665477d2a33e8f539d4fa4ca81c83\", \"lessThan\": \"34a949e7a0869dfa31a40416d2a56973fae1807b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"66f5d6ce53e665477d2a33e8f539d4fa4ca81c83\", \"lessThan\": \"d9ccb18f83ea2bb654289b6ecf014fd267cc988b\", \"versionType\": \"git\"}], \"programFiles\": [\"net/ipv6/ip6_fib.c\", \"net/ipv6/route.c\", \"tools/testing/selftests/net/Makefile\", \"tools/testing/selftests/net/ipv6_route_update_soft_lockup.sh\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.15\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.15\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.128\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.75\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.11\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.13\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/ipv6/ip6_fib.c\", \"net/ipv6/route.c\", \"tools/testing/selftests/net/Makefile\", \"tools/testing/selftests/net/ipv6_route_update_soft_lockup.sh\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/d0ec61c9f3583b76aebdbb271f5c0d3fcccd48b2\"}, {\"url\": \"https://git.kernel.org/stable/c/52da02521ede55fb86546c3fffd9377b3261b91f\"}, {\"url\": \"https://git.kernel.org/stable/c/11edcd026012ac18acee0f1514db3ed1b160fc6f\"}, {\"url\": \"https://git.kernel.org/stable/c/34a949e7a0869dfa31a40416d2a56973fae1807b\"}, {\"url\": \"https://git.kernel.org/stable/c/d9ccb18f83ea2bb654289b6ecf014fd267cc988b\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nipv6: Fix soft lockups in fib6_select_path under high next hop churn\\n\\nSoft lockups have been observed on a cluster of Linux-based edge routers\\nlocated in a highly dynamic environment. Using the `bird` service, these\\nrouters continuously update BGP-advertised routes due to frequently\\nchanging nexthop destinations, while also managing significant IPv6\\ntraffic. The lockups occur during the traversal of the multipath\\ncircular linked-list in the `fib6_select_path` function, particularly\\nwhile iterating through the siblings in the list. The issue typically\\narises when the nodes of the linked list are unexpectedly deleted\\nconcurrently on a different core\\u2014indicated by their \u0027next\u0027 and\\n\u0027previous\u0027 elements pointing back to the node itself and their reference\\ncount dropping to zero. This results in an infinite loop, leading to a\\nsoft lockup that triggers a system panic via the watchdog timer.\\n\\nApply RCU primitives in the problematic code sections to resolve the\\nissue. Where necessary, update the references to fib6_siblings to\\nannotate or use the RCU APIs.\\n\\nInclude a test script that reproduces the issue. The script\\nperiodically updates the routing table while generating a heavy load\\nof outgoing IPv6 traffic through multiple iperf3 clients. It\\nconsistently induces infinite soft lockups within a couple of minutes.\\n\\nKernel log:\\n\\n 0 [ffffbd13003e8d30] machine_kexec at ffffffff8ceaf3eb\\n 1 [ffffbd13003e8d90] __crash_kexec at ffffffff8d0120e3\\n 2 [ffffbd13003e8e58] panic at ffffffff8cef65d4\\n 3 [ffffbd13003e8ed8] watchdog_timer_fn at ffffffff8d05cb03\\n 4 [ffffbd13003e8f08] __hrtimer_run_queues at ffffffff8cfec62f\\n 5 [ffffbd13003e8f70] hrtimer_interrupt at ffffffff8cfed756\\n 6 [ffffbd13003e8fd0] __sysvec_apic_timer_interrupt at ffffffff8cea01af\\n 7 [ffffbd13003e8ff0] sysvec_apic_timer_interrupt at ffffffff8df1b83d\\n-- \u003cIRQ stack\u003e --\\n 8 [ffffbd13003d3708] asm_sysvec_apic_timer_interrupt at ffffffff8e000ecb\\n    [exception RIP: fib6_select_path+299]\\n    RIP: ffffffff8ddafe7b  RSP: ffffbd13003d37b8  RFLAGS: 00000287\\n    RAX: ffff975850b43600  RBX: ffff975850b40200  RCX: 0000000000000000\\n    RDX: 000000003fffffff  RSI: 0000000051d383e4  RDI: ffff975850b43618\\n    RBP: ffffbd13003d3800   R8: 0000000000000000   R9: ffff975850b40200\\n    R10: 0000000000000000  R11: 0000000000000000  R12: ffffbd13003d3830\\n    R13: ffff975850b436a8  R14: ffff975850b43600  R15: 0000000000000007\\n    ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018\\n 9 [ffffbd13003d3808] ip6_pol_route at ffffffff8ddb030c\\n10 [ffffbd13003d3888] ip6_pol_route_input at ffffffff8ddb068c\\n11 [ffffbd13003d3898] fib6_rule_lookup at ffffffff8ddf02b5\\n12 [ffffbd13003d3928] ip6_route_input at ffffffff8ddb0f47\\n13 [ffffbd13003d3a18] ip6_rcv_finish_core.constprop.0 at ffffffff8dd950d0\\n14 [ffffbd13003d3a30] ip6_list_rcv_finish.constprop.0 at ffffffff8dd96274\\n15 [ffffbd13003d3a98] ip6_sublist_rcv at ffffffff8dd96474\\n16 [ffffbd13003d3af8] ipv6_list_rcv at ffffffff8dd96615\\n17 [ffffbd13003d3b60] __netif_receive_skb_list_core at ffffffff8dc16fec\\n18 [ffffbd13003d3be0] netif_receive_skb_list_internal at ffffffff8dc176b3\\n19 [ffffbd13003d3c50] napi_gro_receive at ffffffff8dc565b9\\n20 [ffffbd13003d3c80] ice_receive_skb at ffffffffc087e4f5 [ice]\\n21 [ffffbd13003d3c90] ice_clean_rx_irq at ffffffffc0881b80 [ice]\\n22 [ffffbd13003d3d20] ice_napi_poll at ffffffffc088232f [ice]\\n23 [ffffbd13003d3d80] __napi_poll at ffffffff8dc18000\\n24 [ffffbd13003d3db8] net_rx_action at ffffffff8dc18581\\n25 [ffffbd13003d3e40] __do_softirq at ffffffff8df352e9\\n26 [ffffbd13003d3eb0] run_ksoftirqd at ffffffff8ceffe47\\n27 [ffffbd13003d3ec0] smpboot_thread_fn at ffffffff8cf36a30\\n28 [ffffbd13003d3ee8] kthread at ffffffff8cf2b39f\\n29 [ffffbd13003d3f28] ret_from_fork at ffffffff8ce5fa64\\n30 [ffffbd13003d3f50] ret_from_fork_asm at ffffffff8ce03cbb\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.128\", \"versionStartIncluding\": \"4.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.75\", \"versionStartIncluding\": \"4.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.11\", \"versionStartIncluding\": \"4.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.2\", \"versionStartIncluding\": \"4.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.13\", \"versionStartIncluding\": \"4.15\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T20:57:37.245Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-56703\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-14T12:38:39.047Z\", \"dateReserved\": \"2024-12-27T15:00:39.856Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-12-28T09:46:24.978Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.