GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-40957 (GCVE-0-2024-40957)

Vulnerability from cvelistv5 – Published: 2024-07-12 12:31 – Updated: 2026-08-05 11:34
VLAI
Title
seg6: fix parameter passing when calling NF_HOOK() in End.DX4 and End.DX6 behaviors
Summary
In the Linux kernel, the following vulnerability has been resolved: seg6: fix parameter passing when calling NF_HOOK() in End.DX4 and End.DX6 behaviors input_action_end_dx4() and input_action_end_dx6() are called NF_HOOK() for PREROUTING hook, in PREROUTING hook, we should passing a valid indev, and a NULL outdev to NF_HOOK(), otherwise may trigger a NULL pointer dereference, as below: [74830.647293] BUG: kernel NULL pointer dereference, address: 0000000000000090 [74830.655633] #PF: supervisor read access in kernel mode [74830.657888] #PF: error_code(0x0000) - not-present page [74830.659500] PGD 0 P4D 0 [74830.660450] Oops: 0000 [#1] PREEMPT SMP PTI ... [74830.664953] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [74830.666569] RIP: 0010:rpfilter_mt+0x44/0x15e [ipt_rpfilter] ... [74830.689725] Call Trace: [74830.690402] <IRQ> [74830.690953] ? show_trace_log_lvl+0x1c4/0x2df [74830.692020] ? show_trace_log_lvl+0x1c4/0x2df [74830.693095] ? ipt_do_table+0x286/0x710 [ip_tables] [74830.694275] ? __die_body.cold+0x8/0xd [74830.695205] ? page_fault_oops+0xac/0x140 [74830.696244] ? exc_page_fault+0x62/0x150 [74830.697225] ? asm_exc_page_fault+0x22/0x30 [74830.698344] ? rpfilter_mt+0x44/0x15e [ipt_rpfilter] [74830.699540] ipt_do_table+0x286/0x710 [ip_tables] [74830.700758] ? ip6_route_input+0x19d/0x240 [74830.701752] nf_hook_slow+0x3f/0xb0 [74830.702678] input_action_end_dx4+0x19b/0x1e0 [74830.703735] ? input_action_end_t+0xe0/0xe0 [74830.704734] seg6_local_input_core+0x2d/0x60 [74830.705782] lwtunnel_input+0x5b/0xb0 [74830.706690] __netif_receive_skb_one_core+0x63/0xa0 [74830.707825] process_backlog+0x99/0x140 [74830.709538] __napi_poll+0x2c/0x160 [74830.710673] net_rx_action+0x296/0x350 [74830.711860] __do_softirq+0xcb/0x2ac [74830.713049] do_softirq+0x63/0x90 input_action_end_dx4() passing a NULL indev to NF_HOOK(), and finally trigger a NULL dereference in rpfilter_mt()->rpfilter_is_loopback(): static bool rpfilter_is_loopback(const struct sk_buff *skb, const struct net_device *in) { // in is NULL return skb->pkt_type == PACKET_LOOPBACK || in->flags & IFF_LOOPBACK; }
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 17:03 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 7a3f5b0de3647c854e34269c3332d7a1e902901a , < af90e3d73dc45778767b2fb6e7edd57ebe34380d (git)
Affected: 7a3f5b0de3647c854e34269c3332d7a1e902901a , < ec4d970b597ee5e17b0d8d73b7875197ce9a04d4 (git)
Affected: 7a3f5b0de3647c854e34269c3332d7a1e902901a , < d62df86c172033679d744f07d89e93e367dd11f6 (git)
Affected: 7a3f5b0de3647c854e34269c3332d7a1e902901a , < 561475d53aa7e4511ee7cdba8728ded81cf1db1c (git)
Affected: 7a3f5b0de3647c854e34269c3332d7a1e902901a , < 9a3bc8d16e0aacd65c31aaf23a2bced3288a7779 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.15
Unaffected: 0 , < 5.15 (semver)
Unaffected: 5.15.162 , ≤ 5.15.* (semver)
Unaffected: 6.1.96 , ≤ 6.1.* (semver)
Unaffected: 6.6.36 , ≤ 6.6.* (semver)
Unaffected: 6.9.7 , ≤ 6.9.* (semver)
Unaffected: 6.10 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T21:58:21.536Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/af90e3d73dc45778767b2fb6e7edd57ebe34380d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ec4d970b597ee5e17b0d8d73b7875197ce9a04d4"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d62df86c172033679d744f07d89e93e367dd11f6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/561475d53aa7e4511ee7cdba8728ded81cf1db1c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/9a3bc8d16e0aacd65c31aaf23a2bced3288a7779"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-40957",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:03:38.761289Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:24.035Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/seg6_local.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "af90e3d73dc45778767b2fb6e7edd57ebe34380d",
              "status": "affected",
              "version": "7a3f5b0de3647c854e34269c3332d7a1e902901a",
              "versionType": "git"
            },
            {
              "lessThan": "ec4d970b597ee5e17b0d8d73b7875197ce9a04d4",
              "status": "affected",
              "version": "7a3f5b0de3647c854e34269c3332d7a1e902901a",
              "versionType": "git"
            },
            {
              "lessThan": "d62df86c172033679d744f07d89e93e367dd11f6",
              "status": "affected",
              "version": "7a3f5b0de3647c854e34269c3332d7a1e902901a",
              "versionType": "git"
            },
            {
              "lessThan": "561475d53aa7e4511ee7cdba8728ded81cf1db1c",
              "status": "affected",
              "version": "7a3f5b0de3647c854e34269c3332d7a1e902901a",
              "versionType": "git"
            },
            {
              "lessThan": "9a3bc8d16e0aacd65c31aaf23a2bced3288a7779",
              "status": "affected",
              "version": "7a3f5b0de3647c854e34269c3332d7a1e902901a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/seg6_local.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.162",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.162",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.96",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.36",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.7",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nseg6: fix parameter passing when calling NF_HOOK() in End.DX4 and End.DX6 behaviors\n\ninput_action_end_dx4() and input_action_end_dx6() are called NF_HOOK() for\nPREROUTING hook, in PREROUTING hook, we should passing a valid indev,\nand a NULL outdev to NF_HOOK(), otherwise may trigger a NULL pointer\ndereference, as below:\n\n    [74830.647293] BUG: kernel NULL pointer dereference, address: 0000000000000090\n    [74830.655633] #PF: supervisor read access in kernel mode\n    [74830.657888] #PF: error_code(0x0000) - not-present page\n    [74830.659500] PGD 0 P4D 0\n    [74830.660450] Oops: 0000 [#1] PREEMPT SMP PTI\n    ...\n    [74830.664953] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011\n    [74830.666569] RIP: 0010:rpfilter_mt+0x44/0x15e [ipt_rpfilter]\n    ...\n    [74830.689725] Call Trace:\n    [74830.690402]  \u003cIRQ\u003e\n    [74830.690953]  ? show_trace_log_lvl+0x1c4/0x2df\n    [74830.692020]  ? show_trace_log_lvl+0x1c4/0x2df\n    [74830.693095]  ? ipt_do_table+0x286/0x710 [ip_tables]\n    [74830.694275]  ? __die_body.cold+0x8/0xd\n    [74830.695205]  ? page_fault_oops+0xac/0x140\n    [74830.696244]  ? exc_page_fault+0x62/0x150\n    [74830.697225]  ? asm_exc_page_fault+0x22/0x30\n    [74830.698344]  ? rpfilter_mt+0x44/0x15e [ipt_rpfilter]\n    [74830.699540]  ipt_do_table+0x286/0x710 [ip_tables]\n    [74830.700758]  ? ip6_route_input+0x19d/0x240\n    [74830.701752]  nf_hook_slow+0x3f/0xb0\n    [74830.702678]  input_action_end_dx4+0x19b/0x1e0\n    [74830.703735]  ? input_action_end_t+0xe0/0xe0\n    [74830.704734]  seg6_local_input_core+0x2d/0x60\n    [74830.705782]  lwtunnel_input+0x5b/0xb0\n    [74830.706690]  __netif_receive_skb_one_core+0x63/0xa0\n    [74830.707825]  process_backlog+0x99/0x140\n    [74830.709538]  __napi_poll+0x2c/0x160\n    [74830.710673]  net_rx_action+0x296/0x350\n    [74830.711860]  __do_softirq+0xcb/0x2ac\n    [74830.713049]  do_softirq+0x63/0x90\n\ninput_action_end_dx4() passing a NULL indev to NF_HOOK(), and finally\ntrigger a NULL dereference in rpfilter_mt()-\u003erpfilter_is_loopback():\n\n    static bool\n    rpfilter_is_loopback(const struct sk_buff *skb,\n          \t       const struct net_device *in)\n    {\n            // in is NULL\n            return skb-\u003epkt_type == PACKET_LOOPBACK ||\n          \t in-\u003eflags \u0026 IFF_LOOPBACK;\n    }"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The crash is triggered by a received IPv6 packet whose destination matches a configured SRv6 End.DX4/End.DX6 SID, processed in the receive softirq path (`lwtunnel_input` \u2192 `seg6_local_input_core`). No local access or account on the router is needed \u2014 any host able to route a packet to the SID reaches the code.\nAC:L - Once the target runs the affected (supported, documented) SRv6 + netfilter configuration, a single crafted packet deterministically dereferences NULL \u2014 no race, no memory-layout dependence, no information the attacker must first gather. The required rpfilter/fib-check rule is the default in firewalld-based distros, and the `nf_hooks_lwtunnel` gate can even be flipped host-wide by any local unprivileged user via a user namespace.\nPR:N - Packet processing happens before any authentication or authorization; the attacker needs no credentials or privileges on the target at all, only the ability to send a packet to the SID.\nUI:N - The crash occurs entirely in the kernel\u0027s packet receive path with no action by any local user or administrator beyond the pre-existing configuration.\nS:U - The NULL dereference occurs in the kernel of the machine receiving the packet, and the impact is confined to that same kernel/security authority \u2014 no VM, IOMMU, or sandbox boundary is crossed.\nC:N - The fault is a read of a fixed small offset (0x90) from a NULL pointer, which is unmapped; nothing is returned to the attacker and no kernel memory contents are exposed.\nI:N - No memory is written and no data is modified \u2014 the bug is a read-only dereference of a NULL device pointer, which cannot be leveraged into a write or control-flow primitive.\nA:H - The NULL dereference happens in softirq/interrupt context during NAPI receive processing, producing a kernel oops that panics or renders the router unusable, and it can be re-triggered by every subsequent packet."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:34:16.301Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/af90e3d73dc45778767b2fb6e7edd57ebe34380d"
        },
        {
          "url": "https://git.kernel.org/stable/c/ec4d970b597ee5e17b0d8d73b7875197ce9a04d4"
        },
        {
          "url": "https://git.kernel.org/stable/c/d62df86c172033679d744f07d89e93e367dd11f6"
        },
        {
          "url": "https://git.kernel.org/stable/c/561475d53aa7e4511ee7cdba8728ded81cf1db1c"
        },
        {
          "url": "https://git.kernel.org/stable/c/9a3bc8d16e0aacd65c31aaf23a2bced3288a7779"
        }
      ],
      "title": "seg6: fix parameter passing when calling NF_HOOK() in End.DX4 and End.DX6 behaviors",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-40957",
    "datePublished": "2024-07-12T12:31:59.747Z",
    "dateReserved": "2024-07-12T12:17:45.593Z",
    "dateUpdated": "2026-08-05T11:34:16.301Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-40957",
      "date": "2026-09-16",
      "epss": "0.00731",
      "percentile": "0.5256"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.15\", \"versionEndExcluding\": \"5.15.162\", \"matchCriteriaId\": \"4626E4B7-D5F4-42CC-93A8-B73E6384273F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.16\", \"versionEndExcluding\": \"6.1.96\", \"matchCriteriaId\": \"61E887B4-732A-40D2-9983-CC6F281EBFB7\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.2\", \"versionEndExcluding\": \"6.6.36\", \"matchCriteriaId\": \"E1046C95-860A-45B0-B718-2B29F65BFF10\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.9.7\", \"matchCriteriaId\": \"0A047AF2-94AC-4A3A-B32D-6AB930D8EF1C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.10:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"2EBB4392-5FA6-4DA9-9772-8F9C750109FA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.10:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"331C2F14-12C7-45D5-893D-8C52EE38EA10\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.10:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"3173713D-909A-4DD3-9DD4-1E171EB057EE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.10:rc4:*:*:*:*:*:*\", \"matchCriteriaId\": \"79F18AFA-40F7-43F0-BA30-7BDB65F918B9\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nseg6: fix parameter passing when calling NF_HOOK() in End.DX4 and End.DX6 behaviors\\n\\ninput_action_end_dx4() and input_action_end_dx6() are called NF_HOOK() for\\nPREROUTING hook, in PREROUTING hook, we should passing a valid indev,\\nand a NULL outdev to NF_HOOK(), otherwise may trigger a NULL pointer\\ndereference, as below:\\n\\n    [74830.647293] BUG: kernel NULL pointer dereference, address: 0000000000000090\\n    [74830.655633] #PF: supervisor read access in kernel mode\\n    [74830.657888] #PF: error_code(0x0000) - not-present page\\n    [74830.659500] PGD 0 P4D 0\\n    [74830.660450] Oops: 0000 [#1] PREEMPT SMP PTI\\n    ...\\n    [74830.664953] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011\\n    [74830.666569] RIP: 0010:rpfilter_mt+0x44/0x15e [ipt_rpfilter]\\n    ...\\n    [74830.689725] Call Trace:\\n    [74830.690402]  \u003cIRQ\u003e\\n    [74830.690953]  ? show_trace_log_lvl+0x1c4/0x2df\\n    [74830.692020]  ? show_trace_log_lvl+0x1c4/0x2df\\n    [74830.693095]  ? ipt_do_table+0x286/0x710 [ip_tables]\\n    [74830.694275]  ? __die_body.cold+0x8/0xd\\n    [74830.695205]  ? page_fault_oops+0xac/0x140\\n    [74830.696244]  ? exc_page_fault+0x62/0x150\\n    [74830.697225]  ? asm_exc_page_fault+0x22/0x30\\n    [74830.698344]  ? rpfilter_mt+0x44/0x15e [ipt_rpfilter]\\n    [74830.699540]  ipt_do_table+0x286/0x710 [ip_tables]\\n    [74830.700758]  ? ip6_route_input+0x19d/0x240\\n    [74830.701752]  nf_hook_slow+0x3f/0xb0\\n    [74830.702678]  input_action_end_dx4+0x19b/0x1e0\\n    [74830.703735]  ? input_action_end_t+0xe0/0xe0\\n    [74830.704734]  seg6_local_input_core+0x2d/0x60\\n    [74830.705782]  lwtunnel_input+0x5b/0xb0\\n    [74830.706690]  __netif_receive_skb_one_core+0x63/0xa0\\n    [74830.707825]  process_backlog+0x99/0x140\\n    [74830.709538]  __napi_poll+0x2c/0x160\\n    [74830.710673]  net_rx_action+0x296/0x350\\n    [74830.711860]  __do_softirq+0xcb/0x2ac\\n    [74830.713049]  do_softirq+0x63/0x90\\n\\ninput_action_end_dx4() passing a NULL indev to NF_HOOK(), and finally\\ntrigger a NULL dereference in rpfilter_mt()-\u003erpfilter_is_loopback():\\n\\n    static bool\\n    rpfilter_is_loopback(const struct sk_buff *skb,\\n          \\t       const struct net_device *in)\\n    {\\n            // in is NULL\\n            return skb-\u003epkt_type == PACKET_LOOPBACK ||\\n          \\t in-\u003eflags \u0026 IFF_LOOPBACK;\\n    }\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: seg6: corrige el paso de par\\u00e1metros al llamar a NF_HOOK() en los comportamientos End.DX4 y End.DX6 input_action_end_dx4() y input_action_end_dx6() se llaman NF_HOOK() para el gancho PREROUTING, en el gancho PREROUTING , debemos pasar un indev v\\u00e1lido y un outdev NULL a NF_HOOK(); de lo contrario, podemos desencadenar una desreferencia del puntero NULL, como se muestra a continuaci\\u00f3n: [74830.647293] ERROR: desreferencia del puntero NULL del kernel, direcci\\u00f3n: 00000000000000090 [74830.655633] #PF: acceso de lectura del supervisor en modo kernel [74830.657888] #PF: error_code(0x0000) - p\\u00e1gina no presente [74830.659500] PGD 0 P4D 0 [74830.660450] Ups: 0000 [#1] PREEMPT SMP PTI... [74830.664953] Nombre de hardware: Red Hat KVM , BIOS 0.5.1 01/01/2011 [74830.666569] RIP: 0010:rpfilter_mt+0x44/0x15e [ipt_rpfilter] ... [74830.689725] Seguimiento de llamadas: [74830.690402]  [74830.690953] ? show_trace_log_lvl+0x1c4/0x2df [74830.692020] ? show_trace_log_lvl+0x1c4/0x2df [74830.693095] ? ipt_do_table+0x286/0x710 [ip_tables] [74830.694275] ? __die_body.cold+0x8/0xd [74830.695205] ? page_fault_oops+0xac/0x140 [74830.696244] ? exc_page_fault+0x62/0x150 [74830.697225] ? asm_exc_page_fault+0x22/0x30 [74830.698344] ? rpfilter_mt+0x44/0x15e [ipt_rpfilter] [74830.699540] ipt_do_table+0x286/0x710 [ip_tables] [74830.700758] ? ip6_route_input+0x19d/0x240 [74830.701752] nf_hook_slow+0x3f/0xb0 [74830.702678] input_action_end_dx4+0x19b/0x1e0 [74830.703735] ? input_action_end_t+0xe0/0xe0 [74830.704734] seg6_local_input_core+0x2d/0x60 [74830.705782] lwtunnel_input+0x5b/0xb0 [74830.706690] __netif_receive_skb_one_core+0x63/0xa0 830.707825] proceso_atrasado+0x99/0x140 [74830.709538] __napi_poll+0x2c/0x160 [74830.710673] net_rx_action+ 0x296/0x350 [74830.711860] __do_softirq+0xcb/0x2ac [74830.713049] do_softirq+0x63/0x90 input_action_end_dx4() pasando un indev NULL a NF_HOOK(), y finalmente activa una desreferencia NULL en rpfilter_mt()-\u0026gt;rpfilter_is_lo opback(): bool est\\u00e1tico rpfilter_is_loopback (const struct sk_buff *skb, const struct net_device *in) { // in es NULL return skb-\u0026gt;pkt_type == PACKET_LOOPBACK || en-\u0026gt;flags \u0026amp; IFF_LOOPBACK; }\"}]",
      "id": "CVE-2024-40957",
      "lastModified": "2024-11-21T09:31:56.810",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-07-12T13:15:17.823",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/561475d53aa7e4511ee7cdba8728ded81cf1db1c\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/9a3bc8d16e0aacd65c31aaf23a2bced3288a7779\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/af90e3d73dc45778767b2fb6e7edd57ebe34380d\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/d62df86c172033679d744f07d89e93e367dd11f6\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/ec4d970b597ee5e17b0d8d73b7875197ce9a04d4\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/561475d53aa7e4511ee7cdba8728ded81cf1db1c\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/9a3bc8d16e0aacd65c31aaf23a2bced3288a7779\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/af90e3d73dc45778767b2fb6e7edd57ebe34380d\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/d62df86c172033679d744f07d89e93e367dd11f6\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/ec4d970b597ee5e17b0d8d73b7875197ce9a04d4\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-476\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-40957\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-07-12T13:15:17.823\",\"lastModified\":\"2026-08-04T11:19:09.797\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nseg6: fix parameter passing when calling NF_HOOK() in End.DX4 and End.DX6 behaviors\\n\\ninput_action_end_dx4() and input_action_end_dx6() are called NF_HOOK() for\\nPREROUTING hook, in PREROUTING hook, we should passing a valid indev,\\nand a NULL outdev to NF_HOOK(), otherwise may trigger a NULL pointer\\ndereference, as below:\\n\\n    [74830.647293] BUG: kernel NULL pointer dereference, address: 0000000000000090\\n    [74830.655633] #PF: supervisor read access in kernel mode\\n    [74830.657888] #PF: error_code(0x0000) - not-present page\\n    [74830.659500] PGD 0 P4D 0\\n    [74830.660450] Oops: 0000 [#1] PREEMPT SMP PTI\\n    ...\\n    [74830.664953] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011\\n    [74830.666569] RIP: 0010:rpfilter_mt+0x44/0x15e [ipt_rpfilter]\\n    ...\\n    [74830.689725] Call Trace:\\n    [74830.690402]  \u003cIRQ\u003e\\n    [74830.690953]  ? show_trace_log_lvl+0x1c4/0x2df\\n    [74830.692020]  ? show_trace_log_lvl+0x1c4/0x2df\\n    [74830.693095]  ? ipt_do_table+0x286/0x710 [ip_tables]\\n    [74830.694275]  ? __die_body.cold+0x8/0xd\\n    [74830.695205]  ? page_fault_oops+0xac/0x140\\n    [74830.696244]  ? exc_page_fault+0x62/0x150\\n    [74830.697225]  ? asm_exc_page_fault+0x22/0x30\\n    [74830.698344]  ? rpfilter_mt+0x44/0x15e [ipt_rpfilter]\\n    [74830.699540]  ipt_do_table+0x286/0x710 [ip_tables]\\n    [74830.700758]  ? ip6_route_input+0x19d/0x240\\n    [74830.701752]  nf_hook_slow+0x3f/0xb0\\n    [74830.702678]  input_action_end_dx4+0x19b/0x1e0\\n    [74830.703735]  ? input_action_end_t+0xe0/0xe0\\n    [74830.704734]  seg6_local_input_core+0x2d/0x60\\n    [74830.705782]  lwtunnel_input+0x5b/0xb0\\n    [74830.706690]  __netif_receive_skb_one_core+0x63/0xa0\\n    [74830.707825]  process_backlog+0x99/0x140\\n    [74830.709538]  __napi_poll+0x2c/0x160\\n    [74830.710673]  net_rx_action+0x296/0x350\\n    [74830.711860]  __do_softirq+0xcb/0x2ac\\n    [74830.713049]  do_softirq+0x63/0x90\\n\\ninput_action_end_dx4() passing a NULL indev to NF_HOOK(), and finally\\ntrigger a NULL dereference in rpfilter_mt()-\u003erpfilter_is_loopback():\\n\\n    static bool\\n    rpfilter_is_loopback(const struct sk_buff *skb,\\n          \\t       const struct net_device *in)\\n    {\\n            // in is NULL\\n            return skb-\u003epkt_type == PACKET_LOOPBACK ||\\n          \\t in-\u003eflags \u0026 IFF_LOOPBACK;\\n    }\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: seg6: corrige el paso de par\u00e1metros al llamar a NF_HOOK() en los comportamientos End.DX4 y End.DX6 input_action_end_dx4() y input_action_end_dx6() se llaman NF_HOOK() para el gancho PREROUTING, en el gancho PREROUTING , debemos pasar un indev v\u00e1lido y un outdev NULL a NF_HOOK(); de lo contrario, podemos desencadenar una desreferencia del puntero NULL, como se muestra a continuaci\u00f3n: [74830.647293] ERROR: desreferencia del puntero NULL del kernel, direcci\u00f3n: 00000000000000090 [74830.655633] #PF: acceso de lectura del supervisor en modo kernel [74830.657888] #PF: error_code(0x0000) - p\u00e1gina no presente [74830.659500] PGD 0 P4D 0 [74830.660450] Ups: 0000 [#1] PREEMPT SMP PTI... [74830.664953] Nombre de hardware: Red Hat KVM , BIOS 0.5.1 01/01/2011 [74830.666569] RIP: 0010:rpfilter_mt+0x44/0x15e [ipt_rpfilter] ... [74830.689725] Seguimiento de llamadas: [74830.690402]  [74830.690953] ? show_trace_log_lvl+0x1c4/0x2df [74830.692020] ? show_trace_log_lvl+0x1c4/0x2df [74830.693095] ? ipt_do_table+0x286/0x710 [ip_tables] [74830.694275] ? __die_body.cold+0x8/0xd [74830.695205] ? page_fault_oops+0xac/0x140 [74830.696244] ? exc_page_fault+0x62/0x150 [74830.697225] ? asm_exc_page_fault+0x22/0x30 [74830.698344] ? rpfilter_mt+0x44/0x15e [ipt_rpfilter] [74830.699540] ipt_do_table+0x286/0x710 [ip_tables] [74830.700758] ? ip6_route_input+0x19d/0x240 [74830.701752] nf_hook_slow+0x3f/0xb0 [74830.702678] input_action_end_dx4+0x19b/0x1e0 [74830.703735] ? input_action_end_t+0xe0/0xe0 [74830.704734] seg6_local_input_core+0x2d/0x60 [74830.705782] lwtunnel_input+0x5b/0xb0 [74830.706690] __netif_receive_skb_one_core+0x63/0xa0 830.707825] proceso_atrasado+0x99/0x140 [74830.709538] __napi_poll+0x2c/0x160 [74830.710673] net_rx_action+ 0x296/0x350 [74830.711860] __do_softirq+0xcb/0x2ac [74830.713049] do_softirq+0x63/0x90 input_action_end_dx4() pasando un indev NULL a NF_HOOK(), y finalmente activa una desreferencia NULL en rpfilter_mt()-\u0026gt;rpfilter_is_lo opback(): bool est\u00e1tico rpfilter_is_loopback (const struct sk_buff *skb, const struct net_device *in) { // in es NULL return skb-\u0026gt;pkt_type == PACKET_LOOPBACK || en-\u0026gt;flags \u0026amp; IFF_LOOPBACK; }\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/ipv6/seg6_local.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7a3f5b0de3647c854e34269c3332d7a1e902901a\",\"lessThan\":\"af90e3d73dc45778767b2fb6e7edd57ebe34380d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7a3f5b0de3647c854e34269c3332d7a1e902901a\",\"lessThan\":\"ec4d970b597ee5e17b0d8d73b7875197ce9a04d4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7a3f5b0de3647c854e34269c3332d7a1e902901a\",\"lessThan\":\"d62df86c172033679d744f07d89e93e367dd11f6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7a3f5b0de3647c854e34269c3332d7a1e902901a\",\"lessThan\":\"561475d53aa7e4511ee7cdba8728ded81cf1db1c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"7a3f5b0de3647c854e34269c3332d7a1e902901a\",\"lessThan\":\"9a3bc8d16e0aacd65c31aaf23a2bced3288a7779\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/ipv6/seg6_local.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.162\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.96\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.36\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9.7\",\"lessThanOrEqual\":\"6.9.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T17:03:38.761289Z\",\"id\":\"CVE-2024-40957\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.15\",\"versionEndExcluding\":\"5.15.162\",\"matchCriteriaId\":\"4626E4B7-D5F4-42CC-93A8-B73E6384273F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.96\",\"matchCriteriaId\":\"61E887B4-732A-40D2-9983-CC6F281EBFB7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.36\",\"matchCriteriaId\":\"E1046C95-860A-45B0-B718-2B29F65BFF10\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.9.7\",\"matchCriteriaId\":\"0A047AF2-94AC-4A3A-B32D-6AB930D8EF1C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"2EBB4392-5FA6-4DA9-9772-8F9C750109FA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"331C2F14-12C7-45D5-893D-8C52EE38EA10\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"3173713D-909A-4DD3-9DD4-1E171EB057EE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.10:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"79F18AFA-40F7-43F0-BA30-7BDB65F918B9\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/561475d53aa7e4511ee7cdba8728ded81cf1db1c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9a3bc8d16e0aacd65c31aaf23a2bced3288a7779\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/af90e3d73dc45778767b2fb6e7edd57ebe34380d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d62df86c172033679d744f07d89e93e367dd11f6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ec4d970b597ee5e17b0d8d73b7875197ce9a04d4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/561475d53aa7e4511ee7cdba8728ded81cf1db1c\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9a3bc8d16e0aacd65c31aaf23a2bced3288a7779\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/af90e3d73dc45778767b2fb6e7edd57ebe34380d\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d62df86c172033679d744f07d89e93e367dd11f6\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ec4d970b597ee5e17b0d8d73b7875197ce9a04d4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T18:47:01+00:00",
      "cve": "CVE-2024-40957",
      "id": "CVE-2024-40957",
      "initial_release_date": "2024-07-12T00:00:00+00:00",
      "product_status:fixed": "279",
      "product_status:known_affected": "64",
      "product_status:known_not_affected": "48",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: seg6: fix parameter passing when calling NF_HOOK() in End.DX4 and End.DX6 behaviors",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-40957.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-12T17:00:27Z",
      "cve": "CVE-2024-40957",
      "id": "CVE-2024-40957",
      "initial_release_date": "2024-07-16T02:34:18Z",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "361",
      "product_status:recommended": "384",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-40957",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-40957.json",
      "version": "90"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/af90e3d73dc45778767b2fb6e7edd57ebe34380d\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/ec4d970b597ee5e17b0d8d73b7875197ce9a04d4\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/d62df86c172033679d744f07d89e93e367dd11f6\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/561475d53aa7e4511ee7cdba8728ded81cf1db1c\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/9a3bc8d16e0aacd65c31aaf23a2bced3288a7779\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T21:58:21.536Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-40957\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T17:03:38.761289Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:22.423Z\"}}], \"cna\": {\"title\": \"seg6: fix parameter passing when calling NF_HOOK() in End.DX4 and End.DX6 behaviors\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:N - The crash is triggered by a received IPv6 packet whose destination matches a configured SRv6 End.DX4/End.DX6 SID, processed in the receive softirq path (`lwtunnel_input` \\u2192 `seg6_local_input_core`). No local access or account on the router is needed \\u2014 any host able to route a packet to the SID reaches the code.\\nAC:L - Once the target runs the affected (supported, documented) SRv6 + netfilter configuration, a single crafted packet deterministically dereferences NULL \\u2014 no race, no memory-layout dependence, no information the attacker must first gather. The required rpfilter/fib-check rule is the default in firewalld-based distros, and the `nf_hooks_lwtunnel` gate can even be flipped host-wide by any local unprivileged user via a user namespace.\\nPR:N - Packet processing happens before any authentication or authorization; the attacker needs no credentials or privileges on the target at all, only the ability to send a packet to the SID.\\nUI:N - The crash occurs entirely in the kernel\u0027s packet receive path with no action by any local user or administrator beyond the pre-existing configuration.\\nS:U - The NULL dereference occurs in the kernel of the machine receiving the packet, and the impact is confined to that same kernel/security authority \\u2014 no VM, IOMMU, or sandbox boundary is crossed.\\nC:N - The fault is a read of a fixed small offset (0x90) from a NULL pointer, which is unmapped; nothing is returned to the attacker and no kernel memory contents are exposed.\\nI:N - No memory is written and no data is modified \\u2014 the bug is a read-only dereference of a NULL device pointer, which cannot be leveraged into a write or control-flow primitive.\\nA:H - The NULL dereference happens in softirq/interrupt context during NAPI receive processing, producing a kernel oops that panics or renders the router unusable, and it can be re-triggered by every subsequent packet.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"7a3f5b0de3647c854e34269c3332d7a1e902901a\", \"lessThan\": \"af90e3d73dc45778767b2fb6e7edd57ebe34380d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7a3f5b0de3647c854e34269c3332d7a1e902901a\", \"lessThan\": \"ec4d970b597ee5e17b0d8d73b7875197ce9a04d4\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7a3f5b0de3647c854e34269c3332d7a1e902901a\", \"lessThan\": \"d62df86c172033679d744f07d89e93e367dd11f6\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7a3f5b0de3647c854e34269c3332d7a1e902901a\", \"lessThan\": \"561475d53aa7e4511ee7cdba8728ded81cf1db1c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"7a3f5b0de3647c854e34269c3332d7a1e902901a\", \"lessThan\": \"9a3bc8d16e0aacd65c31aaf23a2bced3288a7779\", \"versionType\": \"git\"}], \"programFiles\": [\"net/ipv6/seg6_local.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.15\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.15\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.162\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.96\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.36\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9.7\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/ipv6/seg6_local.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/af90e3d73dc45778767b2fb6e7edd57ebe34380d\"}, {\"url\": \"https://git.kernel.org/stable/c/ec4d970b597ee5e17b0d8d73b7875197ce9a04d4\"}, {\"url\": \"https://git.kernel.org/stable/c/d62df86c172033679d744f07d89e93e367dd11f6\"}, {\"url\": \"https://git.kernel.org/stable/c/561475d53aa7e4511ee7cdba8728ded81cf1db1c\"}, {\"url\": \"https://git.kernel.org/stable/c/9a3bc8d16e0aacd65c31aaf23a2bced3288a7779\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nseg6: fix parameter passing when calling NF_HOOK() in End.DX4 and End.DX6 behaviors\\n\\ninput_action_end_dx4() and input_action_end_dx6() are called NF_HOOK() for\\nPREROUTING hook, in PREROUTING hook, we should passing a valid indev,\\nand a NULL outdev to NF_HOOK(), otherwise may trigger a NULL pointer\\ndereference, as below:\\n\\n    [74830.647293] BUG: kernel NULL pointer dereference, address: 0000000000000090\\n    [74830.655633] #PF: supervisor read access in kernel mode\\n    [74830.657888] #PF: error_code(0x0000) - not-present page\\n    [74830.659500] PGD 0 P4D 0\\n    [74830.660450] Oops: 0000 [#1] PREEMPT SMP PTI\\n    ...\\n    [74830.664953] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011\\n    [74830.666569] RIP: 0010:rpfilter_mt+0x44/0x15e [ipt_rpfilter]\\n    ...\\n    [74830.689725] Call Trace:\\n    [74830.690402]  \u003cIRQ\u003e\\n    [74830.690953]  ? show_trace_log_lvl+0x1c4/0x2df\\n    [74830.692020]  ? show_trace_log_lvl+0x1c4/0x2df\\n    [74830.693095]  ? ipt_do_table+0x286/0x710 [ip_tables]\\n    [74830.694275]  ? __die_body.cold+0x8/0xd\\n    [74830.695205]  ? page_fault_oops+0xac/0x140\\n    [74830.696244]  ? exc_page_fault+0x62/0x150\\n    [74830.697225]  ? asm_exc_page_fault+0x22/0x30\\n    [74830.698344]  ? rpfilter_mt+0x44/0x15e [ipt_rpfilter]\\n    [74830.699540]  ipt_do_table+0x286/0x710 [ip_tables]\\n    [74830.700758]  ? ip6_route_input+0x19d/0x240\\n    [74830.701752]  nf_hook_slow+0x3f/0xb0\\n    [74830.702678]  input_action_end_dx4+0x19b/0x1e0\\n    [74830.703735]  ? input_action_end_t+0xe0/0xe0\\n    [74830.704734]  seg6_local_input_core+0x2d/0x60\\n    [74830.705782]  lwtunnel_input+0x5b/0xb0\\n    [74830.706690]  __netif_receive_skb_one_core+0x63/0xa0\\n    [74830.707825]  process_backlog+0x99/0x140\\n    [74830.709538]  __napi_poll+0x2c/0x160\\n    [74830.710673]  net_rx_action+0x296/0x350\\n    [74830.711860]  __do_softirq+0xcb/0x2ac\\n    [74830.713049]  do_softirq+0x63/0x90\\n\\ninput_action_end_dx4() passing a NULL indev to NF_HOOK(), and finally\\ntrigger a NULL dereference in rpfilter_mt()-\u003erpfilter_is_loopback():\\n\\n    static bool\\n    rpfilter_is_loopback(const struct sk_buff *skb,\\n          \\t       const struct net_device *in)\\n    {\\n            // in is NULL\\n            return skb-\u003epkt_type == PACKET_LOOPBACK ||\\n          \\t in-\u003eflags \u0026 IFF_LOOPBACK;\\n    }\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.162\", \"versionStartIncluding\": \"5.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.96\", \"versionStartIncluding\": \"5.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.36\", \"versionStartIncluding\": \"5.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9.7\", \"versionStartIncluding\": \"5.15\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10\", \"versionStartIncluding\": \"5.15\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:34:16.301Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-40957\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:34:16.301Z\", \"dateReserved\": \"2024-07-12T12:17:45.593Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-07-12T12:31:59.747Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.