GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-46783 (GCVE-0-2024-46783)

Vulnerability from cvelistv5 – Published: 2024-09-18 07:12 – Updated: 2026-05-12 11:57
VLAI
Title
tcp_bpf: fix return value of tcp_bpf_sendmsg()
Summary
In the Linux kernel, the following vulnerability has been resolved: tcp_bpf: fix return value of tcp_bpf_sendmsg() When we cork messages in psock->cork, the last message triggers the flushing will result in sending a sk_msg larger than the current message size. In this case, in tcp_bpf_send_verdict(), 'copied' becomes negative at least in the following case: 468 case __SK_DROP: 469 default: 470 sk_msg_free_partial(sk, msg, tosend); 471 sk_msg_apply_bytes(psock, tosend); 472 *copied -= (tosend + delta); // <==== HERE 473 return -EACCES; Therefore, it could lead to the following BUG with a proper value of 'copied' (thanks to syzbot). We should not use negative 'copied' as a return value here. ------------[ cut here ]------------ kernel BUG at net/socket.c:733! Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP Modules linked in: CPU: 0 UID: 0 PID: 3265 Comm: syz-executor510 Not tainted 6.11.0-rc3-syzkaller-00060-gd07b43284ab3 #0 Hardware name: linux,dummy-virt (DT) pstate: 61400009 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) pc : sock_sendmsg_nosec net/socket.c:733 [inline] pc : sock_sendmsg_nosec net/socket.c:728 [inline] pc : __sock_sendmsg+0x5c/0x60 net/socket.c:745 lr : sock_sendmsg_nosec net/socket.c:730 [inline] lr : __sock_sendmsg+0x54/0x60 net/socket.c:745 sp : ffff800088ea3b30 x29: ffff800088ea3b30 x28: fbf00000062bc900 x27: 0000000000000000 x26: ffff800088ea3bc0 x25: ffff800088ea3bc0 x24: 0000000000000000 x23: f9f00000048dc000 x22: 0000000000000000 x21: ffff800088ea3d90 x20: f9f00000048dc000 x19: ffff800088ea3d90 x18: 0000000000000001 x17: 0000000000000000 x16: 0000000000000000 x15: 000000002002ffaf x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000000 x10: ffff8000815849c0 x9 : ffff8000815b49c0 x8 : 0000000000000000 x7 : 000000000000003f x6 : 0000000000000000 x5 : 00000000000007e0 x4 : fff07ffffd239000 x3 : fbf00000062bc900 x2 : 0000000000000000 x1 : 0000000000000000 x0 : 00000000fffffdef Call trace: sock_sendmsg_nosec net/socket.c:733 [inline] __sock_sendmsg+0x5c/0x60 net/socket.c:745 ____sys_sendmsg+0x274/0x2ac net/socket.c:2597 ___sys_sendmsg+0xac/0x100 net/socket.c:2651 __sys_sendmsg+0x84/0xe0 net/socket.c:2680 __do_sys_sendmsg net/socket.c:2689 [inline] __se_sys_sendmsg net/socket.c:2687 [inline] __arm64_sys_sendmsg+0x24/0x30 net/socket.c:2687 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x48/0x110 arch/arm64/kernel/syscall.c:49 el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:132 do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:151 el0_svc+0x34/0xec arch/arm64/kernel/entry-common.c:712 el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598 Code: f9404463 d63f0060 3108441f 54fffe81 (d4210000) ---[ end trace 0000000000000000 ]---
Severity
No CVSS data available.
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-29 14:29 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 4f738adba30a7cfc006f605707e7aee847ffefa0 , < 6f9fdf5806cced888c43512bccbdf7fefd50f510 (git)
Affected: 4f738adba30a7cfc006f605707e7aee847ffefa0 , < 3efe53eb221a38e207c1e3f81c51e4ca057d50c2 (git)
Affected: 4f738adba30a7cfc006f605707e7aee847ffefa0 , < 78bb38d9c5a311c5f8bdef7c9557d7d81ca30e4a (git)
Affected: 4f738adba30a7cfc006f605707e7aee847ffefa0 , < 810a4e7d92dea4074cb04c25758320909d752193 (git)
Affected: 4f738adba30a7cfc006f605707e7aee847ffefa0 , < c8219a27fa43a2cbf99f5176f6dddfe73e7a24ae (git)
Affected: 4f738adba30a7cfc006f605707e7aee847ffefa0 , < 126d72b726c4cf1119f3a7fe413a78d341c3fea9 (git)
Affected: 4f738adba30a7cfc006f605707e7aee847ffefa0 , < fe1910f9337bd46a9343967b547ccab26b4b2c6e (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.17
Unaffected: 0 , < 4.17 (semver)
Unaffected: 5.4.284 , ≤ 5.4.* (semver)
Unaffected: 5.10.226 , ≤ 5.10.* (semver)
Unaffected: 5.15.167 , ≤ 5.15.* (semver)
Unaffected: 6.1.110 , ≤ 6.1.* (semver)
Unaffected: 6.6.51 , ≤ 6.6.* (semver)
Unaffected: 6.10.10 , ≤ 6.10.* (semver)
Unaffected: 6.11 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Siemens RUGGEDCOM RST2428P Affected: 0 , < V3.2 (custom)
guessed Create a notification for this product.
Siemens SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family Affected: 0 , < V3.2 (custom)
guessed Create a notification for this product.
Siemens SCALANCE XCM-/XRM-/XCH-/XRH-300 family Affected: 0 , < V3.2 (custom)
guessed Create a notification for this product.
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem Affected: 0 , < * (custom)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-46783",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-29T14:29:59.160997Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-29T14:30:13.589Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:18:29.717Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM RST2428P",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XCM-/XRM-/XCH-/XRH-300 family",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T11:57:59.612Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-355557.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/tcp_bpf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6f9fdf5806cced888c43512bccbdf7fefd50f510",
              "status": "affected",
              "version": "4f738adba30a7cfc006f605707e7aee847ffefa0",
              "versionType": "git"
            },
            {
              "lessThan": "3efe53eb221a38e207c1e3f81c51e4ca057d50c2",
              "status": "affected",
              "version": "4f738adba30a7cfc006f605707e7aee847ffefa0",
              "versionType": "git"
            },
            {
              "lessThan": "78bb38d9c5a311c5f8bdef7c9557d7d81ca30e4a",
              "status": "affected",
              "version": "4f738adba30a7cfc006f605707e7aee847ffefa0",
              "versionType": "git"
            },
            {
              "lessThan": "810a4e7d92dea4074cb04c25758320909d752193",
              "status": "affected",
              "version": "4f738adba30a7cfc006f605707e7aee847ffefa0",
              "versionType": "git"
            },
            {
              "lessThan": "c8219a27fa43a2cbf99f5176f6dddfe73e7a24ae",
              "status": "affected",
              "version": "4f738adba30a7cfc006f605707e7aee847ffefa0",
              "versionType": "git"
            },
            {
              "lessThan": "126d72b726c4cf1119f3a7fe413a78d341c3fea9",
              "status": "affected",
              "version": "4f738adba30a7cfc006f605707e7aee847ffefa0",
              "versionType": "git"
            },
            {
              "lessThan": "fe1910f9337bd46a9343967b547ccab26b4b2c6e",
              "status": "affected",
              "version": "4f738adba30a7cfc006f605707e7aee847ffefa0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/tcp_bpf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.17"
            },
            {
              "lessThan": "4.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.284",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.226",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.167",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.284",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.226",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.167",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.110",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.51",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.10",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp_bpf: fix return value of tcp_bpf_sendmsg()\n\nWhen we cork messages in psock-\u003ecork, the last message triggers the\nflushing will result in sending a sk_msg larger than the current\nmessage size. In this case, in tcp_bpf_send_verdict(), \u0027copied\u0027 becomes\nnegative at least in the following case:\n\n468         case __SK_DROP:\n469         default:\n470                 sk_msg_free_partial(sk, msg, tosend);\n471                 sk_msg_apply_bytes(psock, tosend);\n472                 *copied -= (tosend + delta); // \u003c==== HERE\n473                 return -EACCES;\n\nTherefore, it could lead to the following BUG with a proper value of\n\u0027copied\u0027 (thanks to syzbot). We should not use negative \u0027copied\u0027 as a\nreturn value here.\n\n  ------------[ cut here ]------------\n  kernel BUG at net/socket.c:733!\n  Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP\n  Modules linked in:\n  CPU: 0 UID: 0 PID: 3265 Comm: syz-executor510 Not tainted 6.11.0-rc3-syzkaller-00060-gd07b43284ab3 #0\n  Hardware name: linux,dummy-virt (DT)\n  pstate: 61400009 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)\n  pc : sock_sendmsg_nosec net/socket.c:733 [inline]\n  pc : sock_sendmsg_nosec net/socket.c:728 [inline]\n  pc : __sock_sendmsg+0x5c/0x60 net/socket.c:745\n  lr : sock_sendmsg_nosec net/socket.c:730 [inline]\n  lr : __sock_sendmsg+0x54/0x60 net/socket.c:745\n  sp : ffff800088ea3b30\n  x29: ffff800088ea3b30 x28: fbf00000062bc900 x27: 0000000000000000\n  x26: ffff800088ea3bc0 x25: ffff800088ea3bc0 x24: 0000000000000000\n  x23: f9f00000048dc000 x22: 0000000000000000 x21: ffff800088ea3d90\n  x20: f9f00000048dc000 x19: ffff800088ea3d90 x18: 0000000000000001\n  x17: 0000000000000000 x16: 0000000000000000 x15: 000000002002ffaf\n  x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000\n  x11: 0000000000000000 x10: ffff8000815849c0 x9 : ffff8000815b49c0\n  x8 : 0000000000000000 x7 : 000000000000003f x6 : 0000000000000000\n  x5 : 00000000000007e0 x4 : fff07ffffd239000 x3 : fbf00000062bc900\n  x2 : 0000000000000000 x1 : 0000000000000000 x0 : 00000000fffffdef\n  Call trace:\n   sock_sendmsg_nosec net/socket.c:733 [inline]\n   __sock_sendmsg+0x5c/0x60 net/socket.c:745\n   ____sys_sendmsg+0x274/0x2ac net/socket.c:2597\n   ___sys_sendmsg+0xac/0x100 net/socket.c:2651\n   __sys_sendmsg+0x84/0xe0 net/socket.c:2680\n   __do_sys_sendmsg net/socket.c:2689 [inline]\n   __se_sys_sendmsg net/socket.c:2687 [inline]\n   __arm64_sys_sendmsg+0x24/0x30 net/socket.c:2687\n   __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]\n   invoke_syscall+0x48/0x110 arch/arm64/kernel/syscall.c:49\n   el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:132\n   do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:151\n   el0_svc+0x34/0xec arch/arm64/kernel/entry-common.c:712\n   el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:730\n   el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598\n  Code: f9404463 d63f0060 3108441f 54fffe81 (d4210000)\n  ---[ end trace 0000000000000000 ]---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:36:23.854Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6f9fdf5806cced888c43512bccbdf7fefd50f510"
        },
        {
          "url": "https://git.kernel.org/stable/c/3efe53eb221a38e207c1e3f81c51e4ca057d50c2"
        },
        {
          "url": "https://git.kernel.org/stable/c/78bb38d9c5a311c5f8bdef7c9557d7d81ca30e4a"
        },
        {
          "url": "https://git.kernel.org/stable/c/810a4e7d92dea4074cb04c25758320909d752193"
        },
        {
          "url": "https://git.kernel.org/stable/c/c8219a27fa43a2cbf99f5176f6dddfe73e7a24ae"
        },
        {
          "url": "https://git.kernel.org/stable/c/126d72b726c4cf1119f3a7fe413a78d341c3fea9"
        },
        {
          "url": "https://git.kernel.org/stable/c/fe1910f9337bd46a9343967b547ccab26b4b2c6e"
        }
      ],
      "title": "tcp_bpf: fix return value of tcp_bpf_sendmsg()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-46783",
    "datePublished": "2024-09-18T07:12:39.573Z",
    "dateReserved": "2024-09-11T15:12:18.276Z",
    "dateUpdated": "2026-05-12T11:57:59.612Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-46783",
      "date": "2026-09-16",
      "epss": "0.00231",
      "percentile": "0.14142"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.17\", \"versionEndExcluding\": \"5.4.284\", \"matchCriteriaId\": \"696176F3-9A41-4ABF-A284-5551C94F0B61\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.5\", \"versionEndExcluding\": \"5.10.226\", \"matchCriteriaId\": \"864FC17C-501A-4823-A643-6F35D65D8A97\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.11\", \"versionEndExcluding\": \"5.15.167\", \"matchCriteriaId\": \"043405A4-25FE-45D4-A7BB-2A0C3B7D17C1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.16\", \"versionEndExcluding\": \"6.1.110\", \"matchCriteriaId\": \"6B1A95FC-7E7E-428B-BB59-F76640C652AE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.2\", \"versionEndExcluding\": \"6.6.51\", \"matchCriteriaId\": \"E4529134-BAC4-4776-840B-304009E181A0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.10.10\", \"matchCriteriaId\": \"ACDEE48C-137A-4731-90D0-A675865E1BED\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"8B3CE743-2126-47A3-8B7C-822B502CF119\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"4DEB27E7-30AA-45CC-8934-B89263EF3551\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"E0005AEF-856E-47EB-BFE4-90C46899394D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc4:*:*:*:*:*:*\", \"matchCriteriaId\": \"39889A68-6D34-47A6-82FC-CD0BF23D6754\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc5:*:*:*:*:*:*\", \"matchCriteriaId\": \"B8383ABF-1457-401F-9B61-EE50F4C61F4F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc6:*:*:*:*:*:*\", \"matchCriteriaId\": \"B77A9280-37E6-49AD-B559-5B23A3B1DC3D\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntcp_bpf: fix return value of tcp_bpf_sendmsg()\\n\\nWhen we cork messages in psock-\u003ecork, the last message triggers the\\nflushing will result in sending a sk_msg larger than the current\\nmessage size. In this case, in tcp_bpf_send_verdict(), \u0027copied\u0027 becomes\\nnegative at least in the following case:\\n\\n468         case __SK_DROP:\\n469         default:\\n470                 sk_msg_free_partial(sk, msg, tosend);\\n471                 sk_msg_apply_bytes(psock, tosend);\\n472                 *copied -= (tosend + delta); // \u003c==== HERE\\n473                 return -EACCES;\\n\\nTherefore, it could lead to the following BUG with a proper value of\\n\u0027copied\u0027 (thanks to syzbot). We should not use negative \u0027copied\u0027 as a\\nreturn value here.\\n\\n  ------------[ cut here ]------------\\n  kernel BUG at net/socket.c:733!\\n  Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP\\n  Modules linked in:\\n  CPU: 0 UID: 0 PID: 3265 Comm: syz-executor510 Not tainted 6.11.0-rc3-syzkaller-00060-gd07b43284ab3 #0\\n  Hardware name: linux,dummy-virt (DT)\\n  pstate: 61400009 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)\\n  pc : sock_sendmsg_nosec net/socket.c:733 [inline]\\n  pc : sock_sendmsg_nosec net/socket.c:728 [inline]\\n  pc : __sock_sendmsg+0x5c/0x60 net/socket.c:745\\n  lr : sock_sendmsg_nosec net/socket.c:730 [inline]\\n  lr : __sock_sendmsg+0x54/0x60 net/socket.c:745\\n  sp : ffff800088ea3b30\\n  x29: ffff800088ea3b30 x28: fbf00000062bc900 x27: 0000000000000000\\n  x26: ffff800088ea3bc0 x25: ffff800088ea3bc0 x24: 0000000000000000\\n  x23: f9f00000048dc000 x22: 0000000000000000 x21: ffff800088ea3d90\\n  x20: f9f00000048dc000 x19: ffff800088ea3d90 x18: 0000000000000001\\n  x17: 0000000000000000 x16: 0000000000000000 x15: 000000002002ffaf\\n  x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000\\n  x11: 0000000000000000 x10: ffff8000815849c0 x9 : ffff8000815b49c0\\n  x8 : 0000000000000000 x7 : 000000000000003f x6 : 0000000000000000\\n  x5 : 00000000000007e0 x4 : fff07ffffd239000 x3 : fbf00000062bc900\\n  x2 : 0000000000000000 x1 : 0000000000000000 x0 : 00000000fffffdef\\n  Call trace:\\n   sock_sendmsg_nosec net/socket.c:733 [inline]\\n   __sock_sendmsg+0x5c/0x60 net/socket.c:745\\n   ____sys_sendmsg+0x274/0x2ac net/socket.c:2597\\n   ___sys_sendmsg+0xac/0x100 net/socket.c:2651\\n   __sys_sendmsg+0x84/0xe0 net/socket.c:2680\\n   __do_sys_sendmsg net/socket.c:2689 [inline]\\n   __se_sys_sendmsg net/socket.c:2687 [inline]\\n   __arm64_sys_sendmsg+0x24/0x30 net/socket.c:2687\\n   __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]\\n   invoke_syscall+0x48/0x110 arch/arm64/kernel/syscall.c:49\\n   el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:132\\n   do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:151\\n   el0_svc+0x34/0xec arch/arm64/kernel/entry-common.c:712\\n   el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:730\\n   el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598\\n  Code: f9404463 d63f0060 3108441f 54fffe81 (d4210000)\\n  ---[ end trace 0000000000000000 ]---\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: tcp_bpf: se corrige el valor de retorno de tcp_bpf_sendmsg() Cuando copiamos mensajes en psock-\u0026gt;cork, el \\u00faltimo mensaje que activa el vaciado dar\\u00e1 como resultado el env\\u00edo de un sk_msg m\\u00e1s grande que el tama\\u00f1o del mensaje actual. En este caso, en tcp_bpf_send_verdict(), \u0027copied\u0027 se vuelve negativo al menos en el siguiente caso: 468 case __SK_DROP: 469 default: 470 sk_msg_free_partial(sk, msg, tosend); 471 sk_msg_apply_bytes(psock, tosend); 472 *copied -= (tosend + delta); // \u0026lt;==== HERE 473 return -EACCES; Por lo tanto, podr\\u00eda generar el siguiente ERROR con un valor adecuado de \u0027copied\u0027 (gracias a syzbot). No deber\\u00edamos usar \u0027copied\u0027 negativo como valor de retorno aqu\\u00ed. ------------[ corte aqu\\u00ed ]------------ \\u00a1ERROR del kernel en net/socket.c:733! Error interno: Oops - BUG: 00000000f2000800 [#1] PREEMPT M\\u00f3dulos SMP vinculados en: CPU: 0 UID: 0 PID: 3265 Comm: syz-executor510 No contaminado 6.11.0-rc3-syzkaller-00060-gd07b43284ab3 #0 Nombre del hardware: linux,dummy-virt (DT) pstate: 61400009 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) pc : sock_sendmsg_nosec net/socket.c:733 [en l\\u00ednea] pc : sock_sendmsg_nosec net/socket.c:728 [en l\\u00ednea] pc : __sock_sendmsg+0x5c/0x60 net/socket.c:745 lr : sock_sendmsg_nosec net/socket.c:730 [en l\\u00ednea] lr : __sock_sendmsg+0x54/0x60 net/socket.c:745 sp : ffff800088ea3b30 x29: ffff800088ea3b30 x28: fbf00000062bc900 x27: 0000000000000000 x26: ffff800088ea3bc0 x25: ffff800088ea3bc0 x24: 0000000000000000 x23: f9f0000048dc000 x22: 0000000000000000 x21: ffff800088ea3d90 x20: f9f00000048dc000 x19: ffff800088ea3d90 x18: 0000000000000001 x17: 0000000000000000 x16: 0000000000000000 x15: 000000002002ffaf x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000000 x10: ffff8000815849c0 x9 : ffff8000815b49c0 x8 : 0000000000000000 x7 : 0000000000000003f x6 : 0000000000000000 x5 : 00000000000007e0 x4 : fff07ffffd239000 x3 : fbf00000062bc900 x2 : 000000000000000 x1 : 000000000000000 x0 : 00000000fffffdef Rastreo de llamadas: sock_sendmsg_nosec net/socket.c:733 [en l\\u00ednea] __sock_sendmsg+0x5c/0x60 net/socket.c:745 ____sys_sendmsg+0x274/0x2ac net/socket.c:2597 ___sys_sendmsg+0xac/0x100 net/socket.c:2651 __sys_sendmsg+0x84/0xe0 net/socket.c:2680 __do_sys_sendmsg net/socket.c:2689 [en l\\u00ednea] __se_sys_sendmsg net/socket.c:2687 [en l\\u00ednea] __arm64_sys_sendmsg+0x24/0x30 net/socket.c:2687 __invoke_syscall arch/arm64/kernel/syscall.c:35 [en l\\u00ednea] anybody_syscall+0x48/0x110 arch/arm64/kernel/syscall.c:49 el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:132 do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:151 el0_svc+0x34/0xec arch/arm64/kernel/entry-common.c:712 el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598 C\\u00f3digo: f9404463 d63f0060 3108441f 54fffe81 (d4210000) ---[ fin de seguimiento 0000000000000000 ]---\"}]",
      "id": "CVE-2024-46783",
      "lastModified": "2024-11-20T15:47:35.273",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-09-18T08:15:05.630",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/126d72b726c4cf1119f3a7fe413a78d341c3fea9\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/3efe53eb221a38e207c1e3f81c51e4ca057d50c2\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/6f9fdf5806cced888c43512bccbdf7fefd50f510\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/78bb38d9c5a311c5f8bdef7c9557d7d81ca30e4a\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/810a4e7d92dea4074cb04c25758320909d752193\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/c8219a27fa43a2cbf99f5176f6dddfe73e7a24ae\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/fe1910f9337bd46a9343967b547ccab26b4b2c6e\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-noinfo\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-46783\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-09-18T08:15:05.630\",\"lastModified\":\"2026-06-17T07:55:55.447\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntcp_bpf: fix return value of tcp_bpf_sendmsg()\\n\\nWhen we cork messages in psock-\u003ecork, the last message triggers the\\nflushing will result in sending a sk_msg larger than the current\\nmessage size. In this case, in tcp_bpf_send_verdict(), \u0027copied\u0027 becomes\\nnegative at least in the following case:\\n\\n468         case __SK_DROP:\\n469         default:\\n470                 sk_msg_free_partial(sk, msg, tosend);\\n471                 sk_msg_apply_bytes(psock, tosend);\\n472                 *copied -= (tosend + delta); // \u003c==== HERE\\n473                 return -EACCES;\\n\\nTherefore, it could lead to the following BUG with a proper value of\\n\u0027copied\u0027 (thanks to syzbot). We should not use negative \u0027copied\u0027 as a\\nreturn value here.\\n\\n  ------------[ cut here ]------------\\n  kernel BUG at net/socket.c:733!\\n  Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP\\n  Modules linked in:\\n  CPU: 0 UID: 0 PID: 3265 Comm: syz-executor510 Not tainted 6.11.0-rc3-syzkaller-00060-gd07b43284ab3 #0\\n  Hardware name: linux,dummy-virt (DT)\\n  pstate: 61400009 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)\\n  pc : sock_sendmsg_nosec net/socket.c:733 [inline]\\n  pc : sock_sendmsg_nosec net/socket.c:728 [inline]\\n  pc : __sock_sendmsg+0x5c/0x60 net/socket.c:745\\n  lr : sock_sendmsg_nosec net/socket.c:730 [inline]\\n  lr : __sock_sendmsg+0x54/0x60 net/socket.c:745\\n  sp : ffff800088ea3b30\\n  x29: ffff800088ea3b30 x28: fbf00000062bc900 x27: 0000000000000000\\n  x26: ffff800088ea3bc0 x25: ffff800088ea3bc0 x24: 0000000000000000\\n  x23: f9f00000048dc000 x22: 0000000000000000 x21: ffff800088ea3d90\\n  x20: f9f00000048dc000 x19: ffff800088ea3d90 x18: 0000000000000001\\n  x17: 0000000000000000 x16: 0000000000000000 x15: 000000002002ffaf\\n  x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000\\n  x11: 0000000000000000 x10: ffff8000815849c0 x9 : ffff8000815b49c0\\n  x8 : 0000000000000000 x7 : 000000000000003f x6 : 0000000000000000\\n  x5 : 00000000000007e0 x4 : fff07ffffd239000 x3 : fbf00000062bc900\\n  x2 : 0000000000000000 x1 : 0000000000000000 x0 : 00000000fffffdef\\n  Call trace:\\n   sock_sendmsg_nosec net/socket.c:733 [inline]\\n   __sock_sendmsg+0x5c/0x60 net/socket.c:745\\n   ____sys_sendmsg+0x274/0x2ac net/socket.c:2597\\n   ___sys_sendmsg+0xac/0x100 net/socket.c:2651\\n   __sys_sendmsg+0x84/0xe0 net/socket.c:2680\\n   __do_sys_sendmsg net/socket.c:2689 [inline]\\n   __se_sys_sendmsg net/socket.c:2687 [inline]\\n   __arm64_sys_sendmsg+0x24/0x30 net/socket.c:2687\\n   __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]\\n   invoke_syscall+0x48/0x110 arch/arm64/kernel/syscall.c:49\\n   el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:132\\n   do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:151\\n   el0_svc+0x34/0xec arch/arm64/kernel/entry-common.c:712\\n   el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:730\\n   el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598\\n  Code: f9404463 d63f0060 3108441f 54fffe81 (d4210000)\\n  ---[ end trace 0000000000000000 ]---\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: tcp_bpf: se corrige el valor de retorno de tcp_bpf_sendmsg() Cuando copiamos mensajes en psock-\u0026gt;cork, el \u00faltimo mensaje que activa el vaciado dar\u00e1 como resultado el env\u00edo de un sk_msg m\u00e1s grande que el tama\u00f1o del mensaje actual. En este caso, en tcp_bpf_send_verdict(), \u0027copied\u0027 se vuelve negativo al menos en el siguiente caso: 468 case __SK_DROP: 469 default: 470 sk_msg_free_partial(sk, msg, tosend); 471 sk_msg_apply_bytes(psock, tosend); 472 *copied -= (tosend + delta); // \u0026lt;==== HERE 473 return -EACCES; Por lo tanto, podr\u00eda generar el siguiente ERROR con un valor adecuado de \u0027copied\u0027 (gracias a syzbot). No deber\u00edamos usar \u0027copied\u0027 negativo como valor de retorno aqu\u00ed. ------------[ corte aqu\u00ed ]------------ \u00a1ERROR del kernel en net/socket.c:733! Error interno: Oops - BUG: 00000000f2000800 [#1] PREEMPT M\u00f3dulos SMP vinculados en: CPU: 0 UID: 0 PID: 3265 Comm: syz-executor510 No contaminado 6.11.0-rc3-syzkaller-00060-gd07b43284ab3 #0 Nombre del hardware: linux,dummy-virt (DT) pstate: 61400009 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) pc : sock_sendmsg_nosec net/socket.c:733 [en l\u00ednea] pc : sock_sendmsg_nosec net/socket.c:728 [en l\u00ednea] pc : __sock_sendmsg+0x5c/0x60 net/socket.c:745 lr : sock_sendmsg_nosec net/socket.c:730 [en l\u00ednea] lr : __sock_sendmsg+0x54/0x60 net/socket.c:745 sp : ffff800088ea3b30 x29: ffff800088ea3b30 x28: fbf00000062bc900 x27: 0000000000000000 x26: ffff800088ea3bc0 x25: ffff800088ea3bc0 x24: 0000000000000000 x23: f9f0000048dc000 x22: 0000000000000000 x21: ffff800088ea3d90 x20: f9f00000048dc000 x19: ffff800088ea3d90 x18: 0000000000000001 x17: 0000000000000000 x16: 0000000000000000 x15: 000000002002ffaf x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000000 x10: ffff8000815849c0 x9 : ffff8000815b49c0 x8 : 0000000000000000 x7 : 0000000000000003f x6 : 0000000000000000 x5 : 00000000000007e0 x4 : fff07ffffd239000 x3 : fbf00000062bc900 x2 : 000000000000000 x1 : 000000000000000 x0 : 00000000fffffdef Rastreo de llamadas: sock_sendmsg_nosec net/socket.c:733 [en l\u00ednea] __sock_sendmsg+0x5c/0x60 net/socket.c:745 ____sys_sendmsg+0x274/0x2ac net/socket.c:2597 ___sys_sendmsg+0xac/0x100 net/socket.c:2651 __sys_sendmsg+0x84/0xe0 net/socket.c:2680 __do_sys_sendmsg net/socket.c:2689 [en l\u00ednea] __se_sys_sendmsg net/socket.c:2687 [en l\u00ednea] __arm64_sys_sendmsg+0x24/0x30 net/socket.c:2687 __invoke_syscall arch/arm64/kernel/syscall.c:35 [en l\u00ednea] anybody_syscall+0x48/0x110 arch/arm64/kernel/syscall.c:49 el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:132 do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:151 el0_svc+0x34/0xec arch/arm64/kernel/entry-common.c:712 el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598 C\u00f3digo: f9404463 d63f0060 3108441f 54fffe81 (d4210000) ---[ fin de seguimiento 0000000000000000 ]---\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/ipv4/tcp_bpf.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4f738adba30a7cfc006f605707e7aee847ffefa0\",\"lessThan\":\"6f9fdf5806cced888c43512bccbdf7fefd50f510\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4f738adba30a7cfc006f605707e7aee847ffefa0\",\"lessThan\":\"3efe53eb221a38e207c1e3f81c51e4ca057d50c2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4f738adba30a7cfc006f605707e7aee847ffefa0\",\"lessThan\":\"78bb38d9c5a311c5f8bdef7c9557d7d81ca30e4a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4f738adba30a7cfc006f605707e7aee847ffefa0\",\"lessThan\":\"810a4e7d92dea4074cb04c25758320909d752193\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4f738adba30a7cfc006f605707e7aee847ffefa0\",\"lessThan\":\"c8219a27fa43a2cbf99f5176f6dddfe73e7a24ae\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4f738adba30a7cfc006f605707e7aee847ffefa0\",\"lessThan\":\"126d72b726c4cf1119f3a7fe413a78d341c3fea9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4f738adba30a7cfc006f605707e7aee847ffefa0\",\"lessThan\":\"fe1910f9337bd46a9343967b547ccab26b4b2c6e\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/ipv4/tcp_bpf.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.17\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.17\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.284\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.226\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.167\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.110\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.51\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10.10\",\"lessThanOrEqual\":\"6.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]},{\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\",\"affectedData\":[{\"vendor\":\"Siemens\",\"product\":\"RUGGEDCOM RST2428P\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"V3.2\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"V3.2\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SCALANCE XCM-/XRM-/XCH-/XRH-300 family\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"V3.2\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-29T14:29:59.160997Z\",\"id\":\"CVE-2024-46783\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.17\",\"versionEndExcluding\":\"5.4.284\",\"matchCriteriaId\":\"696176F3-9A41-4ABF-A284-5551C94F0B61\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.226\",\"matchCriteriaId\":\"864FC17C-501A-4823-A643-6F35D65D8A97\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.167\",\"matchCriteriaId\":\"043405A4-25FE-45D4-A7BB-2A0C3B7D17C1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.110\",\"matchCriteriaId\":\"6B1A95FC-7E7E-428B-BB59-F76640C652AE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.51\",\"matchCriteriaId\":\"E4529134-BAC4-4776-840B-304009E181A0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.10.10\",\"matchCriteriaId\":\"ACDEE48C-137A-4731-90D0-A675865E1BED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"8B3CE743-2126-47A3-8B7C-822B502CF119\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4DEB27E7-30AA-45CC-8934-B89263EF3551\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"E0005AEF-856E-47EB-BFE4-90C46899394D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"39889A68-6D34-47A6-82FC-CD0BF23D6754\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"B8383ABF-1457-401F-9B61-EE50F4C61F4F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"B77A9280-37E6-49AD-B559-5B23A3B1DC3D\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/126d72b726c4cf1119f3a7fe413a78d341c3fea9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3efe53eb221a38e207c1e3f81c51e4ca057d50c2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6f9fdf5806cced888c43512bccbdf7fefd50f510\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/78bb38d9c5a311c5f8bdef7c9557d7d81ca30e4a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/810a4e7d92dea4074cb04c25758320909d752193\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c8219a27fa43a2cbf99f5176f6dddfe73e7a24ae\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fe1910f9337bd46a9343967b547ccab26b4b2c6e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-265688.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\"},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-355557.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-13T09:15:34+00:00",
      "cve": "CVE-2024-46783",
      "id": "CVE-2024-46783",
      "initial_release_date": "2024-09-18T00:00:00+00:00",
      "product_status:fixed": "305",
      "product_status:known_affected": "112",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: tcp_bpf: fix return value of tcp_bpf_sendmsg()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-46783.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-12T16:58:28Z",
      "cve": "CVE-2024-46783",
      "id": "CVE-2024-46783",
      "initial_release_date": "2024-09-19T03:09:59Z",
      "product_status:known_affected": "520",
      "product_status:known_not_affected": "131",
      "product_status:recommended": "753",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-46783",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-46783.json",
      "version": "86"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-46783\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-29T14:29:59.160997Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-29T14:30:03.461Z\"}}], \"cna\": {\"title\": \"tcp_bpf: fix return value of tcp_bpf_sendmsg()\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4f738adba30a\", \"lessThan\": \"6f9fdf5806cc\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4f738adba30a\", \"lessThan\": \"3efe53eb221a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4f738adba30a\", \"lessThan\": \"78bb38d9c5a3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4f738adba30a\", \"lessThan\": \"810a4e7d92de\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4f738adba30a\", \"lessThan\": \"c8219a27fa43\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4f738adba30a\", \"lessThan\": \"126d72b726c4\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4f738adba30a\", \"lessThan\": \"fe1910f9337b\", \"versionType\": \"git\"}], \"programFiles\": [\"net/ipv4/tcp_bpf.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.17\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.17\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.4.284\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.226\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.167\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.110\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.51\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.10\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/ipv4/tcp_bpf.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/6f9fdf5806cced888c43512bccbdf7fefd50f510\"}, {\"url\": \"https://git.kernel.org/stable/c/3efe53eb221a38e207c1e3f81c51e4ca057d50c2\"}, {\"url\": \"https://git.kernel.org/stable/c/78bb38d9c5a311c5f8bdef7c9557d7d81ca30e4a\"}, {\"url\": \"https://git.kernel.org/stable/c/810a4e7d92dea4074cb04c25758320909d752193\"}, {\"url\": \"https://git.kernel.org/stable/c/c8219a27fa43a2cbf99f5176f6dddfe73e7a24ae\"}, {\"url\": \"https://git.kernel.org/stable/c/126d72b726c4cf1119f3a7fe413a78d341c3fea9\"}, {\"url\": \"https://git.kernel.org/stable/c/fe1910f9337bd46a9343967b547ccab26b4b2c6e\"}], \"x_generator\": {\"engine\": \"bippy-9e1c9544281a\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntcp_bpf: fix return value of tcp_bpf_sendmsg()\\n\\nWhen we cork messages in psock-\u003ecork, the last message triggers the\\nflushing will result in sending a sk_msg larger than the current\\nmessage size. In this case, in tcp_bpf_send_verdict(), \u0027copied\u0027 becomes\\nnegative at least in the following case:\\n\\n468         case __SK_DROP:\\n469         default:\\n470                 sk_msg_free_partial(sk, msg, tosend);\\n471                 sk_msg_apply_bytes(psock, tosend);\\n472                 *copied -= (tosend + delta); // \u003c==== HERE\\n473                 return -EACCES;\\n\\nTherefore, it could lead to the following BUG with a proper value of\\n\u0027copied\u0027 (thanks to syzbot). We should not use negative \u0027copied\u0027 as a\\nreturn value here.\\n\\n  ------------[ cut here ]------------\\n  kernel BUG at net/socket.c:733!\\n  Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP\\n  Modules linked in:\\n  CPU: 0 UID: 0 PID: 3265 Comm: syz-executor510 Not tainted 6.11.0-rc3-syzkaller-00060-gd07b43284ab3 #0\\n  Hardware name: linux,dummy-virt (DT)\\n  pstate: 61400009 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)\\n  pc : sock_sendmsg_nosec net/socket.c:733 [inline]\\n  pc : sock_sendmsg_nosec net/socket.c:728 [inline]\\n  pc : __sock_sendmsg+0x5c/0x60 net/socket.c:745\\n  lr : sock_sendmsg_nosec net/socket.c:730 [inline]\\n  lr : __sock_sendmsg+0x54/0x60 net/socket.c:745\\n  sp : ffff800088ea3b30\\n  x29: ffff800088ea3b30 x28: fbf00000062bc900 x27: 0000000000000000\\n  x26: ffff800088ea3bc0 x25: ffff800088ea3bc0 x24: 0000000000000000\\n  x23: f9f00000048dc000 x22: 0000000000000000 x21: ffff800088ea3d90\\n  x20: f9f00000048dc000 x19: ffff800088ea3d90 x18: 0000000000000001\\n  x17: 0000000000000000 x16: 0000000000000000 x15: 000000002002ffaf\\n  x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000\\n  x11: 0000000000000000 x10: ffff8000815849c0 x9 : ffff8000815b49c0\\n  x8 : 0000000000000000 x7 : 000000000000003f x6 : 0000000000000000\\n  x5 : 00000000000007e0 x4 : fff07ffffd239000 x3 : fbf00000062bc900\\n  x2 : 0000000000000000 x1 : 0000000000000000 x0 : 00000000fffffdef\\n  Call trace:\\n   sock_sendmsg_nosec net/socket.c:733 [inline]\\n   __sock_sendmsg+0x5c/0x60 net/socket.c:745\\n   ____sys_sendmsg+0x274/0x2ac net/socket.c:2597\\n   ___sys_sendmsg+0xac/0x100 net/socket.c:2651\\n   __sys_sendmsg+0x84/0xe0 net/socket.c:2680\\n   __do_sys_sendmsg net/socket.c:2689 [inline]\\n   __se_sys_sendmsg net/socket.c:2687 [inline]\\n   __arm64_sys_sendmsg+0x24/0x30 net/socket.c:2687\\n   __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]\\n   invoke_syscall+0x48/0x110 arch/arm64/kernel/syscall.c:49\\n   el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:132\\n   do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:151\\n   el0_svc+0x34/0xec arch/arm64/kernel/entry-common.c:712\\n   el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:730\\n   el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598\\n  Code: f9404463 d63f0060 3108441f 54fffe81 (d4210000)\\n  ---[ end trace 0000000000000000 ]---\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-11-05T09:46:33.608Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-46783\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-11-05T09:46:33.608Z\", \"dateReserved\": \"2024-09-11T15:12:18.276Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-09-18T07:12:39.573Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.