GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-49979 (GCVE-0-2024-49979)

Vulnerability from cvelistv5 – Published: 2024-10-21 18:02 – Updated: 2026-08-05 11:40
VLAI
Title
net: gso: fix tcp fraglist segmentation after pull from frag_list
Summary
In the Linux kernel, the following vulnerability has been resolved: net: gso: fix tcp fraglist segmentation after pull from frag_list Detect tcp gso fraglist skbs with corrupted geometry (see below) and pass these to skb_segment instead of skb_segment_list, as the first can segment them correctly. Valid SKB_GSO_FRAGLIST skbs - consist of two or more segments - the head_skb holds the protocol headers plus first gso_size - one or more frag_list skbs hold exactly one segment - all but the last must be gso_size Optional datapath hooks such as NAT and BPF (bpf_skb_pull_data) can modify these skbs, breaking these invariants. In extreme cases they pull all data into skb linear. For TCP, this causes a NULL ptr deref in __tcpv4_gso_segment_list_csum at tcp_hdr(seg->next). Detect invalid geometry due to pull, by checking head_skb size. Don't just drop, as this may blackhole a destination. Convert to be able to pass to regular skb_segment. Approach and description based on a patch by Willem de Bruijn.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-22 13:32 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: c2ea8cab368b9f25b5937a7f07ab1a66e90b8064 , < 75733986fcb0725c0033cde94764389e287b331e (git)
Affected: 1f2b859225eb8d1ec974214ce4a581f8c528ae57 , < e19201b0c67da5146eaac06fd3d44bd7945c3448 (git)
Affected: bee88cd5bd83d40b8aec4d6cb729378f707f6197 , < 3fdd8c83e83fa5e82f1b5585245c51e0355c9f46 (git)
Affected: bee88cd5bd83d40b8aec4d6cb729378f707f6197 , < 2d4a83a44428de45bfe9dccb0192a3711d1097e0 (git)
Affected: bee88cd5bd83d40b8aec4d6cb729378f707f6197 , < 17bd3bd82f9f79f3feba15476c2b2c95a9b11ff8 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.10
Unaffected: 0 , < 6.10 (semver)
Unaffected: 6.10.14 , ≤ 6.10.* (semver)
Unaffected: 6.11.3 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-49979",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-22T13:32:45.687666Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-22T13:38:44.690Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/tcp_offload.c",
            "net/ipv6/tcpv6_offload.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "75733986fcb0725c0033cde94764389e287b331e",
              "status": "affected",
              "version": "c2ea8cab368b9f25b5937a7f07ab1a66e90b8064",
              "versionType": "git"
            },
            {
              "lessThan": "e19201b0c67da5146eaac06fd3d44bd7945c3448",
              "status": "affected",
              "version": "1f2b859225eb8d1ec974214ce4a581f8c528ae57",
              "versionType": "git"
            },
            {
              "lessThan": "3fdd8c83e83fa5e82f1b5585245c51e0355c9f46",
              "status": "affected",
              "version": "bee88cd5bd83d40b8aec4d6cb729378f707f6197",
              "versionType": "git"
            },
            {
              "lessThan": "2d4a83a44428de45bfe9dccb0192a3711d1097e0",
              "status": "affected",
              "version": "bee88cd5bd83d40b8aec4d6cb729378f707f6197",
              "versionType": "git"
            },
            {
              "lessThan": "17bd3bd82f9f79f3feba15476c2b2c95a9b11ff8",
              "status": "affected",
              "version": "bee88cd5bd83d40b8aec4d6cb729378f707f6197",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/tcp_offload.c",
            "net/ipv6/tcpv6_offload.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.14",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.3",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: gso: fix tcp fraglist segmentation after pull from frag_list\n\nDetect tcp gso fraglist skbs with corrupted geometry (see below) and\npass these to skb_segment instead of skb_segment_list, as the first\ncan segment them correctly.\n\nValid SKB_GSO_FRAGLIST skbs\n- consist of two or more segments\n- the head_skb holds the protocol headers plus first gso_size\n- one or more frag_list skbs hold exactly one segment\n- all but the last must be gso_size\n\nOptional datapath hooks such as NAT and BPF (bpf_skb_pull_data) can\nmodify these skbs, breaking these invariants.\n\nIn extreme cases they pull all data into skb linear. For TCP, this\ncauses a NULL ptr deref in __tcpv4_gso_segment_list_csum at\ntcp_hdr(seg-\u003enext).\n\nDetect invalid geometry due to pull, by checking head_skb size.\nDon\u0027t just drop, as this may blackhole a destination. Convert to be\nable to pass to regular skb_segment.\n\nApproach and description based on a patch by Willem de Bruijn."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable geometry is built by GRO from TCP packets received off the wire and destroyed on the egress GSO path of a forwarding host, so a remote attacker anywhere on the internet triggers it purely by sending a back-to-back TCP stream through the router/NAT box or container host. No local access or shared link segment is needed.\nAC:L - Once the (real-world, vendor-shipped) rx-gro-list + NAT/conntrack-helper/BPF datapath is in place, the attacker deterministically creates the condition by sending a burst of TCP segments on a helper-tracked port; there is no race, no memory-layout dependency, and nothing outside the attacker\u0027s control beyond ordinary target configuration.\nPR:N - The code path is reached from raw forwarded TCP packets with no authentication, credential, or capability check anywhere between NAPI receive and the NULL dereference in the segmentation routine.\nUI:N - Packet reception, GRO coalescing, helper linearization, and egress segmentation all occur in softirq context with no action from any local user or administrator.\nS:U - The fault occurs in kernel network code and its impact is confined to the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:N - The defect is a NULL pointer read of `seg-\u003enext-\u003ehead`/`ip_hdr(seg-\u003enext)` that faults immediately; no attacker-controlled memory is read back and no data is returned to the attacker.\nI:N - The `while ((seg = seg-\u003enext))` mangling loop terminates before any write occurs, so the checksum/address rewrites never execute on invalid memory \u2014 there is no out-of-bounds or use-after-free write primitive.\nA:H - The NULL dereference oopses inside the NET_RX softirq on the forwarding path, killing the CPU/interface and typically panicking the router, and it can be re-triggered at will by simply resending traffic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:40:49.381Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/75733986fcb0725c0033cde94764389e287b331e"
        },
        {
          "url": "https://git.kernel.org/stable/c/e19201b0c67da5146eaac06fd3d44bd7945c3448"
        },
        {
          "url": "https://git.kernel.org/stable/c/3fdd8c83e83fa5e82f1b5585245c51e0355c9f46"
        },
        {
          "url": "https://git.kernel.org/stable/c/2d4a83a44428de45bfe9dccb0192a3711d1097e0"
        },
        {
          "url": "https://git.kernel.org/stable/c/17bd3bd82f9f79f3feba15476c2b2c95a9b11ff8"
        }
      ],
      "title": "net: gso: fix tcp fraglist segmentation after pull from frag_list",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-49979",
    "datePublished": "2024-10-21T18:02:25.819Z",
    "dateReserved": "2024-10-21T12:17:06.052Z",
    "dateUpdated": "2026-08-05T11:40:49.381Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-49979",
      "date": "2026-09-16",
      "epss": "0.00593",
      "percentile": "0.46768"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.10\", \"versionEndExcluding\": \"6.10.14\", \"matchCriteriaId\": \"20A9A1A8-B921-4FB1-BC2B-00E240DE3643\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.11\", \"versionEndExcluding\": \"6.11.3\", \"matchCriteriaId\": \"54D9C704-D679-41A7-9C40-10A6B1E7FFE9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"7F361E1D-580F-4A2D-A509-7615F73167A1\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: gso: fix tcp fraglist segmentation after pull from frag_list\\n\\nDetect tcp gso fraglist skbs with corrupted geometry (see below) and\\npass these to skb_segment instead of skb_segment_list, as the first\\ncan segment them correctly.\\n\\nValid SKB_GSO_FRAGLIST skbs\\n- consist of two or more segments\\n- the head_skb holds the protocol headers plus first gso_size\\n- one or more frag_list skbs hold exactly one segment\\n- all but the last must be gso_size\\n\\nOptional datapath hooks such as NAT and BPF (bpf_skb_pull_data) can\\nmodify these skbs, breaking these invariants.\\n\\nIn extreme cases they pull all data into skb linear. For TCP, this\\ncauses a NULL ptr deref in __tcpv4_gso_segment_list_csum at\\ntcp_hdr(seg-\u003enext).\\n\\nDetect invalid geometry due to pull, by checking head_skb size.\\nDon\u0027t just drop, as this may blackhole a destination. Convert to be\\nable to pass to regular skb_segment.\\n\\nApproach and description based on a patch by Willem de Bruijn.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: gso: arregla la segmentaci\\u00f3n de tcp fraglist despu\\u00e9s de extraer de frag_list Detecta skbs tcp gso fraglist con geometr\\u00eda corrupta (ver abajo) y p\\u00e1salos a skb_segment en lugar de a skb_segment_list, ya que el primero puede segmentarlos correctamente. Skbs SKB_GSO_FRAGLIST v\\u00e1lidos: consisten en dos o m\\u00e1s segmentos: el head_skb contiene los encabezados de protocolo m\\u00e1s el primer gso_size: uno o m\\u00e1s skbs frag_list contienen exactamente un segmento: todos menos el \\u00faltimo deben ser gso_size Los ganchos de ruta de datos opcionales como NAT y BPF (bpf_skb_pull_data) pueden modificar estos skbs, rompiendo estos invariantes. En casos extremos, extraen todos los datos en skb lineal. Para TCP, esto provoca un desreferenciado de ptr NULL en __tcpv4_gso_segment_list_csum en tcp_hdr(seg-\u0026gt;next). Detecta geometr\\u00eda no v\\u00e1lida debido a la extracci\\u00f3n, verificando el tama\\u00f1o de head_skb. No lo descartes, ya que esto puede convertir un destino en un agujero negro. Convierte para poder pasar a skb_segment normal. Enfoque y descripci\\u00f3n basados en un parche de Willem de Bruijn.\"}]",
      "id": "CVE-2024-49979",
      "lastModified": "2024-10-29T18:02:14.197",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-10-21T18:15:18.550",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/17bd3bd82f9f79f3feba15476c2b2c95a9b11ff8\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/2d4a83a44428de45bfe9dccb0192a3711d1097e0\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/3fdd8c83e83fa5e82f1b5585245c51e0355c9f46\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-476\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-49979\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-10-21T18:15:18.550\",\"lastModified\":\"2026-08-04T11:21:04.500\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: gso: fix tcp fraglist segmentation after pull from frag_list\\n\\nDetect tcp gso fraglist skbs with corrupted geometry (see below) and\\npass these to skb_segment instead of skb_segment_list, as the first\\ncan segment them correctly.\\n\\nValid SKB_GSO_FRAGLIST skbs\\n- consist of two or more segments\\n- the head_skb holds the protocol headers plus first gso_size\\n- one or more frag_list skbs hold exactly one segment\\n- all but the last must be gso_size\\n\\nOptional datapath hooks such as NAT and BPF (bpf_skb_pull_data) can\\nmodify these skbs, breaking these invariants.\\n\\nIn extreme cases they pull all data into skb linear. For TCP, this\\ncauses a NULL ptr deref in __tcpv4_gso_segment_list_csum at\\ntcp_hdr(seg-\u003enext).\\n\\nDetect invalid geometry due to pull, by checking head_skb size.\\nDon\u0027t just drop, as this may blackhole a destination. Convert to be\\nable to pass to regular skb_segment.\\n\\nApproach and description based on a patch by Willem de Bruijn.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: gso: arregla la segmentaci\u00f3n de tcp fraglist despu\u00e9s de extraer de frag_list Detecta skbs tcp gso fraglist con geometr\u00eda corrupta (ver abajo) y p\u00e1salos a skb_segment en lugar de a skb_segment_list, ya que el primero puede segmentarlos correctamente. Skbs SKB_GSO_FRAGLIST v\u00e1lidos: consisten en dos o m\u00e1s segmentos: el head_skb contiene los encabezados de protocolo m\u00e1s el primer gso_size: uno o m\u00e1s skbs frag_list contienen exactamente un segmento: todos menos el \u00faltimo deben ser gso_size Los ganchos de ruta de datos opcionales como NAT y BPF (bpf_skb_pull_data) pueden modificar estos skbs, rompiendo estos invariantes. En casos extremos, extraen todos los datos en skb lineal. Para TCP, esto provoca un desreferenciado de ptr NULL en __tcpv4_gso_segment_list_csum en tcp_hdr(seg-\u0026gt;next). Detecta geometr\u00eda no v\u00e1lida debido a la extracci\u00f3n, verificando el tama\u00f1o de head_skb. No lo descartes, ya que esto puede convertir un destino en un agujero negro. Convierte para poder pasar a skb_segment normal. Enfoque y descripci\u00f3n basados en un parche de Willem de Bruijn.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/ipv4/tcp_offload.c\",\"net/ipv6/tcpv6_offload.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"c2ea8cab368b9f25b5937a7f07ab1a66e90b8064\",\"lessThan\":\"75733986fcb0725c0033cde94764389e287b331e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1f2b859225eb8d1ec974214ce4a581f8c528ae57\",\"lessThan\":\"e19201b0c67da5146eaac06fd3d44bd7945c3448\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bee88cd5bd83d40b8aec4d6cb729378f707f6197\",\"lessThan\":\"3fdd8c83e83fa5e82f1b5585245c51e0355c9f46\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bee88cd5bd83d40b8aec4d6cb729378f707f6197\",\"lessThan\":\"2d4a83a44428de45bfe9dccb0192a3711d1097e0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bee88cd5bd83d40b8aec4d6cb729378f707f6197\",\"lessThan\":\"17bd3bd82f9f79f3feba15476c2b2c95a9b11ff8\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/ipv4/tcp_offload.c\",\"net/ipv6/tcpv6_offload.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.10\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.10\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10.14\",\"lessThanOrEqual\":\"6.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11.3\",\"lessThanOrEqual\":\"6.11.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-10-22T13:32:45.687666Z\",\"id\":\"CVE-2024-49979\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.10\",\"versionEndExcluding\":\"6.10.14\",\"matchCriteriaId\":\"20A9A1A8-B921-4FB1-BC2B-00E240DE3643\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.11\",\"versionEndExcluding\":\"6.11.3\",\"matchCriteriaId\":\"54D9C704-D679-41A7-9C40-10A6B1E7FFE9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F361E1D-580F-4A2D-A509-7615F73167A1\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/17bd3bd82f9f79f3feba15476c2b2c95a9b11ff8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2d4a83a44428de45bfe9dccb0192a3711d1097e0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3fdd8c83e83fa5e82f1b5585245c51e0355c9f46\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/75733986fcb0725c0033cde94764389e287b331e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e19201b0c67da5146eaac06fd3d44bd7945c3448\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-13T15:42:49+00:00",
      "cve": "CVE-2024-49979",
      "id": "CVE-2024-49979",
      "initial_release_date": "2024-10-21T00:00:00+00:00",
      "product_status:known_affected": "28",
      "product_status:known_not_affected": "170",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: gso: fix tcp fraglist segmentation after pull from frag_list",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-49979.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-30T02:20:22Z",
      "cve": "CVE-2024-49979",
      "id": "CVE-2024-49979",
      "initial_release_date": "2024-10-24T03:18:13Z",
      "product_status:known_not_affected": "477",
      "product_status:recommended": "6",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-49979",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-49979.json",
      "version": "25"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-49979\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-22T13:32:45.687666Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-22T13:32:48.928Z\"}}], \"cna\": {\"title\": \"net: gso: fix tcp fraglist segmentation after pull from frag_list\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"c2ea8cab368b9f25b5937a7f07ab1a66e90b8064\", \"lessThan\": \"75733986fcb0725c0033cde94764389e287b331e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1f2b859225eb8d1ec974214ce4a581f8c528ae57\", \"lessThan\": \"e19201b0c67da5146eaac06fd3d44bd7945c3448\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"bee88cd5bd83d40b8aec4d6cb729378f707f6197\", \"lessThan\": \"3fdd8c83e83fa5e82f1b5585245c51e0355c9f46\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"bee88cd5bd83d40b8aec4d6cb729378f707f6197\", \"lessThan\": \"2d4a83a44428de45bfe9dccb0192a3711d1097e0\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"bee88cd5bd83d40b8aec4d6cb729378f707f6197\", \"lessThan\": \"17bd3bd82f9f79f3feba15476c2b2c95a9b11ff8\", \"versionType\": \"git\"}], \"programFiles\": [\"net/ipv4/tcp_offload.c\", \"net/ipv6/tcpv6_offload.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.10\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.10\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.10.14\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/ipv4/tcp_offload.c\", \"net/ipv6/tcpv6_offload.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/75733986fcb0725c0033cde94764389e287b331e\"}, {\"url\": \"https://git.kernel.org/stable/c/e19201b0c67da5146eaac06fd3d44bd7945c3448\"}, {\"url\": \"https://git.kernel.org/stable/c/3fdd8c83e83fa5e82f1b5585245c51e0355c9f46\"}, {\"url\": \"https://git.kernel.org/stable/c/2d4a83a44428de45bfe9dccb0192a3711d1097e0\"}, {\"url\": \"https://git.kernel.org/stable/c/17bd3bd82f9f79f3feba15476c2b2c95a9b11ff8\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: gso: fix tcp fraglist segmentation after pull from frag_list\\n\\nDetect tcp gso fraglist skbs with corrupted geometry (see below) and\\npass these to skb_segment instead of skb_segment_list, as the first\\ncan segment them correctly.\\n\\nValid SKB_GSO_FRAGLIST skbs\\n- consist of two or more segments\\n- the head_skb holds the protocol headers plus first gso_size\\n- one or more frag_list skbs hold exactly one segment\\n- all but the last must be gso_size\\n\\nOptional datapath hooks such as NAT and BPF (bpf_skb_pull_data) can\\nmodify these skbs, breaking these invariants.\\n\\nIn extreme cases they pull all data into skb linear. For TCP, this\\ncauses a NULL ptr deref in __tcpv4_gso_segment_list_csum at\\ntcp_hdr(seg-\u003enext).\\n\\nDetect invalid geometry due to pull, by checking head_skb size.\\nDon\u0027t just drop, as this may blackhole a destination. Convert to be\\nable to pass to regular skb_segment.\\n\\nApproach and description based on a patch by Willem de Bruijn.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.14\", \"versionStartIncluding\": \"6.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.3\", \"versionStartIncluding\": \"6.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"6.10\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-03-25T10:19:13.154Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-49979\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-03-25T10:19:13.154Z\", \"dateReserved\": \"2024-10-21T12:17:06.052Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-10-21T18:02:25.819Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.